404eec34e015e17d41e52a1906bd4c514a879939a325f2ccfbe51140bd4d5a6f

Analysis

user interaction
yes
max time kernel
4s
max time network
29s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 20:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
INSTALLER.exe
Size 11KB
Sample261030-y61dcafe42
SHA256 404eec34e015e17d41e52a1906bd4c514a879939a325f2ccfbe51140bd4d5a6f
MD5 57b29d126b8ec473e0006396328d03c4
SHA1 6534f0ca6ce0a4ab8e387d00e96fcd7e6f1de4b7
SHA512 1a1e8e73445233cb75c298e8eb8938d08a00c9302b3a5786ad7e8df0d445ae206a22c2bb7aac4e45e0b48c949298d7680059bfd0217b47b5c5f2c01536897f44
SSDEEP 192:oUdD38oWELyakdSin7r7Z5a+dRtVz7X0n0E49w6CZnj3a7:9yoWEvvur7ra+dRtdX+0j93CG
TLSH
T15932C61DB3E88A24D5BE4B3218B7D2108770F4138E2BCB5E1DE99CF92D273146976B91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware bootkit collection execution persistence privilege_escalation spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Active Setup\Installed Components	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}	reg.exe

Manipulates Digital Signatures 1 TTPs 60 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\trust	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CTLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\trust	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	INSTALLER.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies system executable filetype association 2 TTPs 19 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\lnkfile\shellex	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\lnkfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	reg.exe

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe
Key opened	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	INSTALLER.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\services.exe	INSTALLER.exe
File opened for modification	C:\Windows\System32\lsass.exe	INSTALLER.exe
File opened for modification	C:\Windows\System32\smss.exe	INSTALLER.exe
File opened for modification	C:\Windows\System32\svchost.exe	INSTALLER.exe
File opened for modification	C:\Windows\System32\user32.dll	INSTALLER.exe
File opened for modification	C:\Windows\System32\advapi32.dll	INSTALLER.exe
File opened for modification	C:\Windows\System32\ole32.dll	INSTALLER.exe
File opened for modification	C:\Windows\System32\wininit.exe	INSTALLER.exe
File opened for modification	C:\Windows\System32\dwm.exe	INSTALLER.exe
File opened for modification	C:\Windows\System32\spoolsv.exe	INSTALLER.exe
File opened for modification	C:\Windows\System32\ntdll.dll	INSTALLER.exe
File opened for modification	C:\Windows\System32\kernel32.dll	INSTALLER.exe
File opened for modification	C:\Windows\System32\gdi32.dll	INSTALLER.exe
File opened for modification	C:\Windows\System32\ntoskrnl.exe	INSTALLER.exe
File opened for modification	C:\Windows\System32\winlogon.exe	INSTALLER.exe
File opened for modification	C:\Windows\System32\csrss.exe	INSTALLER.exe
File opened for modification	C:\Windows\System32\shell32.dll	INSTALLER.exe
File opened for modification	C:\Windows\System32\dllhost.exe	INSTALLER.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1584	cmd.exe
1880	cmd.exe
3580	cmd.exe
2080	cmd.exe
3176	cmd.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	reg.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	reg.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Setup	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Zoom	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\powerpoint	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\SQM	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\34	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Services	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\d99f01ab_0	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Help_Menu_URLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\21	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\26	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\29	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Settings	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\IETld\LowMic	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\16	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\3	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\30	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\37	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Security	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Suggested Sites	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\10	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\18	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\27	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\ms-word	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Desktop	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\23	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\28	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Desktop\General	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\31	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\33	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\35	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\25	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\14	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\LinksBar	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\excel	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\ms-excel	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\6	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\20	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\5	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\ms-powerpoint	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager	reg.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace461026441	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\EventLabels\Notification.Looping.Alarm2	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm7\.Default	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Input\TSF	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\Notification.IM	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\EventLabels\ActivatingDocument	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\Explorer\Navigating\.Default	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\Ribbons	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm2\.Default	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\WindowsUAC\.Current	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Control Panel\PowerCfg\PowerPolicies\1	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\EUDC	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\ime\IMTC70\FuzzyScheme	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\Notification.Looping.Call4	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\PeerNet	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4595840bd\a37dfe62	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\System\GameConfigStore\Parents	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\MenuCommand\.Current	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Open\.Current	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Accessibility	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\Notification.Proximity	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\RestoreDown\.Current	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Windows.SystemToast.Usb.Notification	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Windows	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\CLSID	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\CTF\SortOrder	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\EventLabels\Notification.Looping.Call2	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-19	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Control Panel\Input Method\Hot Keys\00000203	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\EventLabels\CCSelect	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AsyncTextService_8wekyb3d8bbwe%5Cresources.pri\1d7e5367b3ad534	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Windows.SystemToast.BthQuickPair	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Control Panel\International	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\InputPersonalization	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\PeerNet\Event_Config	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\Windows Error Reporting	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4c5ed6b63	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe%5Cresources.pri\1d5acddd8370c4b\a37dfe62	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\AppGPFault\.Current	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Console\%SystemRoot%_SysWOW64_WindowsPowerShell_v1.0_powershell.exe	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\SoundSentry	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\StickyKeys	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe%5Cresources.pri	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\Notification.Looping.Alarm7	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Wisp\MultiTouch	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Control Panel\Input Method\Hot Keys	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4cf7b9220	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.fontdrvhost	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID	reg.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0203-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0225-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.orf\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\.sr2\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0138-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0066-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0076-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0134-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0148-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0234-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0340-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0164-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Extensions\ContractId\Windows.ComponentUI\PackageId\Microsoft.MicrosoftEdge_44.19041.1266.0_neutral__8wekyb3d8bbwe\ActivatableClassId\PdfReader	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\TypeLib	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\WOW6432Node\Interface\{679EC955-75AA-4FB2-A7ED-8C0152ECF409}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.fky	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0109-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0116-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0268-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0139-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0340-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0032-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0084-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0088-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0015-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0052-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0282-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0301-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\AppXw3nvmqt363p060ea53qg33er1a0782a8\DefaultIcon	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0060-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0219-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0012-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0250-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\grvopen\shell	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\Schemas	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.iiq\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0173-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0037-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0261-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Extensions\ContractId\Windows.Protocol\PackageId\Microsoft.ECApp_10.0.19041.1023_neutral__8wekyb3d8bbwe\ActivatableClassId	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.msrcincident	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.obj	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\AppX0enk2acdsmv8ydhntbtea6yjp27223q6\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ex_\PersistentHandler	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0100-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0116-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0336-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Interface\{1b7aed4f-fcaf-4da4-8795-c03e635d8edc}\TypeLib	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\TypeLib\{C9F3F6BB-3172-4CD8-9EB7-37C9BE601C87}\1.0\HELPDIR	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ZFSendToTarget\PersistentHandler	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\AppX1apmywg4z9t3tk3nrn9y8ntjc5cg9675\Shell\open	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0042-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0063-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0038-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0078-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0061-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0210-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.bay\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.css\PersistentHandler	reg.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4136	reg.exe
4200	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3732	INSTALLER.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 1584	3732	INSTALLER.exe	87
PID 3732 wrote to memory of 1880	3732	INSTALLER.exe	89
PID 3732 wrote to memory of 3580	3732	INSTALLER.exe	91
PID 3732 wrote to memory of 2080	3732	INSTALLER.exe	93
PID 3732 wrote to memory of 3176	3732	INSTALLER.exe	95
PID 1880 wrote to memory of 4136	1880	cmd.exe	97
PID 1584 wrote to memory of 1164	1584	cmd.exe	98
PID 3176 wrote to memory of 5076	3176	cmd.exe	99
PID 3580 wrote to memory of 4200	3580	cmd.exe	100
PID 2080 wrote to memory of 4820	2080	cmd.exe	101

outlook_office_path 1 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe

C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
"C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe"
1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\system32\reg.exe
    reg delete HKCR /f
    3⤵
    - Modifies registry class
    PID:1164
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg delete HKCU /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\system32\reg.exe
    reg delete HKCU /f
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Manipulates Digital Signatures
    - Modifies system executable filetype association
    - Accesses Microsoft Outlook profiles
    - Adds Run key to start application
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Modifies registry key
    - outlook_office_path
    PID:4136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg delete HKLM /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\system32\reg.exe
    reg delete HKLM /f
    3⤵
    - Modifies system executable filetype association
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Modifies registry key
    PID:4200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg delete HKU /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\system32\reg.exe
    reg delete HKU /f
    3⤵
    - Manipulates Digital Signatures
    - Adds Run key to start application
    - Modifies data under HKEY_USERS
    - Modifies registry class
    PID:4820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg delete HKCC /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\system32\reg.exe
    reg delete HKCC /f
    3⤵
    PID:5076

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x338 0x3c0
1⤵
PID:2040

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy
1⤵
PID:1840