hxxps://www[.]cyberlink[.]com/downloads/trials/powerdvd-ultra/download_en_US[.]html

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	CyberLink_PowerDVD_Downloader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	WDExclusionPathTool.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	WDExclusionPathTool.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	PowerDVDUtil.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	PowerDVD.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	CLToast.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	PowerDVD.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	PowerDVD.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	CLUpdater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	PowerDVD_22.0.2827.62_Essential_DVD230428-01.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	PowerDVDUtil.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	GDPRDlg.exe

Executes dropped EXE 33 IoCs

pid	Process
1724	CyberLink_PowerDVD_Downloader.exe
2348	PowerDVD_22.0.2827.62_Essential_DVD230428-01.exe
4824	setup.exe
1864	7z.exe
2288	vcredist_x64.exe
2816	vcredist_x64.exe
2308	vcredist_x86.exe
2436	vcredist_x86.exe
3504	MicrosoftEdgeWebview2Setup.exe
1320	MicrosoftEdgeUpdate.exe
3332	WDExclusionPathTool.exe
5028	7z.exe
4728	7z.exe
1448	7z.exe
1316	7z.exe
1732	7z.exe
2892	7z.exe
1724	WDExclusionPathTool.exe
2516	PowerDVDUtil.exe
5008	FebEditor.exe
1528	GenRNKey.exe
1924	PowerDVDUtil.exe
2200	PowerDVD.exe
4828	Install.exe
3344	MediaEspresso.exe
1260	InstallBDKMDriver64.exe
184	CLToast.exe
1064	TaskScheduler.exe
4572	PowerDVD.exe
740	GDPRDlg.exe
3236	PowerDVD.exe
2308	CLUpdater.exe
4940	PowerDVD.exe

Loads dropped DLL 64 IoCs

pid	Process
4824	setup.exe
4824	setup.exe
4824	setup.exe
1864	7z.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
2816	vcredist_x64.exe
2436	vcredist_x86.exe
4824	setup.exe
1320	MicrosoftEdgeUpdate.exe
5028	7z.exe
4728	7z.exe
1448	7z.exe
1316	7z.exe
1732	7z.exe
2892	7z.exe
2516	PowerDVDUtil.exe
2516	PowerDVDUtil.exe
2516	PowerDVDUtil.exe
2516	PowerDVDUtil.exe
2516	PowerDVDUtil.exe
2516	PowerDVDUtil.exe
2516	PowerDVDUtil.exe
2516	PowerDVDUtil.exe
2516	PowerDVDUtil.exe
2516	PowerDVDUtil.exe
2516	PowerDVDUtil.exe
2516	PowerDVDUtil.exe
2516	PowerDVDUtil.exe
2516	PowerDVDUtil.exe
2516	PowerDVDUtil.exe
2516	PowerDVDUtil.exe
2516	PowerDVDUtil.exe
2516	PowerDVDUtil.exe
2516	PowerDVDUtil.exe
5008	FebEditor.exe
5008	FebEditor.exe
5008	FebEditor.exe
5008	FebEditor.exe
5008	FebEditor.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4504	Regsvr32.exe
3216	regsvr32.exe
1636	Regsvr32.exe
4436	regsvr32.exe
4824	setup.exe
1924	PowerDVDUtil.exe
1924	PowerDVDUtil.exe
1924	PowerDVDUtil.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Registers COM server for autorun 1 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8C54B6B-C540-43A5-BDDA-2B0038830F63}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\WOW6432Node\CLSID\{FFA5B06E-20BB-4E7E-A0AC-6982ED6A6041}\LocalServer32	CLToast.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\WOW6432Node\CLSID\{FFA5B06E-20BB-4E7E-A0AC-6982ED6A6041}\LocalServer32\ = "C:\\Program Files (x86)\\CyberLink\\Shared files\\CLToast.exe"	CLToast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8C54B6B-C540-43A5-BDDA-2B0038830F63}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8C54B6B-C540-43A5-BDDA-2B0038830F63}\InprocServer32\ = "C:\\ProgramData\\CyberLink\\PowerDVD22\\OpenWith\\PDVD_Shell64.dll"	regsvr32.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PowerDVD22Agent = "\"C:\\Program Files\\CyberLink\\PowerDVD22\\PowerDVD22Agent.exe\""	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	Install.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CyberlinkPowerPlayerMediaServer_PowerDVD22 = "C:\\Program Files\\CyberLink\\PowerDVD22\\Common\\CLMediaServer\\clmediaserver.exe"	Install.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MicrosoftEdgeUpdate.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	setup.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	setup.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{625dd068-580b-924f-afc2-eae23ab42a91}\SET9724.tmp	netsh.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{625dd068-580b-924f-afc2-eae23ab42a91}\000.cat	netsh.exe
File created	C:\Windows\System32\DriverStore\Temp\{625dd068-580b-924f-afc2-eae23ab42a91}\SET9722.tmp	netsh.exe
File created	C:\Windows\System32\DriverStore\Temp\{625dd068-580b-924f-afc2-eae23ab42a91}\SET9723.tmp	netsh.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\000_64.inf_amd64_991d689d42c5e144\000_64.inf	netsh.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{625dd068-580b-924f-afc2-eae23ab42a91}	netsh.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	netsh.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\000_64.inf_amd64_991d689d42c5e144\000.cat	netsh.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{625dd068-580b-924f-afc2-eae23ab42a91}\SET9722.tmp	netsh.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{625dd068-580b-924f-afc2-eae23ab42a91}\000_64.inf	netsh.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{625dd068-580b-924f-afc2-eae23ab42a91}\SET9724.tmp	netsh.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\000_64.inf_amd64_991d689d42c5e144\000.fcl	netsh.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	netsh.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{625dd068-580b-924f-afc2-eae23ab42a91}\SET9723.tmp	netsh.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{625dd068-580b-924f-afc2-eae23ab42a91}\000.fcl	netsh.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Movie\PK\Custom\Lang\JPN	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\ShareModule32\subsys\AudioRipper\_AudioRipper.pyd	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Common\VideoFilter\libmjpgdec.dll	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\ShareModule32\Common\Koan\site\Crypto\SelfTest\Cipher\test_XOR.pyc	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\subsys\BigBang\Runtime\CLUpdater\Language\ARA\CLUpdater.xml	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Common\CLMediaServer\webplayer\assets\images\main\icon_TV_s.png	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Common\VideoFilterHVD\clvdec_license.txt	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Movie\PK\Custom\Skin\Standard\DVD\Media\Image\listview\btn_list_h.png	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Movie\PK\Custom\Skin\Standard\DVD\Media\Image\playbackbar\btn_tt_apply_n.png	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Movie\PK\Custom\Skin\Standard\DVD\Media\Image_HDPI\playbackbarTenFt\playbackbar_stop_d.png	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\MediaEspresso\subsys\DVD\CLAudFx.ax	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\MediaEspresso\subsys\DVD\MFTWrpH264.ax	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\MediaEspresso\subsys\ShellOp\_ShellOp.pyd	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\MediaEspresso\subsys\VideoConvert\__init__.kc	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\MediaEspresso\CESdlls\CES_PlugIn_4.dll	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Common\CLMediaServer\license\websocketpp\COPYING	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Custom\Skin\Standard\Misc\movie\resumePage\tenft_resume_mask.png	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Custom\Skin\Standard\Misc\onboarding\animation_03\animation_03_048.png	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\subsys\Activator\_PyActivator.pyd	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Eula\lic_Ita.txt	setup.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Common\GDPR\Skin	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Common\CLMediaServer\webplayer\6-04f953b6764225132980.js	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Custom\Skin\Standard\Misc\onboarding\animation_03\animation_03_005.png	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Movie\PK\Custom\Skin\Standard\DVD\Media\Image\moreFunctions\btn_bd_Yellow_h.png	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Movie\PK\Custom\Skin\Standard\DVD\Media\Image\playbackbar\Btn_RepeatT_n.png	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Custom\Setting\FreeLicenses\beautifulsoup	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Movie\PK\Custom\Skin\Standard\DVD\Media\Image\3D\3DAutoDetectSource.png	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Movie\PK\Custom\Skin\Standard\DVD\Media\Image\dialog\dialog_400x420_bg.png	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\thirdparty\scandir.pyc	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Common\Koan\select.pyd	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Common\Sysripper\Filters\decoderPack\CLImageSourceReader.ax	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Common\VideoFilter\fonts\conf.d\50-user.conf	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Custom\Skin\Standard\Misc\face_scan\face_scan_071.png	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Movie\PK\Custom\Skin\Standard\DVD\Media\Image\moreFunctions\btn_no_2_n.png	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Movie\PK\Custom\Skin\Standard\DVD\Media\Image\listview\btn_list_h.png	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Movie\PK\Custom\Skin\Standard\DVD\Media\Image_HDPI\moreFunctions\btn_f_MagicPlayOn_g.png	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Movie\PK\Custom\Skin\Standard\DVD\Media\Image_HDPI\navigationbar\btn_n.png	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Movie\PK\Custom\Skin\Standard\DVD\Media\Image\playbackbar\btn_DVD_h.png	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Movie\PK\Custom\Skin\Standard\DVD\Media\Image_HDPI\playbackbarTenFt\playbackbar_next_n.png	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Common\MSDKRaw.dll	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Common\CLDynamicTranscode_license\zeroconf-0.17.4\COPYING	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Common\CLMediaServer\webplayer\assets\images\main\btn_close_p.png	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Custom\Skin\Standard\Misc\musicPlaylingAnimation\playling_22.png	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Custom\Skin\Standard\Misc\onboarding\animation_04\animation_04_052.png	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Custom\Skin\Standard\Misc\onboarding\animation_05\animation_05_044.png	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Common\Sysripper\Filters\decoderPack\CLCVD\vc1dsse2.dll	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Common\CLMediaServer\webplayer\assets\images\main\share_powerplayer_logo.png	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Custom\Skin\Standard\Misc\hlsl\rotate_7.hlsl	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\ShareModule32\Common\Koan\site\Crypto\SelfTest\Hash\test_HMAC.pyc	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\subsys\PyWebview2Controller\_PyWebview2Controller.pyd	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Common\CLMediaServer\webplayer\assets\images\player\btn_music_repeat_h.png	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Movie\PK\Custom\Skin\Standard\DVD\Layout\template\SelectMenuItemTenFt.bkml	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Movie\PK\Custom\Skin\Standard\DVD\Media\Image\playbackbar\btn_popupmenu_P.png	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Common\Sysripper\Filters\decoderPack\CLCVD\cl265dec.dll	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\DA_ETHANCHV	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Movie\PK\Custom\Skin\Standard\DVD\Media\Image\playbackbar\btn_eject_H.png	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Movie\PK\Custom\Skin\Standard\DVD\Media\Image\playbackbarTenFt\playbackbar_pervious_d.png	7z.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU69CD.tmp\msedgeupdateres_id.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Common\CLDynamicTranscode_license\PyChromecast-0.6\LICENSE	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Common\CLMediaServer\webplayer\assets\images\main\[email protected]	7z.exe
File opened for modification	C:\Program Files\CyberLink\PowerDVD22\Common\CLMediaServer\webplayer\assets\images\player\[email protected]	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Custom\Skin\Standard\Misc\onboarding\animation_02\animation_02_026.png	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\Movie\PK\Custom\Skin\Standard\DVD\Media\Image_HDPI\TTHDConfig\tab_L_h.png	7z.exe
File created	C:\Program Files\CyberLink\PowerDVD22\thirdparty\youtubeLib\apiclient\mimeparse.pyc	7z.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	netsh.exe
File opened for modification	C:\Windows\inf\oem3.inf	netsh.exe
File created	C:\Windows\inf\oem3.inf	netsh.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	schtasks.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	PowerDVD.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	InstallBDKMDriver64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 26 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	netsh.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	netsh.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	netsh.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	netsh.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	netsh.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	netsh.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	netsh.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	netsh.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	netsh.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2040	schtasks.exe
3860	schtasks.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\clpdvd22dl\WarnOnOpen = "0"	PowerDVD.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\clpdvdcloudsl\WarnOnOpen = "0"	PowerDVD.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\PowerDVD.exe = "8000"	PowerDVD.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	CyberLink_PowerDVD_Downloader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	CyberLink_PowerDVD_Downloader.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Internet Explorer\IESettingSync	CyberLink_PowerDVD_Downloader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	CyberLink_PowerDVD_Downloader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\clpdvd22dl	PowerDVD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\clpdvdcloudsl	PowerDVD.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\PowerDVD_HIVE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\PlayDVDMovieOnArrival	setup.exe
Key created	\REGISTRY\USER\PowerDVD_HIVE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\PlayDVDMovieOnArrival	setup.exe
Set value (str)	\REGISTRY\USER\PowerDVD_HIVE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\PlayBluRayOnArrival\ = "PowerDVD22.0PlayBluRayOnArrival"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	netsh.exe
Key created	\REGISTRY\USER\PowerDVD_HIVE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\PlayEnhancedCDOnArrival	setup.exe
Key created	\REGISTRY\USER\PowerDVD_HIVE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\PlayVideoCDMovieOnArrival	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	netsh.exe
Set value (str)	\REGISTRY\USER\PowerDVD_HIVE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\PlayCDAudioOnArrival\ = "PowerDVD22.0PlayCDAudioOnArrival"	setup.exe
Set value (str)	\REGISTRY\USER\PowerDVD_HIVE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\PlayEnhancedDVDOnArrival\ = "PowerDVD22.0PlayDVDMovieOnArrival"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	netsh.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133288246431909269"	chrome.exe
Key created	\REGISTRY\USER\PowerDVD_HIVE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\PlayBluRayOnArrival	setup.exe
Set value (str)	\REGISTRY\USER\PowerDVD_HIVE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\PlaySuperVideoCDMovieOnArrival\ = "PowerDVD22.0PlaySuperVideoCDMovieOnArrival"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	netsh.exe
Set value (str)	\REGISTRY\USER\PowerDVD_HIVE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\PlayEnhancedCDOnArrival\ = "PowerDVD22.0PlayCDAudioOnArrival"	setup.exe
Set value (str)	\REGISTRY\USER\PowerDVD_HIVE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\PlayDVDMovieOnArrival\ = "PowerDVD22.0PlayDVDMovieOnArrival"	setup.exe
Key created	\REGISTRY\USER\PowerDVD_HIVE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\PlayVideoCDMovieOnArrival	setup.exe
Set value (str)	\REGISTRY\USER\PowerDVD_HIVE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\PlayEnhancedDVDOnArrival\ = "PowerDVD22.0PlayDVDMovieOnArrival"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	netsh.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\PowerDVD_HIVE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\PlayCDAudioOnArrival	setup.exe
Key created	\REGISTRY\USER\PowerDVD_HIVE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\PlaySuperVideoCDMovieOnArrival	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	netsh.exe
Key created	\REGISTRY\USER\PowerDVD_HIVE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\PlayEnhancedCDOnArrival	setup.exe
Set value (str)	\REGISTRY\USER\PowerDVD_HIVE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\PlayDVDMovieOnArrival\ = "PowerDVD22.0PlayDVDMovieOnArrival"	setup.exe
Key created	\REGISTRY\USER\PowerDVD_HIVE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\PlayEnhancedDVDOnArrival	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	netsh.exe
Set value (str)	\REGISTRY\USER\PowerDVD_HIVE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\PlayBluRayOnArrival\ = "PowerDVD22.0PlayBluRayOnArrival"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	netsh.exe
Set value (str)	\REGISTRY\USER\PowerDVD_HIVE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\PlayCDAudioOnArrival\ = "PowerDVD22.0PlayCDAudioOnArrival"	setup.exe
Key created	\REGISTRY\USER\PowerDVD_HIVE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\PlaySuperVideoCDMovieOnArrival	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	netsh.exe
Set value (str)	\REGISTRY\USER\PowerDVD_HIVE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\PlayEnhancedCDOnArrival\ = "PowerDVD22.0PlayCDAudioOnArrival"	setup.exe
Set value (str)	\REGISTRY\USER\PowerDVD_HIVE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\PlayVideoCDMovieOnArrival\ = "PowerDVD22.0PlayVideoCDMovieOnArrival"	setup.exe
Set value (str)	\REGISTRY\USER\PowerDVD_HIVE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\PlayVideoCDMovieOnArrival\ = "PowerDVD22.0PlayVideoCDMovieOnArrival"	setup.exe
Key created	\REGISTRY\USER\PowerDVD_HIVE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\PlayEnhancedDVDOnArrival	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	netsh.exe
Key created	\REGISTRY\USER\PowerDVD_HIVE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\PlayCDAudioOnArrival	setup.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BluRay\Shell\PlayWithPowerDVD22.0	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VCD\Shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VideoFiles\ = "VideoFiles"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerDVD22.0FILE\shell\Open	PowerDVD.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdLite500\{11A19188-36EC-4D6F-9831-05A38E1E9E55} = 00000000000000000000000000000000	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdLite500\{11A19188-36EC-4D6F-9831-05A38E1E9E55} = e7070500030011001300180025009503	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\clpdvd22dl\URL Protocol	PowerDVD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioCD\Shell	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SVCD\Shell\PlayWithPowerDVD22.0	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Picture\Shell\PlayWithPowerDVD22.0\Command\ = "\"C:\\Program Files\\CyberLink\\PowerDVD22\\PDVDLP.exe\" LOCALAUTOPLAY PHOTO \"%L\""	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Picture\DefaultIcon	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MixedContent\DefaultIcon\ = "C:\\Program Files\\CyberLink\\PowerDVD22\\PowerDVD.ico"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\clpdvd22dl\DefaultIcon\ = "C:\\Program Files\\CyberLink\\PowerDVD22\\PowerDVD.ico"	PowerDVD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SVCD\ = "SVCD"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8C54B6B-C540-43A5-BDDA-2B0038830F63}\Settings\Title = "Open with &PowerDVD"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\clpdvdcloudsl\shell\open	PowerDVD.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioCD\Shell\PlayWithPowerDVD22.0\Command	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BluRay\Shell	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BluRay\DefaultIcon	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Picture\Shell	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MusicFiles\Shell\PlayWithPowerDVD22.0\Command	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MixedContent\Shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MusicFiles\DefaultIcon\ = "C:\\Program Files\\CyberLink\\PowerDVD22\\PowerDVD.ico"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8C54B6B-C540-43A5-BDDA-2B0038830F63}\ = "$PowerDVD22"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DVD\ = "DVD"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VCD\DefaultIcon\ = "C:\\Program Files\\CyberLink\\PowerDVD22\\PowerDVD.ico"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SVCD\DefaultIcon\ = "C:\\Program Files\\CyberLink\\PowerDVD22\\PowerDVD.ico"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MixedContent	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MixedContent\ = "MixedContent"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\clpdvdcloudsl\DefaultIcon\ = "C:\\Program Files\\CyberLink\\PowerDVD22\\PowerDVD.ico"	PowerDVD.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DVD\Shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BluRay\Shell\PlayWithPowerDVD22.0\Command\ = "\"C:\\Program Files\\CyberLink\\PowerDVD22\\PDVDLP.exe\" AUTOPLAY BD \"%L\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SVCD\Shell\ = "PlayWithPowerDVD22.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VideoFiles\DefaultIcon	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EnDVD	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\clpdvd22dl\shell\open\command\ = "\"C:\\Program Files\\CyberLink\\PowerDVD22\\Common\\CLDownloader\\CLDownloader.exe\" /bundle \"%1\""	PowerDVD.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DVD\shell\ = "PlayWithPowerDVD22.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VCD\DefaultIcon	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VCD\Shell\ = "PlayWithPowerDVD22.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VideoFiles\Shell\PlayWithPowerDVD22.0\Command	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerDVD22.0FILE\shell\ = "Open"	PowerDVD.exe
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\WOW6432Node\CLSID\{FFA5B06E-20BB-4E7E-A0AC-6982ED6A6041}	CLToast.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BluRay	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VCD\Shell\PlayWithPowerDVD22.0\Command\ = "\"C:\\Program Files\\CyberLink\\PowerDVD22\\PDVDLP.exe\" AUTOPLAY VCD \"%L\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VideoFiles\DefaultIcon\ = "C:\\Program Files\\CyberLink\\PowerDVD22\\PowerDVD.ico"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Picture	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EnDVD\Shell\PlayWithPowerDVD22.0\Command\ = "\"C:\\Program Files\\CyberLink\\PowerDVD22\\PDVDLP.exe\" AUTOPLAY DVD \"%L\""	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerDVD22.0FILE	PowerDVD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MusicFiles\ = "MusicFiles"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EnDVD\Shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EnDVD\Shell\PlayWithPowerDVD22.0\ = "@C:\\Program Files\\CyberLink\\PowerDVD22\\Common\\MUI\\PDVDEnvRes.dll,-163"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioCD\shell\PlayWithPowerDVD22.0\ = "@C:\\Program Files\\CyberLink\\PowerDVD22\\Common\\MUI\\PDVDEnvRes.dll,-163"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioCD\DefaultIcon	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MixedContent\Shell\PlayWithPowerDVD22.0	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EnDVD\DefaultIcon	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DVD\shell\PlayWithPowerDVD22.0\Command\ = "\"C:\\Program Files\\CyberLink\\PowerDVD22\\PDVDLP.exe\" AUTOPLAY DVD \"%L\""	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BluRay\Shell\PlayWithPowerDVD22.0\ = "@C:\\Program Files\\CyberLink\\PowerDVD22\\Common\\MUI\\PDVDEnvRes.dll,-163"	setup.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	CyberLink_PowerDVD_Downloader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	CyberLink_PowerDVD_Downloader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c00000001000000040000000008000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	CyberLink_PowerDVD_Downloader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	CyberLink_PowerDVD_Downloader.exe

Runs .reg file with regedit 10 IoCs

pid	Process
5116	Regedit.exe
4664	Regedit.exe
1544	Regedit.exe
2844	Regedit.exe
536	Regedit.exe
2304	Regedit.exe
3064	Regedit.exe
4200	Regedit.exe
4472	Regedit.exe
4900	Regedit.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
4204	chrome.exe
4204	chrome.exe
3716	chrome.exe
3716	chrome.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
4824	setup.exe
1320	MicrosoftEdgeUpdate.exe
1320	MicrosoftEdgeUpdate.exe
1464	powershell.exe
1464	powershell.exe
1944	powershell.exe
1944	powershell.exe
1532	PowerShell.exe
1532	PowerShell.exe
4824	setup.exe
4824	setup.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe
Token: SeShutdownPrivilege	4204	chrome.exe
Token: SeCreatePagefilePrivilege	4204	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
740	GDPRDlg.exe
2308	CLUpdater.exe
2308	CLUpdater.exe
2308	CLUpdater.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
4204	chrome.exe
2308	CLUpdater.exe
2308	CLUpdater.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
1724	CyberLink_PowerDVD_Downloader.exe
1724	CyberLink_PowerDVD_Downloader.exe
1724	CyberLink_PowerDVD_Downloader.exe
2348	PowerDVD_22.0.2827.62_Essential_DVD230428-01.exe
4476	SearchApp.exe
4824	setup.exe
1864	7z.exe
2288	vcredist_x64.exe
2816	vcredist_x64.exe
2308	vcredist_x86.exe
2436	vcredist_x86.exe
3504	MicrosoftEdgeWebview2Setup.exe
1320	MicrosoftEdgeUpdate.exe
3332	WDExclusionPathTool.exe
5028	7z.exe
4728	7z.exe
1448	7z.exe
1316	7z.exe
1732	7z.exe
2892	7z.exe
1724	WDExclusionPathTool.exe
2516	PowerDVDUtil.exe
5008	FebEditor.exe
1528	GenRNKey.exe
1924	PowerDVDUtil.exe
2200	PowerDVD.exe
4828	Install.exe
3344	MediaEspresso.exe
184	CLToast.exe
1064	TaskScheduler.exe
4572	PowerDVD.exe
4572	PowerDVD.exe
3236	PowerDVD.exe
3236	PowerDVD.exe
4940	PowerDVD.exe
4940	PowerDVD.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 3804	4204	chrome.exe	83
PID 4204 wrote to memory of 3804	4204	chrome.exe	83
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 1692	4204	chrome.exe	84
PID 4204 wrote to memory of 5048	4204	chrome.exe	85
PID 4204 wrote to memory of 5048	4204	chrome.exe	85
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86
PID 4204 wrote to memory of 3256	4204	chrome.exe	86

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.cyberlink.com/downloads/trials/powerdvd-ultra/download_en_US.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe91e9758,0x7fffe91e9768,0x7fffe91e9778
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1760,i,1049720999426523302,3131601658442193682,131072 /prefetch:2
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1760,i,1049720999426523302,3131601658442193682,131072 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1312 --field-trial-handle=1760,i,1049720999426523302,3131601658442193682,131072 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3164 --field-trial-handle=1760,i,1049720999426523302,3131601658442193682,131072 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3192 --field-trial-handle=1760,i,1049720999426523302,3131601658442193682,131072 /prefetch:1
  2⤵
  PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4632 --field-trial-handle=1760,i,1049720999426523302,3131601658442193682,131072 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5604 --field-trial-handle=1760,i,1049720999426523302,3131601658442193682,131072 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5644 --field-trial-handle=1760,i,1049720999426523302,3131601658442193682,131072 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 --field-trial-handle=1760,i,1049720999426523302,3131601658442193682,131072 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 --field-trial-handle=1760,i,1049720999426523302,3131601658442193682,131072 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4608 --field-trial-handle=1760,i,1049720999426523302,3131601658442193682,131072 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5248 --field-trial-handle=1760,i,1049720999426523302,3131601658442193682,131072 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5036 --field-trial-handle=1760,i,1049720999426523302,3131601658442193682,131072 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6208 --field-trial-handle=1760,i,1049720999426523302,3131601658442193682,131072 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4932 --field-trial-handle=1760,i,1049720999426523302,3131601658442193682,131072 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 --field-trial-handle=1760,i,1049720999426523302,3131601658442193682,131072 /prefetch:8
  2⤵
  PID:792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5660 --field-trial-handle=1760,i,1049720999426523302,3131601658442193682,131072 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5696 --field-trial-handle=1760,i,1049720999426523302,3131601658442193682,131072 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5724 --field-trial-handle=1760,i,1049720999426523302,3131601658442193682,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2192

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3808

C:\Users\Admin\Downloads\CyberLink_PowerDVD_Downloader.exe
"C:\Users\Admin\Downloads\CyberLink_PowerDVD_Downloader.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:1724
- C:\Users\Admin\Downloads\PowerDVD_22.0.2827.62_Essential_DVD230428-01.exe
  "C:\Users\Admin\Downloads\PowerDVD_22.0.2827.62_Essential_DVD230428-01.exe" /S
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2348
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\7z.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SupportFiles.7z" -o"C:\ProgramData\SUPPORTDIR\20230517_192033_4824" -aoa
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup\RunTime\VC2017_x64\vcredist_x64.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup\RunTime\VC2017_x64\vcredist_x64.exe" /quiet /norestart
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup\RunTime\VC2017_x64\vcredist_x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup\RunTime\VC2017_x64\vcredist_x64.exe" /quiet /norestart -burn.unelevated BurnPipe.{86FA876B-0DE9-4320-A39A-3DEB84034A72} {20CA9C0A-5D86-4E1F-9AC0-B73AC9CEC0A6} 2288
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup\RunTime\VC2017_x86\vcredist_x86.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup\RunTime\VC2017_x86\vcredist_x86.exe" /quiet /norestart
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup\RunTime\VC2017_x86\vcredist_x86.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup\RunTime\VC2017_x86\vcredist_x86.exe" /quiet /norestart -burn.unelevated BurnPipe.{5CEAB056-A3FE-42E8-907F-D11C680F6683} {2E110034-68B2-4A26-85A1-72A178559E2A} 2308
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup\Utility\Runtime\MicrosoftEdgeWebview2Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup\Utility\Runtime\MicrosoftEdgeWebview2Setup.exe" /silent /install
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      PID:3504
    - - C:\Program Files (x86)\Microsoft\Temp\EU69CD.tmp\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\Temp\EU69CD.tmp\MicrosoftEdgeUpdate.exe" /silent /install
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1320
      - C:\Windows\SysWOW64\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1320" "1008" "888" "1004" "0" "0" "0" "0" "0" "0" "0" "0"
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3424
  - - C:\ProgramData\SUPPORTDIR\20230517_192033_4824\x64\WDExclusionPathTool.exe
      "C:\ProgramData\SUPPORTDIR\20230517_192033_4824\x64\WDExclusionPathTool.exe" -Add "C:\Program Files\CyberLink\PowerDVD22"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3332
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /NOCONSOLE /C PowerShell Add-MpPreference -ExclusionPath "\"C:\Program Files\CyberLink\PowerDVD22\""
        5⤵
        
        PID:2688
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell Add-MpPreference -ExclusionPath "\"C:\Program Files\CyberLink\PowerDVD22\""
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\7z.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data1.7z" -o"C:\Program Files\CyberLink\PowerDVD22" -aoa
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\7z.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data2.7z" -o"C:\Program Files\CyberLink\PowerDVD22\MediaEspresso" -aoa
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\7z.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data3.7z" -o"C:\Program Files\CyberLink\PowerDVD22" -aoa
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\7z.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data4.7z" -o"C:\Program Files\CyberLink\PowerDVD22\Common\CLVirtualDriver\Drivers" -aoa
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1316
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\7z.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data5.7z" -o"C:\Program Files\CyberLink\PowerDVD22\Common\CLVirtualDriver\Drivers" -aoa
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\7z.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data9.7z" -o"C:\Program Files\CyberLink\PowerDVD22\Common\CLVirtualDriver\Drivers" -aoa
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2892
  - - C:\ProgramData\SUPPORTDIR\20230517_192033_4824\x64\WDExclusionPathTool.exe
      "C:\ProgramData\SUPPORTDIR\20230517_192033_4824\x64\WDExclusionPathTool.exe" -Remove "C:\Program Files\CyberLink\PowerDVD22"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1724
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /NOCONSOLE /C PowerShell Remove-MpPreference -ExclusionPath "\"C:\Program Files\CyberLink\PowerDVD22\""
        5⤵
        
        PID:3088
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell Remove-MpPreference -ExclusionPath "\"C:\Program Files\CyberLink\PowerDVD22\""
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1944
  - - C:\Program Files\CyberLink\PowerDVD22\PowerDVDUtil.exe
      "C:\Program Files\CyberLink\PowerDVD22\PowerDVDUtil.exe" febeditor "C:\Program Files\CyberLink\PowerDVD22\SRExport.ini"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2516
  - - C:\Program Files\CyberLink\PowerDVD22\MediaEspresso\Custom\Setting\FebEditor.exe
      "C:\Program Files\CyberLink\PowerDVD22\MediaEspresso\Custom\Setting\FebEditor.exe" "C:\Program Files\CyberLink\PowerDVD22\SRExport_MediaEspresso.ini" /CustomInstallPath="C:\Program Files\CyberLink\PowerDVD22\MediaEspresso\Custom\Setting" /CustomRegPath=CyberLink\PowerDVD22\MediaEspresso /CustomKoanPath="C:\Program Files\CyberLink\PowerDVD22\ShareModule32\Common\Koan"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:5008
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" load HKEY_USERS\PowerDVD_HIVE C:\Users\Default\NTUSER.DAT
      4⤵
      PID:2416
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" unload HKEY_USERS\PowerDVD_HIVE
      4⤵
      PID:1932
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" load HKEY_USERS\PowerDVD_HIVE C:\Users\Default\NTUSER.DAT
      4⤵
      PID:2672
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" unload HKEY_USERS\PowerDVD_HIVE
      4⤵
      PID:2428
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" load HKEY_USERS\PowerDVD_HIVE C:\Users\Default\NTUSER.DAT
      4⤵
      PID:4432
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" unload HKEY_USERS\PowerDVD_HIVE
      4⤵
      PID:5000
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" load HKEY_USERS\PowerDVD_HIVE C:\Users\Default\NTUSER.DAT
      4⤵
      PID:2924
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" unload HKEY_USERS\PowerDVD_HIVE
      4⤵
      PID:400
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" load HKEY_USERS\PowerDVD_HIVE C:\Users\Default\NTUSER.DAT
      4⤵
      PID:4464
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" unload HKEY_USERS\PowerDVD_HIVE
      4⤵
      PID:1548
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" load HKEY_USERS\PowerDVD_HIVE C:\Users\Default\NTUSER.DAT
      4⤵
      PID:4500
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" unload HKEY_USERS\PowerDVD_HIVE
      4⤵
      PID:4212
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" load HKEY_USERS\PowerDVD_HIVE C:\Users\Default\NTUSER.DAT
      4⤵
      PID:2408
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\system32\reg.exe" unload HKEY_USERS\PowerDVD_HIVE
      4⤵
      PID:3856
  - - C:\Windows\Regedit.exe
      "C:\Windows\Regedit.exe" /s "C:\Program Files\CyberLink\PowerDVD22\discProfile.reg"
      4⤵
      Runs .reg file with regedit
      PID:4664
  - - C:\Windows\SysWOW64\Regedit.exe
      "C:\Windows\SysWOW64\Regedit.exe" /s "C:\Program Files\CyberLink\PowerDVD22\discProfile.reg"
      4⤵
      Runs .reg file with regedit
      PID:1544
  - - C:\Windows\Regedit.exe
      "C:\Windows\Regedit.exe" /s "C:\Program Files\CyberLink\PowerDVD22\Movie.reg"
      4⤵
      Runs .reg file with regedit
      PID:3064
  - - C:\Windows\SysWOW64\Regedit.exe
      "C:\Windows\SysWOW64\Regedit.exe" /s "C:\Program Files\CyberLink\PowerDVD22\Movie.reg"
      4⤵
      Runs .reg file with regedit
      PID:4200
  - - C:\Windows\Regedit.exe
      "C:\Windows\Regedit.exe" /s "C:\Program Files\CyberLink\PowerDVD22\Movie\Registry\DVD.reg"
      4⤵
      Runs .reg file with regedit
      PID:2844
  - - C:\Windows\SysWOW64\Regedit.exe
      "C:\Windows\SysWOW64\Regedit.exe" /s "C:\Program Files\CyberLink\PowerDVD22\Movie\Registry\DVD.reg"
      4⤵
      Runs .reg file with regedit
      PID:536
  - - C:\Windows\Regedit.exe
      "C:\Windows\Regedit.exe" /s "C:\Program Files\CyberLink\PowerDVD22\Movie\Registry\BD.reg"
      4⤵
      Runs .reg file with regedit
      PID:4472
  - - C:\Windows\SysWOW64\Regedit.exe
      "C:\Windows\SysWOW64\Regedit.exe" /s "C:\Program Files\CyberLink\PowerDVD22\Movie\Registry\BD.reg"
      4⤵
      Runs .reg file with regedit
      PID:4900
  - - C:\Windows\Regedit.exe
      "C:\Windows\Regedit.exe" /s "C:\Program Files\CyberLink\PowerDVD22\Kanten.reg"
      4⤵
      Runs .reg file with regedit
      PID:2304
  - - C:\Windows\SysWOW64\Regedit.exe
      "C:\Windows\SysWOW64\Regedit.exe" /s "C:\Program Files\CyberLink\PowerDVD22\Kanten.reg"
      4⤵
      Runs .reg file with regedit
      PID:5116
  - - C:\Program Files\CyberLink\PowerDVD22\ShareModule32\Common\NavFilter\GenRNKey.exe
      "C:\Program Files\CyberLink\PowerDVD22\ShareModule32\Common\NavFilter\GenRNKey.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1528
  - - C:\Windows\SysWOW64\Regsvr32.exe
      "C:\Windows\SysWOW64\Regsvr32.exe" /s "C:\ProgramData\CyberLink\PowerDVD22\OpenWith\PDVD_Shell64.dll"
      4⤵
      Loads dropped DLL
      PID:4504
    - - C:\Windows\system32\regsvr32.exe
        
        /s "C:\ProgramData\CyberLink\PowerDVD22\OpenWith\PDVD_Shell64.dll"
        5⤵
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:3216
  - - C:\Windows\SysWOW64\Regsvr32.exe
      "C:\Windows\SysWOW64\Regsvr32.exe" /s "C:\Program Files\CyberLink\PowerDVD22\fwnet.dll"
      4⤵
      Loads dropped DLL
      PID:1636
    - - C:\Windows\system32\regsvr32.exe
        
        /s "C:\Program Files\CyberLink\PowerDVD22\fwnet.dll"
        5⤵
        Loads dropped DLL
        
        PID:4436
  - - C:\Program Files\CyberLink\PowerDVD22\PowerDVDUtil.exe
      "C:\Program Files\CyberLink\PowerDVD22\PowerDVDUtil.exe" genmanifest
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1924
  - - C:\Program Files\CyberLink\PowerDVD22\PowerDVD.exe
      "C:\Program Files\CyberLink\PowerDVD22\PowerDVD.exe" install
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:2200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
        
        PowerShell Add-MpPreference -ControlledFolderAccessAllowedApplications "\"C:\Program Files\CyberLink\PowerDVD22\\\""
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1532
    - - C:\Program Files\CyberLink\PowerDVD22\Common\CLMediaServer\Install.exe
        
        "C:\Program Files\CyberLink\PowerDVD22\Common\CLMediaServer\Install.exe" -i
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:4828
      - C:\Windows\System32\certutil.exe
        
        "C:\Windows\System32\certutil.exe" -f -p 12345678 -importpfx "C:\Program Files\CyberLink\PowerDVD22\Common\CLMediaServer\cert\server.pfx"
        6⤵
        
        PID:4724
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" http add urlacl url=https://*:31308/ sddl=D:(A;;GX;;;S-1-1-0) listen=yes
        6⤵
        
        PID:524
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" http add urlacl url=http://*:31298/ sddl=D:(A;;GX;;;S-1-1-0) listen=yes
        6⤵
        
        PID:3840
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" http add urlacl url=https://*:31309/ sddl=D:(A;;GX;;;S-1-1-0) listen=yes
        6⤵
        
        PID:1432
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" http add urlacl url=http://*:31299/ sddl=D:(A;;GX;;;S-1-1-0) listen=yes
        6⤵
        
        PID:3784
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" http add urlacl url=https://*:31310/ sddl=D:(A;;GX;;;S-1-1-0) listen=yes
        6⤵
        
        PID:1544
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" http add urlacl url=http://*:31300/ sddl=D:(A;;GX;;;S-1-1-0) listen=yes
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        Checks SCSI registry key(s)
        Modifies data under HKEY_USERS
        
        PID:2616
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" http add urlacl url=https://*:31311/ sddl=D:(A;;GX;;;S-1-1-0) listen=yes
        6⤵
        
        PID:1740
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" http add urlacl url=http://*:31301/ sddl=D:(A;;GX;;;S-1-1-0) listen=yes
        6⤵
        
        PID:480
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" http add urlacl url=https://*:31312/ sddl=D:(A;;GX;;;S-1-1-0) listen=yes
        6⤵
        
        PID:1724
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" http add urlacl url=http://*:31302/ sddl=D:(A;;GX;;;S-1-1-0) listen=yes
        6⤵
        
        PID:2876
  - - C:\Program Files\CyberLink\PowerDVD22\MediaEspresso\MediaEspresso.exe
      "C:\Program Files\CyberLink\PowerDVD22\MediaEspresso\MediaEspresso.exe" install koanpath="C:\Program Files\CyberLink\PowerDVD22\ShareModule32\Common\Koan"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3344
  - - C:\Program Files\CyberLink\PowerDVD22\Common\NavFilter\64\InstallBDKMDriver64.exe
      "C:\Program Files\CyberLink\PowerDVD22\Common\NavFilter\64\InstallBDKMDriver64.exe" "C:\Program Files\CyberLink\PowerDVD22\Common\NavFilter\64\000_64.inf"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:1260
  - - C:\Program Files (x86)\CyberLink\Shared files\CLToast.exe
      "C:\Program Files (x86)\CyberLink\Shared files\CLToast.exe" -addCLToastSchedule
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Registers COM server for autorun
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:184
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC DAILY /TN CLToast /F /TR "'C:\Program Files (x86)\CyberLink\Shared files\CLToast.exe' "-UpdateSchedule""
        5⤵
        Drops file in Drivers directory
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:2040
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC ONLOGON /TN CLToastRun /F /TR "'C:\Program Files (x86)\CyberLink\Shared files\CLToast.exe' "-UpdateScheduleRun""
        5⤵
        Creates scheduled task(s)
        
        PID:3860
  - - C:\ProgramData\SUPPORTDIR\20230517_192033_4824\TaskScheduler.exe
      "C:\ProgramData\SUPPORTDIR\20230517_192033_4824\TaskScheduler.exe" "C:\Program Files\CyberLink\PowerDVD22\PowerDVD.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1064

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:4576
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2c2da2d3-ad13-c245-a85c-b95913ab8388}\000_64.inf" "9" "409ac67e3" "0000000000000144" "WinSta0\Default" "0000000000000100" "208" "C:\Program Files\CyberLink\PowerDVD22\Common\NavFilter\64"
  2⤵
  PID:2616
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\000_64.inf_amd64_991d689d42c5e144\000_64.inf" "0" "409ac67e3" "00000000000000B8" "WinSta0\Default"
  2⤵
  PID:2040

C:\Program Files\CyberLink\PowerDVD22\PowerDVD.exe
"C:\Program Files\CyberLink\PowerDVD22\PowerDVD.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4572
- C:\Program Files\CyberLink\PowerDVD22\Common\GDPR\GDPRDlg.exe
  "C:\Program Files\CyberLink\PowerDVD22\Common\GDPR\GDPRDlg.exe" -a"C:\Program Files\CyberLink\PowerDVD22\APREG.url" -m"C:\Program Files\CyberLink\PowerDVD22\Common\MUI\PDVDEnvRes.dll" -l"ENU"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:740
- C:\Program Files\CyberLink\PowerDVD22\PowerDVD.exe
  PowerDVD.exe noolreg
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3236
- - C:\Program Files\CyberLink\PowerDVD22\subsys\BigBang\Runtime\CLUpdater.exe
    "C:\Program Files\CyberLink\PowerDVD22\subsys\BigBang\Runtime\CLUpdater.exe" C:\Users\Admin\AppData\Local\Temp\CLUpdater.ini
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2308
- - C:\Program Files\CyberLink\PowerDVD22\PowerDVD.exe
    PowerDVD.exe /launchmode classic noolreg
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Install Root Certificate

T1130

Modify Registry

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery