A PDF viewer that starts itself
Read Sysmon registry events (13) to find a new Run key value, the installer that set it, and the file it points to. Compare it with an ordinary Teams entry.
Briefing
e.novak installed a “free PDF viewer” from a search ad on Mar 12. Since then the laptop has been slow at every logon.
Sysmon event 13 records registry values being set: which process (Image), which key (TargetObject), and the new data (Details). Values under ...\CurrentVersion\Run start at logon.
LT-ENOVAK · Sysmon triage
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.