cerber | hxxps://cdn[.]discordapp[.]com/attachments/1345777490567888979/1350771897146540073/Frog_Spoofer[.]exe?ex=67d7f3dc&is=67d6a25c&hm=26ceebd9a9beb7e362fb8031bb6cad27f60bab0d187b56d4a0236c390e4cd62c&

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\Control Panel\International\Geo\Nation	Frog Spoofer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\Control Panel\International\Geo\Nation	ntelidcx.dll

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 64 IoCs

pid	Process
6020	Frog Spoofer.exe
3508	dxwebsetup.exe
2708	dxwsetup.exe
10388	infinst.exe
10668	infinst.exe
10948	infinst.exe
11236	infinst.exe
11488	infinst.exe
11760	infinst.exe
12112	infinst.exe
12384	infinst.exe
3968	infinst.exe
12904	infinst.exe
13112	infinst.exe
2332	infinst.exe
6152	infinst.exe
896	infinst.exe
7632	infinst.exe
7256	infinst.exe
6880	infinst.exe
6220	infinst.exe
3952	infinst.exe
5016	infinst.exe
8324	infinst.exe
4856	infinst.exe
3728	infinst.exe
8860	infinst.exe
9200	infinst.exe
9488	infinst.exe
9820	infinst.exe
10136	infinst.exe
10376	infinst.exe
10836	infinst.exe
11148	infinst.exe
11384	infinst.exe
11640	infinst.exe
11992	infinst.exe
8060	infinst.exe
4328	infinst.exe
5004	infinst.exe
3204	infinst.exe
3588	infinst.exe
3896	infinst.exe
12772	infinst.exe
13232	infinst.exe
2764	infinst.exe
4664	infinst.exe
7392	infinst.exe
7572	infinst.exe
6848	infinst.exe
6740	infinst.exe
6116	infinst.exe
6796	infinst.exe
8260	infinst.exe
8544	infinst.exe
6032	infinst.exe
8708	infinst.exe
9084	infinst.exe
9376	infinst.exe
9676	infinst.exe
9976	infinst.exe
4612	infinst.exe
10376	infinst.exe
10844	infinst.exe

Loads dropped DLL 64 IoCs

pid	Process
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
12160	regsvr32.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
2708	dxwsetup.exe
12736	regsvr32.exe
2708	dxwsetup.exe
13204	regsvr32.exe
2708	dxwsetup.exe
5928	regsvr32.exe
2708	dxwsetup.exe
7696	regsvr32.exe
2708	dxwsetup.exe
6280	regsvr32.exe
2708	dxwsetup.exe
5500	regsvr32.exe
2708	dxwsetup.exe
2744	regsvr32.exe
2708	dxwsetup.exe
9524	regsvr32.exe
2708	dxwsetup.exe
10536	regsvr32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dxwebsetup.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	dxwsetup.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	dxwsetup.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\B:	dxwsetup.exe
File opened (read-only)	\??\I:	dxwsetup.exe
File opened (read-only)	\??\L:	dxwsetup.exe
File opened (read-only)	\??\M:	dxwsetup.exe
File opened (read-only)	\??\N:	dxwsetup.exe
File opened (read-only)	\??\R:	dxwsetup.exe
File opened (read-only)	\??\Y:	dxwsetup.exe
File opened (read-only)	\??\G:	dxwsetup.exe
File opened (read-only)	\??\Q:	dxwsetup.exe
File opened (read-only)	\??\V:	dxwsetup.exe
File opened (read-only)	\??\W:	dxwsetup.exe
File opened (read-only)	\??\D:	dxwsetup.exe
File opened (read-only)	\??\H:	dxwsetup.exe
File opened (read-only)	\??\J:	dxwsetup.exe
File opened (read-only)	\??\O:	dxwsetup.exe
File opened (read-only)	\??\S:	dxwsetup.exe
File opened (read-only)	\??\T:	dxwsetup.exe
File opened (read-only)	\??\U:	dxwsetup.exe
File opened (read-only)	\??\X:	dxwsetup.exe
File opened (read-only)	\??\A:	dxwsetup.exe
File opened (read-only)	\??\K:	dxwsetup.exe
File opened (read-only)	\??\P:	dxwsetup.exe
File opened (read-only)	\??\Z:	dxwsetup.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2006_xinput_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2008_x3daudio_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2009_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\system32\SET47DD.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET5B1C.tmp	dxwsetup.exe
File created	C:\Windows\system32\SET5F9B.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SET7979.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET794D.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\DirectX\WebSetup\filelist.dat	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2008_d3dx9_38_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Mar2009_xaudio_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET5C28.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\D3DCompiler_43.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_26.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_31.dll	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET5664.tmp	infinst.exe
File opened for modification	C:\Windows\system32\xactengine2_8.dll	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2010_d3dx9_43_x64.cab	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_27.dll	dxwsetup.exe
File created	C:\Windows\system32\SET551B.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET59A2.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\SET6A5A.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\D3DCompiler_43.dll	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Aug2006_xact_x64.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\SET481E.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SET4F6B.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\D3DCompiler_34.dll	dxwsetup.exe
File opened for modification	C:\Windows\system32\xactengine2_9.dll	infinst.exe
File created	C:\Windows\SysWOW64\SET6550.tmp	dxwsetup.exe
File created	C:\Windows\system32\SET5B46.tmp	infinst.exe
File opened for modification	C:\Windows\system32\XAudio2_1.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET661D.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET6901.tmp	dxwsetup.exe
File created	C:\Windows\system32\SET696E.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET71AC.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET78FB.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SET49D6.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\SET4A93.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET4DE2.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\xactengine2_6.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SET6748.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\d3dcsx_42.dll	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Feb2010_x3daudio_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2010_d3dcsx_43_x64.cab	dxwsetup.exe
File created	C:\Windows\system32\SET4ADA.tmp	infinst.exe
File opened for modification	C:\Windows\system32\xactengine2_4.dll	infinst.exe
File created	C:\Windows\system32\SET57DA.tmp	infinst.exe
File created	C:\Windows\system32\SET66AF.tmp	infinst.exe
File opened for modification	C:\Windows\system32\SET677A.tmp	infinst.exe
File opened for modification	C:\Windows\system32\xactengine3_4.dll	infinst.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Jun2008_xact_x86.cab	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\MDX_1.0.2903.0_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\system32\d3dx9_28.dll	infinst.exe
File created	C:\Windows\SysWOW64\SET4F1C.tmp	dxwsetup.exe
File opened for modification	C:\Windows\system32\D3DCompiler_35.dll	infinst.exe
File opened for modification	C:\Windows\system32\X3DAudio1_3.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\xactengine3_2.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET7599.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\SET49D6.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\DirectX\WebSetup\Apr2006_MDX1_x86.cab	dxwsetup.exe
File opened for modification	C:\Windows\system32\d3dx9_33.dll	infinst.exe
File created	C:\Windows\SysWOW64\SET5D14.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\xactengine3_1.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\XAPOFX1_0.dll	dxwsetup.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

Hidden Files and Directories

T1564.001

pid	Process
1672	cmd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2908.0\Microsoft.DirectX.Direct3DX.xml	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\assembly\tmp\R1XFV3AZ\__AssemblyInfo__.ini	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\assembly\tmp\O32JTAQU\__AssemblyInfo__.ini	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2903.0\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File created	C:\Windows\assembly\tmp\5ZY4HSUI\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File created	C:\Windows\assembly\tmp\R1XFV3AZ\Microsoft.DirectX.Direct3D.dll	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\AppVLicense.dll	Frog Spoofer.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Diagnostics.xml	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2905.0\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\ntelidcx.dll	Frog Spoofer.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2905.0\Microsoft.DirectX.Direct3DX.xml	dxwsetup.exe
File opened for modification	C:\Windows\assembly\tmp\EXYEUXLK\__AssemblyInfo__.ini	dxwsetup.exe
File created	C:\Windows\assembly\tmp\83O2AQBT\Microsoft.DirectX.DirectDraw.dll	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\assembly\tmp\30ROE94Y\__AssemblyInfo__.ini	dxwsetup.exe
File created	C:\Windows\assembly\tmp\ZJ7UBF2L\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2904.0\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File created	C:\Windows\assembly\tmp\PAHKZR8T\Microsoft.DirectX.Diagnostics.dll	dxwsetup.exe
File opened for modification	C:\Windows\assembly\tmp\PAHKZR8T\__AssemblyInfo__.ini	dxwsetup.exe
File opened for modification	C:\Windows\assembly\tmp\QPGYXX48\__AssemblyInfo__.ini	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectPlay.xml	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.dll	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe
File opened for modification	C:\Windows\assembly\tmp\ZJ7UBF2L\__AssemblyInfo__.ini	dxwsetup.exe
File opened for modification	C:\Windows\assembly\tmp\TUHHWS6X\__AssemblyInfo__.ini	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2910.0\Microsoft.DirectX.Direct3DX.xml	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.AudioVideoPlayback.dll	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File created	C:\Windows\assembly\Desktop.ini	dxwsetup.exe
File created	C:\Windows\assembly\tmp\30ROE94Y\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2906.0\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2911.0\Microsoft.DirectX.Direct3DX.xml	dxwsetup.exe
File opened for modification	C:\Windows\assembly\tmp\T0SHZK8Q\__AssemblyInfo__.ini	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectInput.dll	dxwsetup.exe
File opened for modification	C:\Windows\DirectX.log	infinst.exe
File created	C:\Windows\assembly\tmp\L7BLPM4B\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.dll	dxwsetup.exe
File created	C:\Windows\assembly\tmp\1IHJU2O8\Microsoft.DirectX.AudioVideoPlayback.dll	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectDraw.dll	dxwsetup.exe
File created	C:\Windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectDraw.xml	dxwsetup.exe
File opened for modification	C:\Windows\Logs\DirectX.log	infinst.exe

Launches sc.exe 21 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
9040	sc.exe
9064	sc.exe
9288	sc.exe
8984	sc.exe
8988	sc.exe
9044	sc.exe
9212	sc.exe
9300	sc.exe
8660	sc.exe
8852	sc.exe
8460	sc.exe
8816	sc.exe
8912	sc.exe
9132	sc.exe
5844	sc.exe
9440	sc.exe
380	sc.exe
1912	sc.exe
8792	sc.exe
8876	sc.exe
8964	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

persistence privilege_escalation

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\dxwebsetup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Frog Spoofer.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntelidcx.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxwebsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppVLicense.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxwsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 58 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Kills process with taskkill 39 IoCs

pid	Process
10024	taskkill.exe
8640	taskkill.exe
10252	taskkill.exe
9908	taskkill.exe
10012	taskkill.exe
8428	taskkill.exe
5108	taskkill.exe
9492	taskkill.exe
9548	taskkill.exe
9600	taskkill.exe
9716	taskkill.exe
8532	taskkill.exe
8588	taskkill.exe
9760	taskkill.exe
9832	taskkill.exe
9888	taskkill.exe
10076	taskkill.exe
10116	taskkill.exe
10196	taskkill.exe
8300	taskkill.exe
10168	taskkill.exe
8684	taskkill.exe
9028	taskkill.exe
9644	taskkill.exe
9640	taskkill.exe
9764	taskkill.exe
9788	taskkill.exe
9960	taskkill.exe
10060	taskkill.exe
10156	taskkill.exe
10364	taskkill.exe
8544	taskkill.exe
9576	taskkill.exe
10188	taskkill.exe
10280	taskkill.exe
8480	taskkill.exe
4680	taskkill.exe
9856	taskkill.exe
10296	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Registration	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Registration\ProductId = "00331-10000-00001-A79DB"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\svcKBNumber = "KB3170202"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Migration	reg.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Migration\IE Installed Date = 1502026740	reg.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\ = "XAudio2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\ = "AudioVolumeMeter"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9cab402c-1d37-44b4-886d-fa4f36170a4c}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0977d092-2d95-4e43-8d42-9ddcc2545ed5}\ = "XACT Engine"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f1b577e-5e5a-4e8a-ba73-c657ea8e8598}	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77c56bf4-18a1-42b0-88af-5072ce814949}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{343e68e6-8f82-4a8d-a2da-6e9a944b378c}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_9.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{629cf0de-3ecc-41e7-9926-f7e43eebec51}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_4.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionInv	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\ = "XACT Engine"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e21a7345-eb21-468e-be50-804db97cf708}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_1.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_5.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\ = "AudioReverb"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f4769300-b949-4df9-b333-00d33932e9a6}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c7338b95-52b8-4542-aa79-42eb016c8c1c}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_4.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8bb7778b-645b-4475-9a73-1de3170bd3af}\ = "AudioReverb"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b802058a-464a-42db-bc10-b650d6f2586a}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3eda9b49-2085-498b-9bb2-39a6778493de}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_6.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\ = "XACT Engine"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9cab402c-1d37-44b4-886d-fa4f36170a4c}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionInv = "{27720B92-23BD-4430-23BD-92244F709F57}"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4c5e637a-16c7-4de3-9c46-5ed22181962d}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248d8a3b-6256-44d3-a018-2ac96c459f47}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine3_6.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_0.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\ = "AudioReverb"	dxwsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings\Software\Microsoft\Windows	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c60fae90-4183-4a3f-b2f7-ac1dc49b0e5c}\ = "XACT Engine"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine2_6.dll"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3a2495ce-31d0-435b-8ccf-e9f0843fd960}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3b80ee2a-b0f5-4780-9e30-90cb39685b03}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d06df0d0-8518-441e-822f-5451d5c595b8}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\ = "XAudio2"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_7.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0aa000aa-f404-11d9-bd7a-0010dc4f8f81}\ = "XACT Engine"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f6ea3a9-2cf5-41cf-91c1-2170b1540063}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94c1affa-66e7-4961-9521-cfdef3128d4f}\InProcServer32\ = "C:\\Windows\\SysWow64\\xactengine3_3.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e180344b-ac83-4483-959e-18a5c56a5e19}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e180344b-ac83-4483-959e-18a5c56a5e19}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_3.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{074b110f-7f58-4743-aea5-12f15b5074ed}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c0c56f46-29b1-44e9-9939-a32ce86867e2}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cecec95a-d894-491a-bee3-5e106fb59f2d}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_6.dll"	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{bcc782bc-6492-4c22-8c35-f5d72fe73c6e}\InProcServer32\ThreadingModel = "Both"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2139e6da-c341-4774-9ac3-b4e026347f64}\InProcServer32	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e48c5a3f-93ef-43bb-a092-2c7ceb946f27}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_6.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bc3e0fc6-2e0d-4c45-bc61-d9c328319bd8}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9cab402c-1d37-44b4-886d-fa4f36170a4c}\ = "AudioReverb"	dxwsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1138472b-d187-44e9-81f2-ae1b0e7785f1}	dxwsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bc3e0fc6-2e0d-4c45-bc61-d9c328319bd8}\InProcServer32\ = "C:\\Windows\\system32\\xactengine2_4.dll"	regsvr32.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\dxwebsetup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Frog Spoofer.exe:Zone.Identifier	firefox.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe
8204	Frog Spoofer.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
8204	Frog Spoofer.exe
3264	Frog Spoofer.exe
8204	Frog Spoofer.exe
3264	Frog Spoofer.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1048	firefox.exe
Token: SeDebugPrivilege	1048	firefox.exe
Token: SeDebugPrivilege	4852	firefox.exe
Token: SeDebugPrivilege	4852	firefox.exe
Token: SeBackupPrivilege	8028	vssvc.exe
Token: SeRestorePrivilege	8028	vssvc.exe
Token: SeAuditPrivilege	8028	vssvc.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	2708	dxwsetup.exe
Token: SeDebugPrivilege	8300	taskkill.exe
Token: SeDebugPrivilege	8428	taskkill.exe
Token: SeDebugPrivilege	8480	taskkill.exe
Token: SeDebugPrivilege	8532	taskkill.exe
Token: SeDebugPrivilege	8544	taskkill.exe
Token: SeDebugPrivilege	5108	taskkill.exe
Token: SeDebugPrivilege	4680	taskkill.exe
Token: SeDebugPrivilege	8588	taskkill.exe
Token: SeDebugPrivilege	8640	taskkill.exe
Token: SeDebugPrivilege	8684	taskkill.exe
Token: SeIncreaseQuotaPrivilege	11872	WMIC.exe
Token: SeSecurityPrivilege	11872	WMIC.exe
Token: SeTakeOwnershipPrivilege	11872	WMIC.exe
Token: SeLoadDriverPrivilege	11872	WMIC.exe
Token: SeSystemProfilePrivilege	11872	WMIC.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
4852	firefox.exe
4852	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
4852	firefox.exe
4852	firefox.exe

Suspicious use of SetWindowsHookEx 42 IoCs

pid	Process
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
8204	Frog Spoofer.exe
3264	Frog Spoofer.exe
3264	Frog Spoofer.exe
3264	Frog Spoofer.exe
3264	Frog Spoofer.exe
3264	Frog Spoofer.exe
3264	Frog Spoofer.exe
3264	Frog Spoofer.exe
3264	Frog Spoofer.exe
3264	Frog Spoofer.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
1048	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
4852	firefox.exe
8204	Frog Spoofer.exe
3264	Frog Spoofer.exe
3264	Frog Spoofer.exe
3264	Frog Spoofer.exe
3264	Frog Spoofer.exe
3264	Frog Spoofer.exe
3264	Frog Spoofer.exe
3264	Frog Spoofer.exe
3264	Frog Spoofer.exe
3264	Frog Spoofer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5888 wrote to memory of 1048	5888	firefox.exe	81
PID 5888 wrote to memory of 1048	5888	firefox.exe	81
PID 5888 wrote to memory of 1048	5888	firefox.exe	81
PID 5888 wrote to memory of 1048	5888	firefox.exe	81
PID 5888 wrote to memory of 1048	5888	firefox.exe	81
PID 5888 wrote to memory of 1048	5888	firefox.exe	81
PID 5888 wrote to memory of 1048	5888	firefox.exe	81
PID 5888 wrote to memory of 1048	5888	firefox.exe	81
PID 5888 wrote to memory of 1048	5888	firefox.exe	81
PID 5888 wrote to memory of 1048	5888	firefox.exe	81
PID 5888 wrote to memory of 1048	5888	firefox.exe	81
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 2824	1048	firefox.exe	82
PID 1048 wrote to memory of 4444	1048	firefox.exe	83
PID 1048 wrote to memory of 4444	1048	firefox.exe	83
PID 1048 wrote to memory of 4444	1048	firefox.exe	83
PID 1048 wrote to memory of 4444	1048	firefox.exe	83
PID 1048 wrote to memory of 4444	1048	firefox.exe	83
PID 1048 wrote to memory of 4444	1048	firefox.exe	83
PID 1048 wrote to memory of 4444	1048	firefox.exe	83
PID 1048 wrote to memory of 4444	1048	firefox.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

Hidden Files and Directories

T1564.001

pid	Process
12608	attrib.exe
11896	attrib.exe

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://cdn.discordapp.com/attachments/1345777490567888979/1350771897146540073/Frog_Spoofer.exe?ex=67d7f3dc&is=67d6a25c&hm=26ceebd9a9beb7e362fb8031bb6cad27f60bab0d187b56d4a0236c390e4cd62c&"
1⤵
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://cdn.discordapp.com/attachments/1345777490567888979/1350771897146540073/Frog_Spoofer.exe?ex=67d7f3dc&is=67d6a25c&hm=26ceebd9a9beb7e362fb8031bb6cad27f60bab0d187b56d4a0236c390e4cd62c&
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27100 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {ff740f82-20d0-4089-9e8f-ae308dedbc85} -parentPid 1048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1048" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2488 -prefsLen 27136 -prefMapHandle 2492 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {38672e72-ef22-436e-9bad-b458b51f5531} -parentPid 1048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3708 -prefsLen 25164 -prefMapHandle 3712 -prefMapSize 270279 -jsInitHandle 3716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3724 -initialChannelId {1f892a92-e444-4bae-846e-99bc87c1bd81} -parentPid 1048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3880 -prefsLen 27277 -prefMapHandle 3884 -prefMapSize 270279 -ipcHandle 3964 -initialChannelId {7bf77e1f-06d7-4f1f-b821-1ddb972d51b9} -parentPid 1048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1048" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:6032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4436 -prefsLen 34776 -prefMapHandle 4440 -prefMapSize 270279 -jsInitHandle 4444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4416 -initialChannelId {d580674f-327f-454f-ace7-8d3b14a8c94b} -parentPid 1048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5028 -prefsLen 35013 -prefMapHandle 5032 -prefMapSize 270279 -ipcHandle 5052 -initialChannelId {e000b7a1-5377-4b78-ac40-c5d1eeb87df4} -parentPid 1048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:4960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5500 -prefsLen 32952 -prefMapHandle 5504 -prefMapSize 270279 -jsInitHandle 4980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5424 -initialChannelId {a5a87b6d-4ff5-42e1-9c29-0d5caff20e69} -parentPid 1048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5620 -prefsLen 32952 -prefMapHandle 5624 -prefMapSize 270279 -jsInitHandle 5628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5632 -initialChannelId {747a9fd1-7c61-4f51-96ba-1cb3b58f3131} -parentPid 1048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:1792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5800 -prefsLen 32952 -prefMapHandle 5796 -prefMapSize 270279 -jsInitHandle 5792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5620 -initialChannelId {a4748872-10f6-4c9f-84ce-4d3d24ed30fa} -parentPid 1048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5860

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2836

C:\Users\Admin\Desktop\Frog Spoofer.exe
"C:\Users\Admin\Desktop\Frog Spoofer.exe"
1⤵
- Executes dropped EXE
PID:6020

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1652
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2032 -prefsLen 27060 -prefMapHandle 2036 -prefMapSize 270315 -ipcHandle 2124 -initialChannelId {d0a01fe5-1f32-41e9-9ad9-8dd8970c087f} -parentPid 4852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4852" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2372 -prefsLen 27060 -prefMapHandle 2376 -prefMapSize 270315 -ipcHandle 2396 -initialChannelId {2d1c7fc5-2647-4a9c-8b52-f58209ee4a92} -parentPid 4852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4080 -prefsLen 27668 -prefMapHandle 4084 -prefMapSize 270315 -jsInitHandle 4088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4100 -initialChannelId {0a511329-cd84-46d1-875d-e2231175a26e} -parentPid 4852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4296 -prefsLen 27668 -prefMapHandle 4300 -prefMapSize 270315 -ipcHandle 4308 -initialChannelId {fc532617-c368-4483-bd33-c0249bae2161} -parentPid 4852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4852" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4564
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4860 -prefsLen 35224 -prefMapHandle 4864 -prefMapSize 270315 -jsInitHandle 4868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4760 -initialChannelId {1a65c854-3f03-4543-9771-500944933781} -parentPid 4852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:1256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5516 -prefsLen 35278 -prefMapHandle 5520 -prefMapSize 270315 -ipcHandle 5528 -initialChannelId {2f1b847f-e4da-4789-9b6c-693391a0b4a9} -parentPid 4852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5700 -prefsLen 33279 -prefMapHandle 5704 -prefMapSize 270315 -jsInitHandle 5708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4676 -initialChannelId {03edf93a-142c-4f31-9764-21fb083eae5f} -parentPid 4852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5864 -prefsLen 33279 -prefMapHandle 5868 -prefMapSize 270315 -jsInitHandle 5872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5828 -initialChannelId {1f1777cc-6871-4f60-9216-5240aa7e431e} -parentPid 4852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:3904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6072 -prefsLen 33279 -prefMapHandle 6076 -prefMapSize 270315 -jsInitHandle 6080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6088 -initialChannelId {75b59e18-3921-4134-894a-bb13024b1869} -parentPid 4852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:3644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6436 -prefsLen 33279 -prefMapHandle 6440 -prefMapSize 270315 -jsInitHandle 6444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6452 -initialChannelId {bf3c6a18-1300-4f89-bdae-71da7befb288} -parentPid 4852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6340 -prefsLen 33279 -prefMapHandle 5768 -prefMapSize 270315 -jsInitHandle 6712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6660 -initialChannelId {932607e1-651b-4b84-9956-16cc25a837e8} -parentPid 4852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:4840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6932 -prefsLen 35409 -prefMapHandle 6936 -prefMapSize 270315 -ipcHandle 6916 -initialChannelId {e4ebd9da-ce84-4ec4-8c3a-014766867f6a} -parentPid 4852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility
    3⤵
    - Checks processor information in registry
    PID:4384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7264 -prefsLen 33279 -prefMapHandle 7324 -prefMapSize 270315 -jsInitHandle 7328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6576 -initialChannelId {7b784036-29bb-42e3-a5ea-471817cc0e84} -parentPid 4852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7572 -prefsLen 33279 -prefMapHandle 7468 -prefMapSize 270315 -jsInitHandle 7448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6440 -initialChannelId {edafd01a-08b3-4cd5-b464-b5ffff87f95e} -parentPid 4852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:3184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7352 -prefsLen 33279 -prefMapHandle 7428 -prefMapSize 270315 -jsInitHandle 7416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6888 -initialChannelId {963f3f1c-4c16-4e9a-b59f-c2bd29980cde} -parentPid 4852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:5892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6472 -prefsLen 33279 -prefMapHandle 6460 -prefMapSize 270315 -jsInitHandle 6416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7504 -initialChannelId {9daca26a-b80c-4973-ab74-85942a9a9bc6} -parentPid 4852 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4852" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:2872
- - C:\Users\Admin\Downloads\dxwebsetup.exe
    "C:\Users\Admin\Downloads\dxwebsetup.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops desktop.ini file(s)
      Enumerates connected drives
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx9_24_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:10388
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx9_25_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:10668
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx9_26_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:10948
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx9_27_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:11236
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx9_28_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:11488
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx9_29_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:11760
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XACT_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:12112
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll
        5⤵
        Loads dropped DLL
        
        PID:12160
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx9_30_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:12384
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XACT2_1_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:3968
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll
        5⤵
        Loads dropped DLL
        
        PID:12736
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:12904
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XACT2_2_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:13112
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:13204
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XACT2_3_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:6152
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx9_31_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:896
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XACT2_4_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:7632
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx9_32_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:7256
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx10_00_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XACT2_5_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:6220
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll
        5⤵
        Loads dropped DLL
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XACT2_6_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:3952
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx9_33_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx10_33_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:8324
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XACT2_7_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4856
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll
        5⤵
        Loads dropped DLL
        
        PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver
        5⤵
        Executes dropped EXE
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx9_34_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx10_34_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:9200
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XACT2_8_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:9488
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll
        5⤵
        Loads dropped DLL
        
        PID:9524
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx9_35_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx10_35_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:10136
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XACT2_9_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:10376
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:10536
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx9_36_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:10836
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx10_36_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:11148
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe X3DAudio1_2_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:11384
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XACT2_10_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:11640
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll
        5⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe D3DX9_37_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:11992
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx10_37_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe X3DAudio1_3_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XACT3_0_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5004
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll
        5⤵
        Modifies registry class
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XAudio2_0_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:3204
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll
        5⤵
        Modifies registry class
        
        PID:12688
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe D3DX9_38_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx10_38_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe X3DAudio1_4_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:12772
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XACT3_1_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:13232
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll
        5⤵
        
        PID:13300
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XAudio2_1_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:2764
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll
        5⤵
        Modifies registry class
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe D3DX9_39_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx10_39_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XACT3_2_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:7572
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll
        5⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XAudio2_2_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:6848
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll
        5⤵
        Modifies registry class
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe X3DAudio1_5_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XACT3_3_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6116
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll
        5⤵
        
        PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XAudio2_3_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6796
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll
        5⤵
        Modifies registry class
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe D3DX9_40_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx10_40_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:8544
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe X3DAudio1_6_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XACT3_4_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:8708
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll
        5⤵
        
        PID:8732
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XAudio2_4_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:9084
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll
        5⤵
        Modifies registry class
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe D3DX9_41_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:9376
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx10_41_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe D3DX9_42_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx10_42_x64.inf
        5⤵
        Executes dropped EXE
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx11_42_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:10376
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dcsx_42_x64.inf
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:10844
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe D3DCompiler_42_x64.inf
        5⤵
        
        PID:11100
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XACT3_5_x64.inf
        5⤵
        Drops file in Windows directory
        
        PID:11328
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_5.dll
        5⤵
        
        PID:11332
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XAudio2_5_x64.inf
        5⤵
        Drops file in Windows directory
        
        PID:11628
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_5.dll
        5⤵
        Modifies registry class
        
        PID:11732
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe X3DAudio1_7_x64.inf
        5⤵
        Drops file in Windows directory
        
        PID:12080
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XACT3_6_x64.inf
        5⤵
        
        PID:12312
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_6.dll
        5⤵
        
        PID:12340
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XAudio2_6_x64.inf
        5⤵
        Drops file in Windows directory
        
        PID:5608
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_6.dll
        5⤵
        Modifies registry class
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe D3DX9_43_x64.inf
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx10_43_x64.inf
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dx11_43_x64.inf
        5⤵
        Drops file in System32 directory
        
        PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe d3dcsx_43_x64.inf
        5⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe D3DCompiler_43_x64.inf
        5⤵
        Drops file in System32 directory
        
        PID:12792
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XACT3_7_x64.inf
        5⤵
        
        PID:2272
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll
        5⤵
        Modifies registry class
        
        PID:760
    - - C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe
        
        C:\Users\Admin\AppData\Local\Temp\DX2B3D.tmp\infinst.exe XAudio2_7_x64.inf
        5⤵
        Drops file in Windows directory
        
        PID:1644
    - - C:\Windows\system32\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll
        5⤵
        Modifies registry class
        
        PID:4252

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:8028

C:\Users\Admin\Desktop\Frog Spoofer.exe
"C:\Users\Admin\Desktop\Frog Spoofer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:8204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
  2⤵
  PID:7992
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerUI.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:8300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
  2⤵
  PID:8396
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerSvc.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:8428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  PID:8448
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:8460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  PID:8476
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:8480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  PID:8512
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:8532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  PID:3692
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:8544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c slmgr /ipk
  2⤵
  - Checks computer location settings
  PID:2260
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ipk
    3⤵
    PID:3888

C:\Users\Admin\Desktop\Frog Spoofer.exe
"C:\Users\Admin\Desktop\Frog Spoofer.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
  2⤵
  PID:4880
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerUI.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
  2⤵
  PID:5036
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerSvc.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  PID:2748
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  PID:8620
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:8588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  PID:8652
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:8640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  PID:8664
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:8684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  PID:8724
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:1912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
  2⤵
  PID:8756
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:8660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
  2⤵
  PID:8732
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    PID:8792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
  2⤵
  PID:8808
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:8816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
  2⤵
  PID:8832
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    - Launches sc.exe
    PID:8852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop cpuz150 >nul 2>&1
  2⤵
  PID:8868
- - C:\Windows\system32\sc.exe
    sc stop cpuz150
    3⤵
    - Launches sc.exe
    PID:8876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgt >nul 2>&1
  2⤵
  PID:8900
- - C:\Windows\system32\sc.exe
    sc stop vgt
    3⤵
    - Launches sc.exe
    PID:8912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgrl >nul 2>&1
  2⤵
  PID:8928
- - C:\Windows\system32\sc.exe
    sc stop vgrl
    3⤵
    - Launches sc.exe
    PID:8964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgk >nul 2>&1
  2⤵
  PID:8968
- - C:\Windows\system32\sc.exe
    sc stop vgk
    3⤵
    - Launches sc.exe
    PID:8984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&1
  2⤵
  PID:8996
- - C:\Windows\system32\sc.exe
    sc stop vgc
    3⤵
    - Launches sc.exe
    PID:8988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete vgrl >nul 2>&1
  2⤵
  PID:9008
- - C:\Windows\system32\sc.exe
    sc delete vgrl
    3⤵
    - Launches sc.exe
    PID:9040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete vgk >nul 2>&1
  2⤵
  PID:9052
- - C:\Windows\system32\sc.exe
    sc delete vgk
    3⤵
    - Launches sc.exe
    PID:9044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete vgc >nul 2>&1
  2⤵
  PID:9100
- - C:\Windows\system32\sc.exe
    sc delete vgc
    3⤵
    - Launches sc.exe
    PID:9064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete vg >nul 2>&1
  2⤵
  PID:9124
- - C:\Windows\system32\sc.exe
    sc delete vg
    3⤵
    - Launches sc.exe
    PID:9132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im vgtray.exe >nul 2>&1
  2⤵
  PID:9152
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im vgtray.exe
    3⤵
    - Kills process with taskkill
    PID:9028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc delete cpuz150 >nul 2>&1
  2⤵
  PID:9208
- - C:\Windows\system32\sc.exe
    sc delete cpuz150
    3⤵
    - Launches sc.exe
    PID:9212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config wuauserv start = disabled >nul 2>&1
  2⤵
  PID:5076
- - C:\Windows\system32\sc.exe
    sc config wuauserv start = disabled
    3⤵
    - Launches sc.exe
    PID:5844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop wuauserv >nul 2>&1
  2⤵
  PID:4428
- - C:\Windows\system32\net.exe
    net stop wuauserv
    3⤵
    PID:9228
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:9248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config bits start = disabled >nul 2>&1
  2⤵
  PID:9268
- - C:\Windows\system32\sc.exe
    sc config bits start = disabled
    3⤵
    - Launches sc.exe
    PID:9288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop bits >nul 2>&1
  2⤵
  PID:9312
- - C:\Windows\system32\net.exe
    net stop bits
    3⤵
    PID:9308
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop bits
      4⤵
      PID:1616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config dosvc start = disabled >nul 2>&1
  2⤵
  PID:9344
- - C:\Windows\system32\sc.exe
    sc config dosvc start = disabled
    3⤵
    - Launches sc.exe
    PID:9300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop dosvc >nul 2>&1
  2⤵
  PID:9352
- - C:\Windows\system32\net.exe
    net stop dosvc
    3⤵
    PID:9372
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop dosvc
      4⤵
      PID:9396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config UsoSvc start = disabled >nul 2>&1
  2⤵
  PID:9416
- - C:\Windows\system32\sc.exe
    sc config UsoSvc start = disabled
    3⤵
    - Launches sc.exe
    PID:9440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop UsoSvc >nul 2>&1
  2⤵
  PID:9460
- - C:\Windows\system32\net.exe
    net stop UsoSvc
    3⤵
    PID:9448
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop UsoSvc
      4⤵
      PID:9428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im smartscreen.exe
  2⤵
  PID:9512
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im smartscreen.exe
    3⤵
    - Kills process with taskkill
    PID:9492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im EasyAntiCheat.exe
  2⤵
  PID:9488
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im EasyAntiCheat.exe
    3⤵
    - Kills process with taskkill
    PID:9548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im dnf.exe
  2⤵
  PID:9556
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im dnf.exe
    3⤵
    - Kills process with taskkill
    PID:9576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im DNF.exe
  2⤵
  PID:9588
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im DNF.exe
    3⤵
    - Kills process with taskkill
    PID:9600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im CrossProxy.exe
  2⤵
  PID:9628
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im CrossProxy.exe
    3⤵
    - Kills process with taskkill
    PID:9644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im tensafe_1.exe
  2⤵
  PID:9656
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im tensafe_1.exe
    3⤵
    - Kills process with taskkill
    PID:9640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im TenSafe_1.exe
  2⤵
  PID:9692
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im TenSafe_1.exe
    3⤵
    - Kills process with taskkill
    PID:9716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im tensafe_2.exe
  2⤵
  PID:9704
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im tensafe_2.exe
    3⤵
    - Kills process with taskkill
    PID:9760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im tencentdl.exe
  2⤵
  PID:9740
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im tencentdl.exe
    3⤵
    - Kills process with taskkill
    PID:9764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im TenioDL.exe
  2⤵
  PID:9768
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im TenioDL.exe
    3⤵
    - Kills process with taskkill
    PID:9788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im uishell.exe
  2⤵
  PID:9816
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im uishell.exe
    3⤵
    - Kills process with taskkill
    PID:9832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im BackgroundDownloader.exe
  2⤵
  PID:9820
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im BackgroundDownloader.exe
    3⤵
    - Kills process with taskkill
    PID:9856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im conime.exe
  2⤵
  PID:9872
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im conime.exe
    3⤵
    - Kills process with taskkill
    PID:9888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im QQDL.EXE
  2⤵
  PID:9900
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im QQDL.EXE
    3⤵
    - Kills process with taskkill
    PID:9908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im qqlogin.exe
  2⤵
  PID:9940
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im qqlogin.exe
    3⤵
    - Kills process with taskkill
    PID:9960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im dnfchina.exe >nul 2>&1
  2⤵
  PID:9972
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im dnfchina.exe
    3⤵
    - Kills process with taskkill
    PID:10012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im dnfchinatest.exe
  2⤵
  PID:9948
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im dnfchinatest.exe
    3⤵
    - Kills process with taskkill
    PID:10024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im dnf.exe
  2⤵
  PID:10036
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im dnf.exe
    3⤵
    - Kills process with taskkill
    PID:10060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im txplatform.exe
  2⤵
  PID:10080
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im txplatform.exe
    3⤵
    - Kills process with taskkill
    PID:10076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im TXPlatform.exe
  2⤵
  PID:10084
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im TXPlatform.exe
    3⤵
    - Kills process with taskkill
    PID:10116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im OriginWebHelperService.exe
  2⤵
  PID:2872
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im OriginWebHelperService.exe
    3⤵
    - Kills process with taskkill
    PID:10196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im Origin.exe
  2⤵
  PID:10144
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im Origin.exe
    3⤵
    - Kills process with taskkill
    PID:10156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im OriginClientService.exe
  2⤵
  PID:10208
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im OriginClientService.exe
    3⤵
    - Kills process with taskkill
    PID:10168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im OriginER.exe
  2⤵
  PID:10184
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im OriginER.exe
    3⤵
    - Kills process with taskkill
    PID:10188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im OriginThinSetupInternal.exe
  2⤵
  PID:4620
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im OriginThinSetupInternal.exe
    3⤵
    - Kills process with taskkill
    PID:10252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im OriginLegacyCLI.exe
  2⤵
  PID:4612
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im OriginLegacyCLI.exe
    3⤵
    - Kills process with taskkill
    PID:10280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im Agent.exe
  2⤵
  PID:10236
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im Agent.exe
    3⤵
    - Kills process with taskkill
    PID:10296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill / f / im Client.exe
  2⤵
  PID:10304
- - C:\Windows\system32\taskkill.exe
    taskkill / f / im Client.exe
    3⤵
    - Kills process with taskkill
    PID:10364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\System32\accessibility.dll /accepteula
  2⤵
  PID:10408
- - C:\Windows\System32\accessibility.dll
    C:\Windows\System32\accessibility.dll /accepteula
    3⤵
    PID:10456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\System32\accessibility.dll
  2⤵
  PID:10512
- - C:\Windows\System32\accessibility.dll
    C:\Windows\System32\accessibility.dll
    3⤵
    PID:10556
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\System32\accessibility.dll /accepteula
  2⤵
  PID:10376
- - C:\Windows\System32\accessibility.dll
    C:\Windows\System32\accessibility.dll /accepteula
    3⤵
    PID:10612
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\System32\accessibility.dll C: %random:~-1%%random:~-1%%random:~-1%%random:~-1%-%random:~-1%%random:~-1%%random:~-1%%random:~-1%
  2⤵
  PID:5080
- - C:\Windows\System32\accessibility.dll
    C:\Windows\System32\accessibility.dll C: 7502-7277
    3⤵
    PID:10680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\System32\accessibility.dll D: %random:~-1%%random:~-1%%random:~-1%%random:~-1%-%random:~-1%%random:~-1%%random:~-1%%random:~-1%
  2⤵
  PID:10704
- - C:\Windows\System32\accessibility.dll
    C:\Windows\System32\accessibility.dll D: 0347-4990
    3⤵
    PID:10760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\System32\accessibility.dll E: %random:~-1%%random:~-1%%random:~-1%%random:~-1%-%random:~-1%%random:~-1%%random:~-1%%random:~-1%
  2⤵
  PID:10668
- - C:\Windows\System32\accessibility.dll
    C:\Windows\System32\accessibility.dll E: 3310-8623
    3⤵
    PID:10816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\System32\accessibility.dll F: %random:~-1%%random:~-1%%random:~-1%%random:~-1%-%random:~-1%%random:~-1%%random:~-1%%random:~-1%
  2⤵
  PID:10848
- - C:\Windows\System32\accessibility.dll
    C:\Windows\System32\accessibility.dll F: 6275-3266
    3⤵
    PID:10868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\System32\accessibility.dll G: %random:~-1%%random:~-1%%random:~-1%%random:~-1%-%random:~-1%%random:~-1%%random:~-1%%random:~-1%
  2⤵
  PID:10832
- - C:\Windows\System32\accessibility.dll
    C:\Windows\System32\accessibility.dll G: 0011-0998
    3⤵
    PID:10952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\System32\accessibility.dll
  2⤵
  PID:10976
- - C:\Windows\System32\accessibility.dll
    C:\Windows\System32\accessibility.dll
    3⤵
    PID:11048
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\System32\ifsutipx.exe /SS %random%%random%%random%
  2⤵
  PID:11028
- - C:\Windows\System32\ifsutipx.exe
    C:\Windows\System32\ifsutipx.exe /SS 139061929920881
    3⤵
    - Cerber
    PID:11140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\System32\ifsutipx.exe /BS %random%%random%%random%
  2⤵
  PID:11132
- - C:\Windows\System32\ifsutipx.exe
    C:\Windows\System32\ifsutipx.exe /BS 13909300475978
    3⤵
    - Cerber
    PID:11172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\System32\ifsutipx.exe /SU auto
  2⤵
  PID:11188
- - C:\Windows\System32\ifsutipx.exe
    C:\Windows\System32\ifsutipx.exe /SU auto
    3⤵
    - Cerber
    PID:11220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\System32\ifsutipx.exe /IV %random:~-1%.%random:~-1%.%random:~-1%
  2⤵
  PID:11260
- - C:\Windows\System32\ifsutipx.exe
    C:\Windows\System32\ifsutipx.exe /IV 6.6.8
    3⤵
    - Cerber
    PID:7080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\System32\ifsutipx.exe /ID 0%random:~-1%/0%random:~-1%/2021
  2⤵
  PID:11284
- - C:\Windows\System32\ifsutipx.exe
    C:\Windows\System32\ifsutipx.exe /ID 09/05/2021
    3⤵
    - Cerber
    PID:11368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\System32\ifsutipx.exe /SP MS-%random:~-1%C%random:~-1%%random:~-1%F
  2⤵
  PID:11316
- - C:\Windows\System32\ifsutipx.exe
    C:\Windows\System32\ifsutipx.exe /SP MS-2C58F
    3⤵
    - Cerber
    PID:11380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\System32\ifsutipx.exe /SK A%random:~-1%%random:~-1%%random:~-1%S%random:~-1%%random:~-1%%random:~-1%O%random:~-1%
  2⤵
  PID:11412
- - C:\Windows\System32\ifsutipx.exe
    C:\Windows\System32\ifsutipx.exe /SK A929S372O1
    3⤵
    - Cerber
    PID:11480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\System32\ifsutipx.exe /SF B%random:~-1%%random:~-1%%random:~-1%S%random:~-1%%random:~-1%%random:~-1%Z%random:~-1%
  2⤵
  PID:11504
- - C:\Windows\System32\ifsutipx.exe
    C:\Windows\System32\ifsutipx.exe /SF B223S818Z5
    3⤵
    - Cerber
    PID:11568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\System32\ifsutipx.exe /BT X%random:~-1%%random:~-1%%random:~-1%S%random:~-1%%random:~-1%%random:~-1%X%random:~-1%
  2⤵
  PID:11384
- - C:\Windows\System32\ifsutipx.exe
    C:\Windows\System32\ifsutipx.exe /BT X619S365X8
    3⤵
    - Cerber
    PID:11632
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\System32\ifsutipx.exe /PSN %random%%random%%random%
  2⤵
  PID:11664
- - C:\Windows\System32\ifsutipx.exe
    C:\Windows\System32\ifsutipx.exe /PSN 13939284792915
    3⤵
    - Cerber
    PID:11640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\ntelidcx.dll
  2⤵
  PID:5796
- - C:\Windows\ntelidcx.dll
    C:\Windows\ntelidcx.dll
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    PID:11744
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ytmp\t16865.bat" "C:\Windows\ntelidcx.dll" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:11784
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
        5⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:11896
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic useraccount where caption='Admin' rename
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:11872
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters" /v "NV Hostname" /t REG_SZ /d F4A0-79DB /f
        5⤵
        
        PID:11960
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters" /v Hostname /t REG_SZ /d F4A0-79DB /f
        5⤵
        
        PID:11984
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName" /v ComputerName /t REG_SZ /d F4A0-79DB /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12000
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName" /v ComputerName /t REG_SZ /d F4A0-79DB /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12016
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v RegisteredOwner /t REG_SZ /d F4A0-79DB /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12092
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d 00331--00001-A79DB /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12084
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DigitalProductId /t REG_BINARY /d A4000000000003030312D3836382D303030303030372D383535353700AA0000005831352D3333000000000000000C3AABF4430BA18B8878E89D4430000000000000396CC459BD030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000023BD6736 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12020
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DigitalProductId4 /t REG_BINARY /d D9759A39040000003000300033003723BD002D00300030003100370030002D003800360038002D003000300030003000300030002D00300033002D0031003000330033002D0037003600300031002E0030003000300030002D003200360035003200300031003700000000000000000000000000000000000000000000000000000000000000000062003900320065003D9759A3980030002D0062003900035002D0034003800320031002D0039006300390034002D0031003400300066003600330032006600360033003100320000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050006F006600650073007300623BDF006E0061006C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000C3AABFA65BBA18B889D24ED80000C61D9759A39D0BEDFD25E23BD45B89FFF45564B84E87CB968EC7F4D18F6E5066261A0B704B9D2739558B7E97DF882AB087AB0D8A314BA9BB1E06029EA28D5800310035002D0033003900310037003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000056006F006C0075006D006A00470056004C004B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000056006F006C007D0065000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11976
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Registration" /v ProductId /t REG_SZ /d 00331-10000-00001-A79DB /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:12040
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer" /v svcKBNumber /t REG_SZ /d KB3170202 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:12024
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_DWORD /d 1502026740 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12148
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Migration" /v "IE Installed Date" /t REG_BINARY /d 1502026740 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:12132
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware Profiles\0001" /v HwProfileGuid /t REG_SZ /d {D9759A39-23BD-4430-23BD-80244F709F57} /f
        5⤵
        
        PID:12156
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e965-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {D9759A39-23BD-4430-23BD-6a244F709F57} /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12172
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {D9759A39-23BD-4430-23BD-6a244F709F57} /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12124
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Diagnostics\Performance\BootCKCLSettings" /v GUID /t REG_SZ /d {D9759A39-23BD-4430-23BD-3e244F709F57} /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12208
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Diagnostics\Performance\SecondaryLogonCKCLSettings" /v GUID /t REG_SZ /d {D9759A39-23BD-4430-23BD-3e244F709F57} /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12212
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Diagnostics\Performance\ShutdownCKCLSettings" /v GUID /t REG_SZ /d {D9759A39-23BD-4430-23BD-3e244F709F57} /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12228
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\IDConfigDB\Hardware Profiles\0001" /v HwProfileGuid /t REG_SZ /d {D9759A39-23BD-4430-23BD-80244F709F57} /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12248
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d D9759A39-23BD-4430-23BD-e7244F709F57 /f
        5⤵
        
        PID:12240
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild /t REG_SZ /d 14403 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12308
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber /t REG_SZ /d 14403 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7116
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildLab /t REG_SZ /d 14403.rs1_release.171127-2100 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12256
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildLabEx /t REG_SZ /d 14403.1944.amd64fre.rs1_release.171127-2100 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12276
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v BuildGUID /t REG_SZ /d D9759A39-23BD-4430-23BD-244F709F57 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7040
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected" /v GUID /t REG_SZ /d {A28BBADE-23BD-4430-23BD-00244F709F57} /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12292
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Disconnected" /v GUID /t REG_SZ /d {143E4E83-23BD-4430-23BD-00244F709F57} /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8060
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\EmailImage" /v GUID /t REG_SZ /d {C66DCEE1-23BD-4430-23BD-2F244F709F57} /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4920
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\FaxImage" /v GUID /t REG_SZ /d {C00EB793-23BD-4430-23BD-00244F709F57} /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5460
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\PrintImage" /v GUID /t REG_SZ /d {B441F425-23BD-4430-23BD-00244F709F57} /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12372
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton" /v GUID /t REG_SZ /d {A6C5A715-23BD-4430-23BD-00244F709F57} /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12388
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\STIproxyEvent" /v GUID /t REG_SZ /d {d711f81f-23BD-4430-23BD-92244F709F57} /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12392
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionInventoryVersionGUID_DONOTUSEINSTORE" /v value /t REG_SZ /d {27720B92-23BD-4430-23BD-92244F709F57} /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:12340
    - - C:\Windows\SysWOW64\net.exe
        
        net stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12432
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12448
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /t REG_SZ /d D9759A39-23BD-4430-23BD-c9244F709F57 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12468
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientIDValidation /t REG_BINARY /d A4000000000003030312D3836382D30303244F709F57D383535353700AA0000005831352D3333000000000000000C3AABF4430BA18B8878E89D4430000000000000396CC459BD030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000023BD6736 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12508
    - - C:\Windows\SysWOW64\net.exe
        
        net start wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12480
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start wuauserv
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12516
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DigitalProductId
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12528
      - C:\Windows\SysWOW64\reg.exe
        
        reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DigitalProductId
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c shutdown /r /t 25
  2⤵
  PID:4328
- - C:\Windows\system32\shutdown.exe
    shutdown /r /t 25
    3⤵
    PID:4616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Windows\AppVLicense.dll
  2⤵
  PID:2248
- - C:\Windows\AppVLicense.dll
    C:\Windows\AppVLicense.dll
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4520
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\afolder" mkdir "C:\Users\Admin\AppData\Local\Temp\afolder"
      4⤵
      System Location Discovery: System Language Discovery
      PID:12612
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\ytmp" mkdir "C:\Users\Admin\AppData\Local\Temp\ytmp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5984
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
      4⤵
      Hide Artifacts: Hidden Files and Directories
      System Location Discovery: System Language Discovery
      PID:1672
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +h C:\Users\Admin\AppData\Local\Temp\ytmp
        5⤵
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:12608
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp9473.bat" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp9473.bat"
      4⤵
      System Location Discovery: System Language Discovery
      PID:12592
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp7660.exe" del "C:\Users\Admin\AppData\Local\Temp\ytmp\tmp7660.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4040
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ytmp\tmp9473.bat "C:\Windows\AppVLicense.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3248
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
        5⤵
        
        PID:1816
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic nic where physicaladapter=true get deviceid
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2288
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr [0-9]
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12632
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1008
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001
        5⤵
        
        PID:5580
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5180
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v NetworkAddress /t REG_SZ /d 727E454EB1D5 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3900
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
        5⤵
        
        PID:5012
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic nic where physicaladapter=true get deviceid
        6⤵
        
        PID:2592
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr [0-9]
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2900
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12652
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5564
    - - C:\Windows\SysWOW64\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5276
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001 /v PnPCapabilities /t REG_DWORD /d 24 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5936
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5228
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5940
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh interface set interface name="Ethernet" disable
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:3284

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:12672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery