privateloader | bc4e220b7539888116beeb5b74bb51cff311d7e1eb859f92ca7f778d605031a1

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{7d3c6ff9-c3c5-4635-a48d-a8f29700cc25} = "\"C:\\ProgramData\\Package Cache\\{7d3c6ff9-c3c5-4635-a48d-a8f29700cc25}\\4kvideodownloaderplus_1.4.3_x64_online.exe\" /burn.runonce"	4kvideodownloaderplus_1.4.3_x64_online.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
46	4672	msiexec.exe
48	4672	msiexec.exe
49	4672	msiexec.exe
51	4672	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	QtWebEngineProcess.exe
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	QtWebEngineProcess.exe
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	QtWebEngineProcess.exe
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	4kvideodownloaderplus_1.4.3_x64_online.exe
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	4kvideodownloaderplus.exe
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	QtWebEngineProcess.exe
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	QtWebEngineProcess.exe
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	QtWebEngineProcess.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtGraphicalEffects\qmldir	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\CircularButtonStyle.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\Qt5Qml.dll	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\ItemDelegate.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQml\qmlplugin.dll	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\msvcp140.dll	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Flat\qtquickextrasflatplugin.dll	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\images\button.png	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\lgpl-3.0.txt	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Desktop\ApplicationWindowStyle.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\CheckBox.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\RadioButtonStyle.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Desktop\CalendarStyle.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\msvcp140_1.dll	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngine\Controls1Delegates\TouchSelectionMenu.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtGraphicalEffects\plugins.qmltypes	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\GroupBoxStyle.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\libGLESv2.dll	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\bn.pak	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtWinExtras\plugins.qmltypes	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\CommonStyleHelper.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\ToggleButtonStyle.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\ComboBoxStyle.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\GroupBox.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngine\Controls2Delegates\Menu.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\Drawer.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Private\ColumnMenuContent.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\images\tab_selected.png	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\qmldir	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\images\leftanglearrow.png	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\sr.pak	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\da.pak	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Tab.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\lv.pak	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\MenuSeparator.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngine\Controls1Delegates\AlertDialog.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\Qt5Widgets.dll	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_resources_200p.pak	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\CalendarStyle.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtGraphicalEffects\private\GaussianGlow.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\audio\alert.wav	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\TreeViewStyle.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\images\groupbox.png	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\ProgressBar.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Private\EditMenu.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Window.2\windowplugin.dll	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\Qt\labs\platform\qtlabsplatformplugin.dll	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\BusyIndicator.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\Qt5Positioning.dll	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Private\qmldir	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\Qt5WebEngineCore.dll	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\GaugeStyle.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Private\BasicButton.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngine\Controls2Delegates\AlertDialog.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtGraphicalEffects\DirectionalBlur.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Private\TextInputWithHandles.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngine\plugins.qmltypes	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\BusyIndicatorStyle.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtGraphicalEffects\BrightnessContrast.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Private\StackViewSlideDelegate.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\es-419.pak	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngineProcess.exe	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_resources.pak	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\bg.pak	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e579aaa.msi	msiexec.exe
File created	C:\Windows\Installer\e579aae.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB76C.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA896.tmp	msiexec.exe
File created	C:\Windows\Installer\{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\e579aaa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA2B8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA375.tmp	msiexec.exe

Executes dropped EXE 10 IoCs

pid	Process
440	4kvideodownloaderplus_1.4.3_x64_online.exe
3152	4kvideodownloaderplus_1.4.3_x64_online.exe
4548	4kvideodownloaderplus.exe
652	crashpad_handler.exe
1552	QtWebEngineProcess.exe
5124	QtWebEngineProcess.exe
5400	QtWebEngineProcess.exe
6408	QtWebEngineProcess.exe
3576	QtWebEngineProcess.exe
6520	QtWebEngineProcess.exe

Loads dropped DLL 64 IoCs

pid	Process
440	4kvideodownloaderplus_1.4.3_x64_online.exe
4596	MsiExec.exe
4668	MsiExec.exe
4596	MsiExec.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
652	crashpad_handler.exe
652	crashpad_handler.exe
652	crashpad_handler.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000057e87298238d7ad50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000057e872980000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090057e87298000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d57e87298000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000057e8729800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5C8A82B669AA6C54A92A7EEAC55C70F7	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\SourceList\Media\2 = ";"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5FA96407-7E77-483C-AC93-691D05850DE8}\Rev = "0"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\ProductName = "4K Video Downloader+"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 7200310000000000a2586c8e1000344b564944457e3100005a0009000400efbea258528ea258718e2e0000000a40020000000a00000000000000000000000000000036f6620034004b00200056006900640065006f00200044006f0077006e006c006f0061006400650072002b00000018000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5FA96407-7E77-483C-AC93-691D05850DE8}\LogicalViewMode = "3"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}	4kvideodownloaderplus_1.4.3_x64_online.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5FA96407-7E77-483C-AC93-691D05850DE8}\Vid = "{0057D0E0-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 780031000000000093586a371100557365727300640009000400efbe874f7748a258178e2e000000c70500000000010000000000000000003a0000000000c5f7580055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000009358ec41100041646d696e003c0009000400efbe93586a37a258178e2e0000006be10100000001000000000000000000000000000000feebdc00410064006d0069006e00000014000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupView = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}\Version = "1.4.3.0060"	4kvideodownloaderplus_1.4.3_x64_online.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\PackageCode = "8C7BA36928FAB6D48B67791AA73B215D"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}v1.4.3.0060\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-877519540-908060166-1852957295-1000\{AB6CB62E-A6E7-4F46-A98C-B43E20F2F749}	4kvideodownloaderplus.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}\DisplayName = "4K Video Downloader+"	4kvideodownloaderplus_1.4.3_x64_online.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\Version = "17039363"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5FA96407-7E77-483C-AC93-691D05850DE8}\IconSize = "96"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5A0DD6B5535352E4082B644C603BE688\5C8A82B669AA6C54A92A7EEAC55C70F7	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5FA96407-7E77-483C-AC93-691D05850DE8}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1092616193"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5FA96407-7E77-483C-AC93-691D05850DE8}\Mode = "1"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{7d3c6ff9-c3c5-4635-a48d-a8f29700cc25}\Dependents\{7d3c6ff9-c3c5-4635-a48d-a8f29700cc25}	4kvideodownloaderplus_1.4.3_x64_online.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-877519540-908060166-1852957295-1000\{6EA22FBD-317B-4D3A-AA89-4B776F9F2A74}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5FA96407-7E77-483C-AC93-691D05850DE8}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{7d3c6ff9-c3c5-4635-a48d-a8f29700cc25}\Version = "1.4.3.60"	4kvideodownloaderplus_1.4.3_x64_online.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\ProductIcon = "C:\\Windows\\Installer\\{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}\\icon.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Videos"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}\ = "{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}"	4kvideodownloaderplus_1.4.3_x64_online.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 7c00310000000000a258528e1100566964656f730000660009000400efbe93586a37a258718e2e0000006de101000000010000000000000000003c000000000042ce1e0056006900640065006f007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370039003100000016000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1092616193"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5FA96407-7E77-483C-AC93-691D05850DE8}\Vid = "{0057D0E0-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5C8A82B669AA6C54A92A7EEAC55C70F7\Complete	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5FA96407-7E77-483C-AC93-691D05850DE8}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{7d3c6ff9-c3c5-4635-a48d-a8f29700cc25}\DisplayName = "4K Video Downloader+"	4kvideodownloaderplus_1.4.3_x64_online.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	4kvideodownloaderplus.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	4kvideodownloaderplus.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	4kvideodownloaderplus.exe

Suspicious behavior: AddClipboardFormatListener 8 IoCs

pid	Process
4548	4kvideodownloaderplus.exe
4040	explorer.exe
1564	vlc.exe
5396	vlc.exe
6948	vlc.exe
2504	explorer.exe
4252	explorer.exe
2980	vlc.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
4672	msiexec.exe
4672	msiexec.exe
4596	MsiExec.exe
4596	MsiExec.exe
4596	MsiExec.exe
4596	MsiExec.exe
4668	MsiExec.exe
4668	MsiExec.exe
5124	QtWebEngineProcess.exe
5400	QtWebEngineProcess.exe
5836	msedge.exe
5836	msedge.exe
5556	msedge.exe
5556	msedge.exe
2400	identity_helper.exe
2400	identity_helper.exe
5180	msedge.exe
5180	msedge.exe
6408	QtWebEngineProcess.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
3576	QtWebEngineProcess.exe
6520	QtWebEngineProcess.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
4548	4kvideodownloaderplus.exe
1564	vlc.exe
4040	explorer.exe
5396	vlc.exe
6948	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	2880	vssvc.exe
Token: SeRestorePrivilege	2880	vssvc.exe
Token: SeAuditPrivilege	2880	vssvc.exe
Token: SeBackupPrivilege	4320	srtasks.exe
Token: SeRestorePrivilege	4320	srtasks.exe
Token: SeSecurityPrivilege	4320	srtasks.exe
Token: SeTakeOwnershipPrivilege	4320	srtasks.exe
Token: SeBackupPrivilege	4320	srtasks.exe
Token: SeRestorePrivilege	4320	srtasks.exe
Token: SeSecurityPrivilege	4320	srtasks.exe
Token: SeTakeOwnershipPrivilege	4320	srtasks.exe
Token: SeShutdownPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeIncreaseQuotaPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeSecurityPrivilege	4672	msiexec.exe
Token: SeCreateTokenPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeAssignPrimaryTokenPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeLockMemoryPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeIncreaseQuotaPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeMachineAccountPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeTcbPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeSecurityPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeTakeOwnershipPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeLoadDriverPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeSystemProfilePrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeSystemtimePrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeProfSingleProcessPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeIncBasePriorityPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeCreatePagefilePrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeCreatePermanentPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeBackupPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeRestorePrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeShutdownPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeDebugPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeAuditPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeSystemEnvironmentPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeChangeNotifyPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeRemoteShutdownPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeUndockPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeSyncAgentPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeEnableDelegationPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeManageVolumePrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeImpersonatePrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeCreateGlobalPrivilege	3152	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe
Token: SeTakeOwnershipPrivilege	4672	msiexec.exe
Token: SeRestorePrivilege	4672	msiexec.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
440	4kvideodownloaderplus_1.4.3_x64_online.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
4548	4kvideodownloaderplus.exe
1564	vlc.exe
1564	vlc.exe
1564	vlc.exe
1564	vlc.exe
5396	vlc.exe
5396	vlc.exe
5396	vlc.exe
5396	vlc.exe
5396	vlc.exe
5396	vlc.exe
5396	vlc.exe
5396	vlc.exe
5396	vlc.exe
6948	vlc.exe
6948	vlc.exe
6948	vlc.exe
6948	vlc.exe
6948	vlc.exe
6948	vlc.exe
6948	vlc.exe
6948	vlc.exe
6948	vlc.exe
2980	vlc.exe
2980	vlc.exe
2980	vlc.exe
2980	vlc.exe
2980	vlc.exe
2980	vlc.exe

Suspicious use of SendNotifyMessage 53 IoCs

pid	Process
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
1564	vlc.exe
1564	vlc.exe
1564	vlc.exe
5396	vlc.exe
5396	vlc.exe
5396	vlc.exe
5396	vlc.exe
5396	vlc.exe
5396	vlc.exe
5396	vlc.exe
5396	vlc.exe
6948	vlc.exe
6948	vlc.exe
6948	vlc.exe
6948	vlc.exe
6948	vlc.exe
6948	vlc.exe
6948	vlc.exe
6948	vlc.exe
2980	vlc.exe
2980	vlc.exe
2980	vlc.exe
2980	vlc.exe
2980	vlc.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4548	4kvideodownloaderplus.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
4040	explorer.exe
1564	vlc.exe
4040	explorer.exe
4040	explorer.exe
5396	vlc.exe
6948	vlc.exe
2504	explorer.exe
2504	explorer.exe
4252	explorer.exe
4252	explorer.exe
2980	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 440	4800	4kvideodownloaderplus_1.4.3_x64_online.exe	86
PID 4800 wrote to memory of 440	4800	4kvideodownloaderplus_1.4.3_x64_online.exe	86
PID 4800 wrote to memory of 440	4800	4kvideodownloaderplus_1.4.3_x64_online.exe	86
PID 440 wrote to memory of 3152	440	4kvideodownloaderplus_1.4.3_x64_online.exe	97
PID 440 wrote to memory of 3152	440	4kvideodownloaderplus_1.4.3_x64_online.exe	97
PID 440 wrote to memory of 3152	440	4kvideodownloaderplus_1.4.3_x64_online.exe	97
PID 4672 wrote to memory of 4596	4672	msiexec.exe	108
PID 4672 wrote to memory of 4596	4672	msiexec.exe	108
PID 4672 wrote to memory of 4596	4672	msiexec.exe	108
PID 4672 wrote to memory of 4668	4672	msiexec.exe	110
PID 4672 wrote to memory of 4668	4672	msiexec.exe	110
PID 4672 wrote to memory of 4668	4672	msiexec.exe	110
PID 440 wrote to memory of 4548	440	4kvideodownloaderplus_1.4.3_x64_online.exe	113
PID 440 wrote to memory of 4548	440	4kvideodownloaderplus_1.4.3_x64_online.exe	113
PID 4548 wrote to memory of 652	4548	4kvideodownloaderplus.exe	114
PID 4548 wrote to memory of 652	4548	4kvideodownloaderplus.exe	114
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 1552	4548	4kvideodownloaderplus.exe	115
PID 4548 wrote to memory of 5124	4548	4kvideodownloaderplus.exe	116
PID 4548 wrote to memory of 5124	4548	4kvideodownloaderplus.exe	116
PID 4548 wrote to memory of 5124	4548	4kvideodownloaderplus.exe	116
PID 4548 wrote to memory of 5124	4548	4kvideodownloaderplus.exe	116
PID 4548 wrote to memory of 5124	4548	4kvideodownloaderplus.exe	116
PID 4548 wrote to memory of 5124	4548	4kvideodownloaderplus.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\4kvideodownloaderplus_1.4.3_x64_online.exe
"C:\Users\Admin\AppData\Local\Temp\4kvideodownloaderplus_1.4.3_x64_online.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\Temp\{C3A51BC0-0E2F-43C5-AE0D-AC8A96CF5963}\.cr\4kvideodownloaderplus_1.4.3_x64_online.exe
  "C:\Windows\Temp\{C3A51BC0-0E2F-43C5-AE0D-AC8A96CF5963}\.cr\4kvideodownloaderplus_1.4.3_x64_online.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\4kvideodownloaderplus_1.4.3_x64_online.exe" -burn.filehandle.attached=532 -burn.filehandle.self=540
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Windows\Temp\{52DA0038-D46C-401B-9EC9-164A88C5D1E1}\.be\4kvideodownloaderplus_1.4.3_x64_online.exe
    "C:\Windows\Temp\{52DA0038-D46C-401B-9EC9-164A88C5D1E1}\.be\4kvideodownloaderplus_1.4.3_x64_online.exe" -q -burn.elevated BurnPipe.{85EBD7F3-62FE-4026-84DA-C09F38E222FC} {C2F4F832-CDC2-4FCE-9EFE-9133BBD77229} 440
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:3152
- - C:\Program Files\4KDownload\4kvideodownloaderplus\4kvideodownloaderplus.exe
    "C:\Program Files\4KDownload\4kvideodownloaderplus\4kvideodownloaderplus.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Modifies system certificate store
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Program Files\4KDownload\4kvideodownloaderplus\crashpad_handler.exe
      "C:/Program Files/4KDownload/4kvideodownloaderplus/crashpad_handler.exe" "--database=C:/Users/Admin/AppData/Local/4kdownload.com/4K Video Downloader+/4K Video Downloader+/../crashdb" "--metrics-dir=C:/Users/Admin/AppData/Local/4kdownload.com/4K Video Downloader+/4K Video Downloader+/../crashdb" --url=https://o354938.ingest.sentry.io/api/4505076032667648/minidump/?sentry_key=1a7e5dd848a445bd99b93ea2e155896c --annotation=format=minidump --annotation=sentry[release]=1.4.3.0060 --initial-client-data=0x5c0,0x5c4,0x5c8,0x59c,0x5cc,0x7ff6157e5438,0x7ff6157e5450,0x7ff6157e5468
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:652
  - - C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngineProcess.exe
      "C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,NetworkServiceInProcess,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,InstalledApp,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=3244 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:1552
  - - C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngineProcess.exe
      "C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,NetworkServiceInProcess,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,InstalledApp,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3284 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:5124
  - - C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngineProcess.exe
      "C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,NetworkServiceInProcess,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,InstalledApp,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=4580 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.4kdownload.com/thanks-for-installing?source=videodownloaderplus&install=first
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97b3546f8,0x7ff97b354708,0x7ff97b354718
        5⤵
        
        PID:5564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
        5⤵
        
        PID:5828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
        5⤵
        
        PID:5876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
        5⤵
        
        PID:6076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
        5⤵
        
        PID:6084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
        5⤵
        
        PID:5412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4560 /prefetch:8
        5⤵
        
        PID:1596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4560 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
        5⤵
        
        PID:5416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
        5⤵
        
        PID:6084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
        5⤵
        
        PID:5680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
        5⤵
        
        PID:3152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
        5⤵
        
        PID:6128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
        5⤵
        
        PID:1564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
        5⤵
        
        PID:5792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
        5⤵
        
        PID:4436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5588 /prefetch:8
        5⤵
        
        PID:6100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5564 /prefetch:8
        5⤵
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:5180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
        5⤵
        
        PID:5080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5364 /prefetch:8
        5⤵
        
        PID:6352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
        5⤵
        
        PID:6284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
        5⤵
        
        PID:6640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
        5⤵
        
        PID:6128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
        5⤵
        
        PID:7128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
        5⤵
        
        PID:5444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
        5⤵
        
        PID:5448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6768 /prefetch:8
        5⤵
        
        PID:6412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5872 /prefetch:8
        5⤵
        
        PID:3232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5212 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
        5⤵
        
        PID:1600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11629077727384609126,708599489860988566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
        5⤵
        
        PID:5112
  - - C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngineProcess.exe
      "C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,NetworkServiceInProcess,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,InstalledApp,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-databases --lang=en --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=5620 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:6408
  - - C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngineProcess.exe
      "C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,NetworkServiceInProcess,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,InstalledApp,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-databases --lang=en --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=6048 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3576
  - - C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngineProcess.exe
      "C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,NetworkServiceInProcess,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,InstalledApp,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --disable-databases --lang=en --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5708 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:6520
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" /select, "C:\Users\Admin\Videos\4K Video Downloader+\Sagawa1gou funny video 😂😂😂 SAGAWA Best Shorts 2023 #shorts.mp4"
      4⤵
      PID:4512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=P_1-Cpo1P0A
      4⤵
      PID:1324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff97b3546f8,0x7ff97b354708,0x7ff97b354718
        5⤵
        
        PID:1832
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" /select, "C:\Users\Admin\Videos\4K Video Downloader+\Sagawa1gou funny video 😂😂😂 SAGAWA Best Shorts 2023 #shorts.mp4"
      4⤵
      PID:6552
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" /select, "C:\Users\Admin\Videos\4K Video Downloader+\Sagawa1gou funny video 😂😂😂 SAGAWA Best Shorts 2023 #shorts.mp4"
      4⤵
      PID:6160

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2880

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 97ABCC46E61B82F99D88DEF04C996A9D
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4596
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D54378D69CB18E0EA674C87F36B0DA41 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x464 0x4e0
1⤵
PID:6336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6640

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4040
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Videos\4K Video Downloader+\Sagawa1gou funny video 😂😂😂 SAGAWA Best Shorts 2023 #shorts.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1564
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Videos\4K Video Downloader+\Sagawa1gou funny video 😂😂😂 SAGAWA Best Shorts 2023 #shorts.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5396
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Videos\4K Video Downloader+\We Built an Actual WATER SLIDE in our House!.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6948

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3376

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2504

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4252
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Videos\4K Video Downloader+\Sagawa1gou funny video 😂😂😂 SAGAWA Best Shorts 2023 #shorts.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery