d0dd0fd94bf0cf78bd9613749dfee32eac544c84078c4569d3608c07306d9dcc

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	uTorrent.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	uTorrent.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	uTorrent.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	utorrent.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	utorrent.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	uTorrent.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000001ac61-59.dat	upx
behavioral1/memory/3348-61-0x0000000000400000-0x00000000009C2000-memory.dmp	upx
behavioral1/memory/3348-87-0x0000000000400000-0x00000000009C2000-memory.dmp	upx
behavioral1/memory/3480-1261-0x0000000000400000-0x00000000009C2000-memory.dmp	upx
behavioral1/memory/3480-1287-0x0000000000400000-0x00000000009C2000-memory.dmp	upx
behavioral1/memory/5696-1288-0x0000000000400000-0x00000000009C2000-memory.dmp	upx
behavioral1/memory/5696-1775-0x0000000000400000-0x00000000009C2000-memory.dmp	upx
behavioral1/memory/5696-1785-0x0000000000400000-0x00000000009C2000-memory.dmp	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\ut = "C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe /MINIMIZED"	utorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\ut = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent\\uTorrent.exe\" /MINIMIZED"	uTorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\ut = "\"C:\\Users\\Admin\\AppData\\Roaming\\utorrent\\uTorrent.exe\" /MINIMIZED"	uTorrent.exe

Downloads MZ/PE file

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	uTorrent.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	uTorrent.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	MicrosoftEdgeUpdate.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 8 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_te.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_kk.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_es-419.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_th.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_tr.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_zh-CN.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_gd.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_quz.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_nn.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\EdgeUpdate.dat	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_da.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_gu.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_hu.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_az.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_mk.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_en-GB.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_nb.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_ca-Es-VALENCIA.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_ca.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_or.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{89CD259E-44F0-40F3-A568-41E90A5F1400}\EDGEMITMP_32BA2.tmp\MSEDGE.PACKED.7Z	MicrosoftEdge_X64_125.0.2535.51.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_fa.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_gl.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\MicrosoftEdgeUpdateSetup.exe	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\MicrosoftEdgeUpdateCore.exe	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_ur.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_mi.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_ne.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdate.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_id.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_mr.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_zh-TW.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_km.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_tt.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_bn.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_et.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_fi.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_iw.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_pt-BR.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_bs.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_ga.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_lb.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_mt.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\psuser_64.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\psuser_arm64.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\psmachine_arm64.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_bg.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_ja.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_ug.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_hr.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_bn-IN.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_sq.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_sr-Cyrl-RS.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_eu.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_kok.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_pa.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_ml.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_cy.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_de.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_pl.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_uk.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_af.dll	MicrosoftEdgeWebView2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\msedgeupdateres_fr.dll	MicrosoftEdgeWebView2Setup.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe

Executes dropped EXE 25 IoCs

pid	Process
192	utorrent_installer.tmp
4752	uTorrent.exe
3348	utorrent.exe
3480	uTorrent.exe
3544	utorrentie.exe
3920	utorrentie.exe
2948	MicrosoftEdgeWebView2Setup.exe
2884	utorrentie.exe
1736	utorrentie.exe
3336	MicrosoftEdgeUpdate.exe
5000	MicrosoftEdgeUpdate.exe
4432	MicrosoftEdgeUpdate.exe
4428	MicrosoftEdgeUpdateComRegisterShell64.exe
4644	MicrosoftEdgeUpdateComRegisterShell64.exe
2056	MicrosoftEdgeUpdateComRegisterShell64.exe
3312	MicrosoftEdgeUpdate.exe
2184	MicrosoftEdgeUpdate.exe
3764	MicrosoftEdgeUpdate.exe
2896	MicrosoftEdgeUpdate.exe
5696	uTorrent.exe
2072	utorrentie.exe
5884	utorrentie.exe
6016	utorrentie.exe
5124	utorrentie.exe
5580	MicrosoftEdge_X64_125.0.2535.51.exe

Loads dropped DLL 23 IoCs

pid	Process
4752	uTorrent.exe
4752	uTorrent.exe
4752	uTorrent.exe
4752	uTorrent.exe
3348	utorrent.exe
4752	uTorrent.exe
3480	uTorrent.exe
3336	MicrosoftEdgeUpdate.exe
5000	MicrosoftEdgeUpdate.exe
4432	MicrosoftEdgeUpdate.exe
4428	MicrosoftEdgeUpdateComRegisterShell64.exe
4432	MicrosoftEdgeUpdate.exe
4644	MicrosoftEdgeUpdateComRegisterShell64.exe
4432	MicrosoftEdgeUpdate.exe
2056	MicrosoftEdgeUpdateComRegisterShell64.exe
4432	MicrosoftEdgeUpdate.exe
3312	MicrosoftEdgeUpdate.exe
2184	MicrosoftEdgeUpdate.exe
3764	MicrosoftEdgeUpdate.exe
3764	MicrosoftEdgeUpdate.exe
2184	MicrosoftEdgeUpdate.exe
2896	MicrosoftEdgeUpdate.exe
5696	uTorrent.exe

Registers COM server for autorun 1 TTPs 31 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 11 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	uTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000	uTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	uTorrent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	uTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000	uTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	uTorrent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	uTorrent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	uTorrent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	utorrent_installer.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	utorrent_installer.tmp

Modifies Internet Explorer settings 1 TTPs 14 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\utorrentie.exe = "1"	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION\utorrentie.exe = "0"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\utorrentie.exe = "1"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\utorrentie.exe = "11000"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\utorrentie.exe = "11000"	uTorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	uTorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CROSS_DOMAIN_REDIRECT_MITIGATION\utorrentie.exe = "0"	uTorrent.exe

Modifies data under HKEY_USERS 53 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-bittorrent-skin	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc.1.0	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\CLSID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ProgID\ = "MicrosoftEdgeUpdate.CoreMachineClass.1"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-skin	utorrent.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\LocalService = "edgeupdatem"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32\ = "{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\ = "Microsoft Edge Update Process Launcher Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ = "Microsoft Edge Update Core Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1D3747B6-FED9-4795-BB56-E077C582FB69}\InprocHandler32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods\ = "27"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine.1.0\ = "Microsoft Edge Update Broker Class Factory"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusSvc.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ = "IAppVersionWeb"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\uTorrent\shell	utorrent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\ = "PSFactoryBuffer"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\MIME\Database\Content Type\application/x-bittorrent-appinst	utorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Magnet\shell\ = "open"	utorrent.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\CurVer\ = "MicrosoftEdgeUpdate.ProcessLauncher.1.0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32\ = "{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
192	utorrent_installer.tmp
192	utorrent_installer.tmp
192	utorrent_installer.tmp
192	utorrent_installer.tmp
192	utorrent_installer.tmp
192	utorrent_installer.tmp
192	utorrent_installer.tmp
192	utorrent_installer.tmp
3480	uTorrent.exe
3480	uTorrent.exe
3920	utorrentie.exe
3920	utorrentie.exe
2884	utorrentie.exe
2884	utorrentie.exe
2884	utorrentie.exe
3336	MicrosoftEdgeUpdate.exe
3336	MicrosoftEdgeUpdate.exe
2884	utorrentie.exe
2884	utorrentie.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5696	uTorrent.exe
5696	uTorrent.exe
5140	taskmgr.exe
5884	utorrentie.exe
5884	utorrentie.exe
6016	utorrentie.exe
5140	taskmgr.exe
6016	utorrentie.exe
6016	utorrentie.exe
6016	utorrentie.exe
5140	taskmgr.exe
6016	utorrentie.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
4112	MicrosoftEdgeCP.exe
4112	MicrosoftEdgeCP.exe
4112	MicrosoftEdgeCP.exe
4112	MicrosoftEdgeCP.exe
4112	MicrosoftEdgeCP.exe
4112	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3348	utorrent.exe
Token: SeManageVolumePrivilege	3480	uTorrent.exe
Token: SeDebugPrivilege	3336	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	1736	utorrentie.exe
Token: SeDebugPrivilege	1736	utorrentie.exe
Token: SeDebugPrivilege	4220	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4220	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4220	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4220	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5140	taskmgr.exe
Token: SeSystemProfilePrivilege	5140	taskmgr.exe
Token: SeCreateGlobalPrivilege	5140	taskmgr.exe
Token: SeManageVolumePrivilege	5696	uTorrent.exe
Token: 33	5140	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5140	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
192	utorrent_installer.tmp
3480	uTorrent.exe
3480	uTorrent.exe
3480	uTorrent.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5696	uTorrent.exe
5696	uTorrent.exe
5696	uTorrent.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3480	uTorrent.exe
3480	uTorrent.exe
3480	uTorrent.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5696	uTorrent.exe
5696	uTorrent.exe
5696	uTorrent.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe
5140	taskmgr.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
3544	utorrentie.exe
3544	utorrentie.exe
3920	utorrentie.exe
3920	utorrentie.exe
2884	utorrentie.exe
2884	utorrentie.exe
1736	utorrentie.exe
1736	utorrentie.exe
3656	MicrosoftEdge.exe
4112	MicrosoftEdgeCP.exe
4220	MicrosoftEdgeCP.exe
4112	MicrosoftEdgeCP.exe
2072	utorrentie.exe
2072	utorrentie.exe
5884	utorrentie.exe
5884	utorrentie.exe
6016	utorrentie.exe
6016	utorrentie.exe
5124	utorrentie.exe
5124	utorrentie.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 192	1260	utorrent_installer.exe	73
PID 1260 wrote to memory of 192	1260	utorrent_installer.exe	73
PID 1260 wrote to memory of 192	1260	utorrent_installer.exe	73
PID 192 wrote to memory of 4752	192	utorrent_installer.tmp	74
PID 192 wrote to memory of 4752	192	utorrent_installer.tmp	74
PID 192 wrote to memory of 4752	192	utorrent_installer.tmp	74
PID 4752 wrote to memory of 3348	4752	uTorrent.exe	75
PID 4752 wrote to memory of 3348	4752	uTorrent.exe	75
PID 4752 wrote to memory of 3348	4752	uTorrent.exe	75
PID 192 wrote to memory of 3480	192	utorrent_installer.tmp	79
PID 192 wrote to memory of 3480	192	utorrent_installer.tmp	79
PID 192 wrote to memory of 3480	192	utorrent_installer.tmp	79
PID 3480 wrote to memory of 3544	3480	uTorrent.exe	80
PID 3480 wrote to memory of 3544	3480	uTorrent.exe	80
PID 3480 wrote to memory of 3544	3480	uTorrent.exe	80
PID 3480 wrote to memory of 3920	3480	uTorrent.exe	81
PID 3480 wrote to memory of 3920	3480	uTorrent.exe	81
PID 3480 wrote to memory of 3920	3480	uTorrent.exe	81
PID 3480 wrote to memory of 2948	3480	uTorrent.exe	82
PID 3480 wrote to memory of 2948	3480	uTorrent.exe	82
PID 3480 wrote to memory of 2948	3480	uTorrent.exe	82
PID 3480 wrote to memory of 2884	3480	uTorrent.exe	83
PID 3480 wrote to memory of 2884	3480	uTorrent.exe	83
PID 3480 wrote to memory of 2884	3480	uTorrent.exe	83
PID 3480 wrote to memory of 1736	3480	uTorrent.exe	84
PID 3480 wrote to memory of 1736	3480	uTorrent.exe	84
PID 3480 wrote to memory of 1736	3480	uTorrent.exe	84
PID 2948 wrote to memory of 3336	2948	MicrosoftEdgeWebView2Setup.exe	85
PID 2948 wrote to memory of 3336	2948	MicrosoftEdgeWebView2Setup.exe	85
PID 2948 wrote to memory of 3336	2948	MicrosoftEdgeWebView2Setup.exe	85
PID 3336 wrote to memory of 5000	3336	MicrosoftEdgeUpdate.exe	86
PID 3336 wrote to memory of 5000	3336	MicrosoftEdgeUpdate.exe	86
PID 3336 wrote to memory of 5000	3336	MicrosoftEdgeUpdate.exe	86
PID 3336 wrote to memory of 4432	3336	MicrosoftEdgeUpdate.exe	87
PID 3336 wrote to memory of 4432	3336	MicrosoftEdgeUpdate.exe	87
PID 3336 wrote to memory of 4432	3336	MicrosoftEdgeUpdate.exe	87
PID 4432 wrote to memory of 4428	4432	MicrosoftEdgeUpdate.exe	88
PID 4432 wrote to memory of 4428	4432	MicrosoftEdgeUpdate.exe	88
PID 4432 wrote to memory of 4644	4432	MicrosoftEdgeUpdate.exe	89
PID 4432 wrote to memory of 4644	4432	MicrosoftEdgeUpdate.exe	89
PID 4432 wrote to memory of 2056	4432	MicrosoftEdgeUpdate.exe	90
PID 4432 wrote to memory of 2056	4432	MicrosoftEdgeUpdate.exe	90
PID 3336 wrote to memory of 3312	3336	MicrosoftEdgeUpdate.exe	91
PID 3336 wrote to memory of 3312	3336	MicrosoftEdgeUpdate.exe	91
PID 3336 wrote to memory of 3312	3336	MicrosoftEdgeUpdate.exe	91
PID 3336 wrote to memory of 2184	3336	MicrosoftEdgeUpdate.exe	92
PID 3336 wrote to memory of 2184	3336	MicrosoftEdgeUpdate.exe	92
PID 3336 wrote to memory of 2184	3336	MicrosoftEdgeUpdate.exe	92
PID 3764 wrote to memory of 2896	3764	MicrosoftEdgeUpdate.exe	94
PID 3764 wrote to memory of 2896	3764	MicrosoftEdgeUpdate.exe	94
PID 3764 wrote to memory of 2896	3764	MicrosoftEdgeUpdate.exe	94
PID 4112 wrote to memory of 2936	4112	MicrosoftEdgeCP.exe	99
PID 4112 wrote to memory of 2936	4112	MicrosoftEdgeCP.exe	99
PID 4112 wrote to memory of 2936	4112	MicrosoftEdgeCP.exe	99
PID 4112 wrote to memory of 2936	4112	MicrosoftEdgeCP.exe	99
PID 4112 wrote to memory of 2936	4112	MicrosoftEdgeCP.exe	99
PID 4112 wrote to memory of 2936	4112	MicrosoftEdgeCP.exe	99
PID 4112 wrote to memory of 2936	4112	MicrosoftEdgeCP.exe	99
PID 4112 wrote to memory of 2936	4112	MicrosoftEdgeCP.exe	99
PID 4112 wrote to memory of 2936	4112	MicrosoftEdgeCP.exe	99
PID 4112 wrote to memory of 2936	4112	MicrosoftEdgeCP.exe	99
PID 4112 wrote to memory of 2936	4112	MicrosoftEdgeCP.exe	99
PID 4112 wrote to memory of 2936	4112	MicrosoftEdgeCP.exe	99
PID 4112 wrote to memory of 2936	4112	MicrosoftEdgeCP.exe	99

C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe
"C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\is-IDQQ2.tmp\utorrent_installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-IDQQ2.tmp\utorrent_installer.tmp" /SL5="$70220,840718,816128,C:\Users\Admin\AppData\Local\Temp\utorrent_installer.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:192
- - C:\Users\Admin\AppData\Local\Temp\is-3ILID.tmp\uTorrent.exe
    "C:\Users\Admin\AppData\Local\Temp\is-3ILID.tmp\uTorrent.exe" /S /FORCEINSTALL 1110010101111110
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\nsqC7D5.tmp\utorrent.exe
      "C:\Users\Admin\AppData\Local\Temp\nsqC7D5.tmp\utorrent.exe" /S /FORCEINSTALL 1110010101111110
      4⤵
      Identifies Wine through registry keys
      Adds Run key to start application
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:3348
- - C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
    "C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe"
    3⤵
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks SCSI registry key(s)
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47084\utorrentie.exe
      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47084\utorrentie.exe" uTorrent_3480_00D35700_1873235045 µTorrent4823DF041B09 uTorrent ie unp
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3544
  - - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47084\utorrentie.exe
      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47084\utorrentie.exe" uTorrent_3480_03AD0500_1608522550 µTorrent4823DF041B09 uTorrent ie unp
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:3920
  - - C:\Users\Admin\AppData\Roaming\uTorrent\MicrosoftEdgeWebView2Setup.exe
      MicrosoftEdgeWebView2Setup.exe /silent /install
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2948
    - - C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\Temp\EUE704.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
        5⤵
        Sets file execution options in registry
        Checks system information in the registry
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3336
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5000
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:4428
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:4644
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:2056
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzciIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuMzciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REMwMUNBRUEtNDM1Qy00RkU5LTgxQjItNTI4RDMwM0RCM0I3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsxODU0MDhGNi1GNkIzLTQzRDYtQTdBNi04MDFERUVBNDE4N0N9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE1MDYzLjAiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iUUVNVSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMTg3LjM3IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTg3OTAzNDI5IiBpbnN0YWxsX3RpbWVfbXM9IjY0MSIvPjwvYXBwPjwvcmVxdWVzdD4
        6⤵
        Checks system information in the registry
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3312
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{DC01CAEA-435C-4FE9-81B2-528D303DB3B7}" /silent
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2184
  - - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47084\utorrentie.exe
      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47084\utorrentie.exe" uTorrent_3480_03B7EEE8_522459126 µTorrent4823DF041B09 uTorrent ie unp
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2884
  - - C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47084\utorrentie.exe
      "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.6.0_47084\utorrentie.exe" uTorrent_3480_00D7BFC8_839247154 µTorrent4823DF041B09 uTorrent ie unp
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1736

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
PID:4428

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzciIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuMzciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REMwMUNBRUEtNDM1Qy00RkU5LTgxQjItNTI4RDMwM0RCM0I3fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MjRGMDc2QzMtNDM2Mi00M0ZCLUJCOUMtMjU2RENFQjYxMUIxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xNTA2My4wIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IlFFTVUiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjQ5IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MTIyMzM3MTIiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM1NjczMTcyMjE2OTg3MTgiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTE0MDY4IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTkxOTY1OTI3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Drops file in System32 directory
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:2896
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{89CD259E-44F0-40F3-A568-41E90A5F1400}\MicrosoftEdge_X64_125.0.2535.51.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{89CD259E-44F0-40F3-A568-41E90A5F1400}\MicrosoftEdge_X64_125.0.2535.51.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  PID:5580

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3656

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2432

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4220

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2936

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5416

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5140

C:\Users\Admin\AppData\Roaming\utorrent\uTorrent.exe
"C:\Users\Admin\AppData\Roaming\utorrent\uTorrent.exe"
1⤵
- Identifies Wine through registry keys
- Adds Run key to start application
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5696
- C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_47084\utorrentie.exe
  "C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_47084\utorrentie.exe" uTorrent_5696_00D0FF98_1565412579 µTorrent4823DF041B09 uTorrent ie unp
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2072
- C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_47084\utorrentie.exe
  "C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_47084\utorrentie.exe" uTorrent_5696_03ACBEC0_1919015663 µTorrent4823DF041B09 uTorrent ie unp
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5884
- C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_47084\utorrentie.exe
  "C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_47084\utorrentie.exe" uTorrent_5696_00D5EC60_117474931 µTorrent4823DF041B09 uTorrent ie unp
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:6016
- C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_47084\utorrentie.exe
  "C:\Users\Admin\AppData\Roaming\utorrent\updates\3.6.0_47084\utorrentie.exe" uTorrent_5696_03B21478_1888864054 µTorrent4823DF041B09 uTorrent ie unp
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5124

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\cdc64077016647e7886e4915318694a9 /t 5700 /p 5696
1⤵
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery