1d4911dd9becd105f1b609f642122a7a0a2f9828b9e6662848ab17eebee10142

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Active Setup\Installed Components	Explorer.EXE

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Public\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Public\Pictures\desktop.ini	Explorer.EXE

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\E:	Explorer.EXE
File opened (read-only)	\??\F:	Explorer.EXE

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5052_1593740021\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5052_1593740021\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5052_1593740021\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\INF\volsnap.PNF	Explorer.EXE

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winscript-portable.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2424	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3880	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	winscript-portable.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	winscript-portable.exe

Checks SCSI registry key(s) 3 TTPs 47 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	Explorer.EXE
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	Explorer.EXE
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Explorer.EXE
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Explorer.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Explorer.EXE
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	Explorer.EXE

Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Explorer.EXE

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\NotificationData	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{25B3EF49-CFBC-4B72-9105-9D314AEABD13}	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{DBCAACB6-BA7F-4643-AABC-1B2E3C572E96}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	Explorer.EXE

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

defense_evasion spyware trojan

pid	Process
4448	reg.exe
3232	reg.exe
3700	reg.exe
4976	reg.exe
5172	reg.exe
4820	reg.exe
3148	reg.exe
2260	reg.exe
2024	reg.exe
4932	reg.exe
2932	reg.exe
4548	reg.exe
4248	reg.exe
4732	reg.exe
4276	reg.exe
3604	reg.exe
2052	reg.exe
3568	reg.exe
2652	reg.exe
2712	reg.exe
5668	reg.exe
4836	reg.exe
4212	reg.exe
5756	reg.exe
4412	reg.exe
5916	reg.exe
3584	reg.exe
1800	reg.exe
1760	reg.exe
3120	reg.exe
1408	reg.exe
2052	reg.exe
1788	reg.exe
1084	reg.exe
1652	reg.exe
5360	reg.exe
1760	reg.exe
4172	reg.exe
4900	reg.exe
3460	reg.exe
5692	reg.exe
1248	reg.exe
4472	reg.exe
4700	reg.exe
2644	reg.exe
4548	reg.exe
1248	reg.exe
5668	reg.exe
5040	reg.exe
4728	reg.exe
564	reg.exe
3164	reg.exe
2416	reg.exe
4820	reg.exe
4700	reg.exe
3520	reg.exe
4264	reg.exe
4112	reg.exe
5688	reg.exe
5948	reg.exe
2164	reg.exe
2148	reg.exe
2492	reg.exe
2412	reg.exe

Modifies system certificate store 2 TTPs 6 IoCs

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	winscript-portable.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 6b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	winscript-portable.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df06b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a2000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	winscript-portable.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c0000000100000004000000800100006b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf15761419000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	winscript-portable.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	winscript-portable.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	winscript-portable.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6100	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2424	powershell.exe
2424	powershell.exe
2424	powershell.exe
2424	powershell.exe
6100	Explorer.EXE
6100	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5052	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeBackupPrivilege	688	vssvc.exe
Token: SeRestorePrivilege	688	vssvc.exe
Token: SeAuditPrivilege	688	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2424	powershell.exe
Token: SeSecurityPrivilege	2424	powershell.exe
Token: SeTakeOwnershipPrivilege	2424	powershell.exe
Token: SeLoadDriverPrivilege	2424	powershell.exe
Token: SeSystemProfilePrivilege	2424	powershell.exe
Token: SeSystemtimePrivilege	2424	powershell.exe
Token: SeProfSingleProcessPrivilege	2424	powershell.exe
Token: SeIncBasePriorityPrivilege	2424	powershell.exe
Token: SeCreatePagefilePrivilege	2424	powershell.exe
Token: SeBackupPrivilege	2424	powershell.exe
Token: SeRestorePrivilege	2424	powershell.exe
Token: SeShutdownPrivilege	2424	powershell.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeSystemEnvironmentPrivilege	2424	powershell.exe
Token: SeRemoteShutdownPrivilege	2424	powershell.exe
Token: SeUndockPrivilege	2424	powershell.exe
Token: SeManageVolumePrivilege	2424	powershell.exe
Token: 33	2424	powershell.exe
Token: 34	2424	powershell.exe
Token: 35	2424	powershell.exe
Token: 36	2424	powershell.exe
Token: SeIncreaseQuotaPrivilege	2424	powershell.exe
Token: SeSecurityPrivilege	2424	powershell.exe
Token: SeTakeOwnershipPrivilege	2424	powershell.exe
Token: SeLoadDriverPrivilege	2424	powershell.exe
Token: SeSystemProfilePrivilege	2424	powershell.exe
Token: SeSystemtimePrivilege	2424	powershell.exe
Token: SeProfSingleProcessPrivilege	2424	powershell.exe
Token: SeIncBasePriorityPrivilege	2424	powershell.exe
Token: SeCreatePagefilePrivilege	2424	powershell.exe
Token: SeBackupPrivilege	2424	powershell.exe
Token: SeRestorePrivilege	2424	powershell.exe
Token: SeShutdownPrivilege	2424	powershell.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeSystemEnvironmentPrivilege	2424	powershell.exe
Token: SeRemoteShutdownPrivilege	2424	powershell.exe
Token: SeUndockPrivilege	2424	powershell.exe
Token: SeManageVolumePrivilege	2424	powershell.exe
Token: 33	2424	powershell.exe
Token: 34	2424	powershell.exe
Token: 35	2424	powershell.exe
Token: 36	2424	powershell.exe
Token: SeIncreaseQuotaPrivilege	2424	powershell.exe
Token: SeSecurityPrivilege	2424	powershell.exe
Token: SeTakeOwnershipPrivilege	2424	powershell.exe
Token: SeLoadDriverPrivilege	2424	powershell.exe
Token: SeSystemProfilePrivilege	2424	powershell.exe
Token: SeSystemtimePrivilege	2424	powershell.exe
Token: SeProfSingleProcessPrivilege	2424	powershell.exe
Token: SeIncBasePriorityPrivilege	2424	powershell.exe
Token: SeCreatePagefilePrivilege	2424	powershell.exe
Token: SeBackupPrivilege	2424	powershell.exe
Token: SeRestorePrivilege	2424	powershell.exe
Token: SeShutdownPrivilege	2424	powershell.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeSystemEnvironmentPrivilege	2424	powershell.exe
Token: SeRemoteShutdownPrivilege	2424	powershell.exe
Token: SeUndockPrivilege	2424	powershell.exe
Token: SeManageVolumePrivilege	2424	powershell.exe
Token: 33	2424	powershell.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
3340	winscript-portable.exe
6100	Explorer.EXE
6100	Explorer.EXE
6100	Explorer.EXE
6100	Explorer.EXE
6100	Explorer.EXE
6100	Explorer.EXE
6100	Explorer.EXE
6100	Explorer.EXE
6100	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
6100	Explorer.EXE
6100	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5072	StartMenuExperienceHost.exe
3588	SearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 5052	3340	winscript-portable.exe	89
PID 5052 wrote to memory of 1236	5052	msedgewebview2.exe	90
PID 5052 wrote to memory of 120	5052	msedgewebview2.exe	91
PID 5052 wrote to memory of 120	5052	msedgewebview2.exe	91
PID 5052 wrote to memory of 120	5052	msedgewebview2.exe	91
PID 5052 wrote to memory of 120	5052	msedgewebview2.exe	91
PID 5052 wrote to memory of 2668	5052	msedgewebview2.exe	92
PID 5052 wrote to memory of 2828	5052	msedgewebview2.exe	93
PID 5052 wrote to memory of 2828	5052	msedgewebview2.exe	93
PID 5052 wrote to memory of 2828	5052	msedgewebview2.exe	93
PID 5052 wrote to memory of 4592	5052	msedgewebview2.exe	94
PID 5052 wrote to memory of 4592	5052	msedgewebview2.exe	94
PID 5052 wrote to memory of 4592	5052	msedgewebview2.exe	94
PID 5052 wrote to memory of 4592	5052	msedgewebview2.exe	94
PID 5052 wrote to memory of 4592	5052	msedgewebview2.exe	94
PID 3340 wrote to memory of 1576	3340	winscript-portable.exe	98
PID 3340 wrote to memory of 3880	3340	winscript-portable.exe	100
PID 3880 wrote to memory of 2424	3880	cmd.exe	102
PID 5052 wrote to memory of 5236	5052	msedgewebview2.exe	108
PID 5052 wrote to memory of 5236	5052	msedgewebview2.exe	108
PID 5052 wrote to memory of 5236	5052	msedgewebview2.exe	108
PID 2424 wrote to memory of 4264	2424	powershell.exe	198
PID 2424 wrote to memory of 4412	2424	powershell.exe	114
PID 2424 wrote to memory of 4820	2424	powershell.exe	191
PID 2424 wrote to memory of 4700	2424	powershell.exe	192
PID 2424 wrote to memory of 3584	2424	powershell.exe	193
PID 2424 wrote to memory of 2052	2424	powershell.exe	194
PID 2424 wrote to memory of 4836	2424	powershell.exe	119
PID 2424 wrote to memory of 2644	2424	powershell.exe	120
PID 2424 wrote to memory of 4212	2424	powershell.exe	121
PID 2424 wrote to memory of 4112	2424	powershell.exe	199
PID 2424 wrote to memory of 5260	2424	powershell.exe	123
PID 2424 wrote to memory of 1004	2424	powershell.exe	124
PID 2424 wrote to memory of 5048	2424	powershell.exe	125
PID 2424 wrote to memory of 628	2424	powershell.exe	126
PID 2424 wrote to memory of 360	2424	powershell.exe	127
PID 2424 wrote to memory of 4480	2424	powershell.exe	128
PID 2424 wrote to memory of 4908	2424	powershell.exe	129
PID 2424 wrote to memory of 3148	2424	powershell.exe	130
PID 2424 wrote to memory of 1800	2424	powershell.exe	131
PID 2424 wrote to memory of 5688	2424	powershell.exe	132
PID 2424 wrote to memory of 4548	2424	powershell.exe	211
PID 2424 wrote to memory of 1248	2424	powershell.exe	212
PID 2424 wrote to memory of 1760	2424	powershell.exe	213
PID 2424 wrote to memory of 5668	2424	powershell.exe	214
PID 2424 wrote to memory of 1784	2424	powershell.exe	137
PID 2424 wrote to memory of 5948	2424	powershell.exe	138
PID 2424 wrote to memory of 4732	2424	powershell.exe	139
PID 2424 wrote to memory of 2260	2424	powershell.exe	140
PID 2424 wrote to memory of 4952	2424	powershell.exe	141
PID 2424 wrote to memory of 1452	2424	powershell.exe	142
PID 2424 wrote to memory of 1084	2424	powershell.exe	143
PID 2424 wrote to memory of 3120	2424	powershell.exe	144
PID 2424 wrote to memory of 2164	2424	powershell.exe	145
PID 2424 wrote to memory of 4152	2424	powershell.exe	146
PID 2424 wrote to memory of 1524	2424	powershell.exe	147
PID 2424 wrote to memory of 6100	2424	powershell.exe	148
PID 2424 wrote to memory of 5544	2424	powershell.exe	149
PID 2424 wrote to memory of 5460	2424	powershell.exe	150
PID 2424 wrote to memory of 5796	2424	powershell.exe	151
PID 2424 wrote to memory of 3692	2424	powershell.exe	152
PID 2424 wrote to memory of 4848	2424	powershell.exe	153
PID 2424 wrote to memory of 1872	2424	powershell.exe	154
PID 2424 wrote to memory of 4348	2424	powershell.exe	155

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\winscript-portable.exe
"C:\Users\Admin\AppData\Local\Temp\winscript-portable.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=winscript-portable.exe --webview-exe-version=2.23.0 --user-data-dir="C:\Users\Admin\AppData\Local\flick.winscript.dev\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=es-ES --accept-lang=es-ES --mojo-named-platform-channel-pipe=3340.2336.15610400188111104983 /pfhostedapp:4ffd11238405356fcaee5c2164d32f592b387bf3
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\flick.winscript.dev\EBWebView /prefetch:4 /pfhostedapp:4ffd11238405356fcaee5c2164d32f592b387bf3 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\flick.winscript.dev\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff879f25fd8,0x7ff879f25fe4,0x7ff879f25ff0
    3⤵
    PID:1236
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\flick.winscript.dev\EBWebView" --webview-exe-name=winscript-portable.exe --webview-exe-version=2.23.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1788,i,10506087513512454246,12383511409848720092,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:4ffd11238405356fcaee5c2164d32f592b387bf3
    3⤵
    PID:120
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\flick.winscript.dev\EBWebView" --webview-exe-name=winscript-portable.exe --webview-exe-version=2.23.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2080 --field-trial-handle=1788,i,10506087513512454246,12383511409848720092,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:4ffd11238405356fcaee5c2164d32f592b387bf3
    3⤵
    PID:2668
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\flick.winscript.dev\EBWebView" --webview-exe-name=winscript-portable.exe --webview-exe-version=2.23.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2360 --field-trial-handle=1788,i,10506087513512454246,12383511409848720092,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ffd11238405356fcaee5c2164d32f592b387bf3
    3⤵
    PID:2828
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\flick.winscript.dev\EBWebView" --webview-exe-name=winscript-portable.exe --webview-exe-version=2.23.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3540 --field-trial-handle=1788,i,10506087513512454246,12383511409848720092,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:4ffd11238405356fcaee5c2164d32f592b387bf3 /prefetch:1
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\flick.winscript.dev\EBWebView" --webview-exe-name=winscript-portable.exe --webview-exe-version=2.23.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4488 --field-trial-handle=1788,i,10506087513512454246,12383511409848720092,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ffd11238405356fcaee5c2164d32f592b387bf3
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\flick.winscript.dev\EBWebView" --webview-exe-name=winscript-portable.exe --webview-exe-version=2.23.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4544 --field-trial-handle=1788,i,10506087513512454246,12383511409848720092,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ffd11238405356fcaee5c2164d32f592b387bf3
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\flick.winscript.dev\EBWebView" --webview-exe-name=winscript-portable.exe --webview-exe-version=2.23.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4608 --field-trial-handle=1788,i,10506087513512454246,12383511409848720092,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ffd11238405356fcaee5c2164d32f592b387bf3
    3⤵
    PID:2260
- C:\Windows\system32\where.exe
  "where.exe" wt
  2⤵
  PID:1576
- C:\Windows\system32\cmd.exe
  "cmd.exe" /c start powershell -NoProfile -NoLogo -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\winscript\winscript.ps1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NoLogo -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\winscript\winscript.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection /v AllowDesktopAnalyticsProcessing /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:4264
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection /v AllowDeviceNameInTelemetry /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:4412
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection /v MicrosoftEdgeDataOptIn /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:4820
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection /v AllowWUfBCloudProcessing /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:4700
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection /v AllowUpdateComplianceProcessing /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:3584
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection /v AllowCommercialDataPipeline /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:2052
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection /v AllowTelemetry /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:4836
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\Software\Policies\Microsoft\Windows\DataCollection /v DisableOneSettingsDownloads /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2644
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\Software\Policies\Microsoft\SQMClient\Windows /v CEIPEnable /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:4212
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v AllowTelemetry /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:4112
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v NoGenTicket /t REG_DWORD /d 1 /f
      4⤵
      PID:5260
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\Software\Policies\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
      4⤵
      PID:1004
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
      4⤵
      PID:5048
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent" /v DefaultConsent /t REG_DWORD /d 0 /f
      4⤵
      PID:628
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent" /v DefaultOverrideBehavior /t REG_DWORD /d 1 /f
      4⤵
      PID:360
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v DontSendAdditionalData /t REG_DWORD /d 1 /f
      4⤵
      PID:4480
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v LoggingDisabled /t REG_DWORD /d 1 /f
      4⤵
      PID:4908
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v ContentDeliveryAllowed /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:3148
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SubscribedContentEnabled /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:1800
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v OemPreInstalledAppsEnabled /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:5688
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v PreInstalledAppsEnabled /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:4548
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v PreInstalledAppsEverEnabled /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:1248
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SilentInstalledAppsEnabled /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:1760
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SystemPaneSuggestionsEnabled /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:5668
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v FeatureManagementEnabled /d 0 /t REG_DWORD /f
      4⤵
      PID:1784
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\Software\Microsoft\Windows\CurrentVersion\SystemSettings\AccountNotifications /v EnableAccountNotifications /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:5948
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\SystemSettings\AccountNotifications /v EnableAccountNotifications /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:4732
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\Software\Policies\Microsoft\Windows\EdgeUI /v DisableMFUTracking /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2260
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKCU\Control Panel\International\User Profile" /v HttpAcceptLanguageOptOut /t REG_DWORD /d 1 /f
      4⤵
      PID:4952
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v PublishUserActivities /t REG_DWORD /d 0 /f
      4⤵
      PID:1452
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v UploadUserActivities /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:1084
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Start_TrackProgs /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:3120
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Personalization\Settings /v AcceptedPrivacyPolicy /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:2164
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v ConnectedSearchPrivacy /t REG_DWORD /d 3 /f
      4⤵
      PID:4152
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v AllowSearchToUseLocation /t REG_DWORD /d 0 /f
      4⤵
      PID:1524
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v EnableDynamicContentInWSB /t REG_DWORD /d 0 /f
      4⤵
      PID:6100
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v ConnectedSearchUseWeb /t REG_DWORD /d 0 /f
      4⤵
      PID:5544
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v DisableWebSearch /t REG_DWORD /d 1 /f
      4⤵
      PID:5460
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v PreventUnwantedAddIns /t REG_SZ /d " " /f
      4⤵
      PID:5796
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v PreventRemoteQueries /t REG_DWORD /d 1 /f
      4⤵
      PID:3692
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v AlwaysUseAutoLangDetection /t REG_DWORD /d 0 /f
      4⤵
      PID:4848
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v AllowIndexingEncryptedStoresOrItems /t REG_DWORD /d 0 /f
      4⤵
      PID:1872
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v ConnectedSearchUseWebOverMeteredConnections /t REG_DWORD /d 0 /f
      4⤵
      PID:4348
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v AllowCloudSearch /t REG_DWORD /d 0 /f
      4⤵
      PID:6116
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v AllowCortana /t REG_DWORD /d 0 /f
      4⤵
      PID:4344
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer /v DisableSearchBoxSuggestions /t REG_DWORD /d 1 /f
      4⤵
      PID:3556
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\Software\Policies\Microsoft\Windows\Explorer /v DisableSearchHistory /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3604
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\SearchSettings /v IsDynamicSearchBoxEnabled /t REG_DWORD /d 0 /f
      4⤵
      PID:2352
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings /v IsMSACloudSearchEnabled /t REG_DWORD /d 0 /f
      4⤵
      PID:5812
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings /v IsAADCloudSearchEnabled /t REG_DWORD /d 0 /f
      4⤵
      PID:1296
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\SearchSettings /v IsDeviceSearchHistoryEnabled /t REG_DWORD /d 0 /f
      4⤵
      PID:2388
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search /v BingSearchEnabled /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:5756
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search /v VoiceShortcut /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:5040
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search /v DeviceHistoryEnabled /t REG_DWORD /d 0 /f
      4⤵
      PID:1132
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search /v HistoryViewEnabled /t REG_DWORD /d 0 /f
      4⤵
      PID:4268
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Search /v CortanaEnabled /t REG_DWORD /d 0 /f
      4⤵
      PID:5476
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v AllowCortana /t REG_DWORD /d 0 /f
      4⤵
      PID:1396
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching /v SearchOrderConfig /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:4448
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization /v DODownloadMode /t REG_DWORD /d 99 /f
      4⤵
      Modifies registry key
      PID:4728
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Mail /v EnableLogging /t REG_DWORD /d 0 /f
      4⤵
      PID:4580
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Mail /v EnableLogging /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:5916
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Calendar /v EnableCalendarLogging /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:3164
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Calendar /v EnableCalendarLogging /t REG_DWORD /d 0 /f
      4⤵
      PID:3292
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Office\15.0\Word\Options /v EnableLogging /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:4276
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Office\16.0\Word\Options /v EnableLogging /t REG_DWORD /d 0 /f
      4⤵
      PID:4736
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Policies\Microsoft\Office\15.0\OSM /v EnableLogging /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:3568
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\OSM /v EnableLogging /t REG_DWORD /d 0 /f
      4⤵
      PID:3960
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Policies\Microsoft\Office\15.0\OSM /v EnableUpload /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:2024
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\OSM /v EnableUpload /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:564
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Office\Common\ClientTelemetry /v DisableTelemetry /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3232
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry /v DisableTelemetry /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3700
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Office\Common\ClientTelemetry /v VerboseLogging /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:2652
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry /v VerboseLogging /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:2416
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Office\15.0\Common /v QMEnable /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:4172
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Office\16.0\Common /v QMEnable /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:1408
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Office\15.0\Common\Feedback /v Enabled /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:2148
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Feedback /v Enabled /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:4900
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Siuf\Rules /v NumberOfSIUFInPeriod /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:2492
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v DoNotShowFeedbackNotifications /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4820
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection /v DoNotShowFeedbackNotifications /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4700
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization /v RestrictImplicitInkCollection /t REG_DWORD /d 1 /f
      4⤵
      PID:3584
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization /v RestrictImplicitTextCollection /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2052
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\Software\Policies\Microsoft\Windows\HandwritingErrorReports /v PreventHandwritingErrorReports /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1652
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\TabletPC /v PreventHandwritingDataSharing /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3460
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization /v AllowInputPersonalization /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:5692
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\InputPersonalization\TrainedDataStore /v HarvestContacts /t REG_DWORD /d 0 /f
      4⤵
      PID:4264
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent /v DisableSoftLanding /t REG_DWORD /d 1 /f
      4⤵
      PID:4112
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\Software\Policies\Microsoft\Windows\CloudContent /v DisableWindowsSpotlightFeatures /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2712
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\Software\Policies\Microsoft\Windows\CloudContent /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1788
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\Software\Policies\Microsoft\Windows\CloudContent /v DisableTailoredExperiencesWithDiagnosticData /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3520
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\Software\Policies\Microsoft\Windows\CloudContent /v DisableTailoredExperiencesWithDiagnosticData /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5360
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\Software\Policies\Microsoft\Windows\CloudContent /v TailoredExperiencesWithDiagnosticDataEnabled /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:4976
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\AdvertisingInfo /v Enabled /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:5172
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo /v DisabledByGroupPolicy /t REG_DWORD /d 1 /f
      4⤵
      PID:4792
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo /v DisabledByGroupPolicy /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4932
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SubscribedContent-338393Enabled /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:2932
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SubscribedContent-353694Enabled /d 0 /t REG_DWORD /f
      4⤵
      PID:4364
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SubscribedContent-353696Enabled /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:2412
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SubscribedContent-338387Enabled /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:4548
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SubscribedContent-338388Enabled /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:1248
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SubscribedContent-338389Enabled /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:1760
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SubscribedContent-353698Enabled /d 0 /t REG_DWORD /f
      4⤵
      Modifies registry key
      PID:5668
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\WMDRM /v DisableOnline /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4472
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy /v HasAccepted /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:4248
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      4⤵
      Modifies registry class
      PID:4892

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:688

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:2844

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1084
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:6100

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:1576

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5072

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:3588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery