cc81be39adcb8ea105c75106084f7b6809014aede70b52fd7eb2f41d5c7c288c

Analysis

max time kernel
112s
max time network
80s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09/03/2023, 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Optimizer-14.9.exe
Size

2.1MB
MD5

0acd5fdeb1332e99679f9c5403fd5dbe
SHA1

9941abbb97c285b8528830cae8762b251e16991a
SHA256

cc81be39adcb8ea105c75106084f7b6809014aede70b52fd7eb2f41d5c7c288c
SHA512

d8ad8f65c8b02fab99a72345940ef35b70e4e366700aab95e7b6e344aa7758fd890b307a2a034091ea469ec3b000604a5cfcb9b081a2192b492ff46111f692f3
SSDEEP

24576:Z46Va9ejh8vRY4n+ED8GJWzWw3BA/ZTvQD0XY0AJBSjRlXP36RMG:Z46Va9ejh8vR8ED8GYzWw3EAJBSjh

Score

10^/10

discovery evasion persistence ransomware trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Optimizer-14.9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	Optimizer-14.9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Optimizer-14.9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Optimizer-14.9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Optimizer-14.9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	Optimizer-14.9.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0"	Optimizer-14.9.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Sets file execution options in registry 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\software_reporter_tool.exe	Optimizer-14.9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\software_reporter_tool.exe\Debugger = "%windir%\\System32\\taskkill.exe"	Optimizer-14.9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe	Optimizer-14.9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe\Debugger = "%windir%\\System32\\taskkill.exe"	Optimizer-14.9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeviceCensus.exe	Optimizer-14.9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeviceCensus.exe\Debugger = "%windir%\\System32\\taskkill.exe"	Optimizer-14.9.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1544	icacls.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	ip-api.com

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1636	sc.exe
1792	sc.exe
1312	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disabling Security Tools
T1089

Modify Registry
T1112

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
240	vssadmin.exe

Modifies Control Panel 9 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\Desktop\LowLevelHooksTimeout = "1000"	Optimizer-14.9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\Mouse\MouseHoverTime = "0"	Optimizer-14.9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\Accessibility\StickyKeys\Flags = "506"	Optimizer-14.9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\Desktop\WaitToKillAppTimeout = "2000"	Optimizer-14.9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\Accessibility\Keyboard Response\Flags = "122"	Optimizer-14.9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\Accessibility\ToggleKeys\Flags = "58"	Optimizer-14.9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\Desktop\AutoEndTasks = "1"	Optimizer-14.9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\Desktop\HungAppTimeout = "1000"	Optimizer-14.9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Control Panel\Desktop\MenuShowDelay = "0"	Optimizer-14.9.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter	Optimizer-14.9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	Optimizer-14.9.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\StickyKeys\Flags = "506"	Optimizer-14.9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\Keyboard Response\Flags = "122"	Optimizer-14.9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\ToggleKeys\Flags = "58"	Optimizer-14.9.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Copy To	Optimizer-14.9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Copy To\ = "{C2FBB630-2971-11D1-A18C-00C04FD75D13}"	Optimizer-14.9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Move To	Optimizer-14.9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Move To\ = "{C2FBB631-2971-11D1-A18C-00C04FD75D13}"	Optimizer-14.9.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Optimizer-14.9.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Optimizer-14.9.exe

Runs .reg file with regedit 1 IoCs

pid	Process
216	regedit.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	Optimizer-14.9.exe
Token: SeBackupPrivilege	836	vssvc.exe
Token: SeRestorePrivilege	836	vssvc.exe
Token: SeAuditPrivilege	836	vssvc.exe
Token: SeShutdownPrivilege	1640	powercfg.exe
Token: SeShutdownPrivilege	1640	powercfg.exe
Token: SeShutdownPrivilege	1640	powercfg.exe
Token: SeShutdownPrivilege	1640	powercfg.exe
Token: SeShutdownPrivilege	1640	powercfg.exe
Token: SeCreatePagefilePrivilege	1640	powercfg.exe
Token: SeShutdownPrivilege	868	powercfg.exe
Token: SeShutdownPrivilege	868	powercfg.exe
Token: SeShutdownPrivilege	868	powercfg.exe
Token: SeShutdownPrivilege	868	powercfg.exe
Token: SeShutdownPrivilege	868	powercfg.exe
Token: SeCreatePagefilePrivilege	868	powercfg.exe
Token: SeTakeOwnershipPrivilege	2020	Optimizer-14.9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 852	2020	Optimizer-14.9.exe	29
PID 2020 wrote to memory of 852	2020	Optimizer-14.9.exe	29
PID 2020 wrote to memory of 852	2020	Optimizer-14.9.exe	29
PID 852 wrote to memory of 1636	852	cmd.exe	31
PID 852 wrote to memory of 1636	852	cmd.exe	31
PID 852 wrote to memory of 1636	852	cmd.exe	31
PID 2020 wrote to memory of 240	2020	Optimizer-14.9.exe	33
PID 2020 wrote to memory of 240	2020	Optimizer-14.9.exe	33
PID 2020 wrote to memory of 240	2020	Optimizer-14.9.exe	33
PID 2020 wrote to memory of 520	2020	Optimizer-14.9.exe	37
PID 2020 wrote to memory of 520	2020	Optimizer-14.9.exe	37
PID 2020 wrote to memory of 520	2020	Optimizer-14.9.exe	37
PID 520 wrote to memory of 1640	520	cmd.exe	39
PID 520 wrote to memory of 1640	520	cmd.exe	39
PID 520 wrote to memory of 1640	520	cmd.exe	39
PID 2020 wrote to memory of 2032	2020	Optimizer-14.9.exe	40
PID 2020 wrote to memory of 2032	2020	Optimizer-14.9.exe	40
PID 2020 wrote to memory of 2032	2020	Optimizer-14.9.exe	40
PID 2032 wrote to memory of 868	2032	cmd.exe	42
PID 2032 wrote to memory of 868	2032	cmd.exe	42
PID 2032 wrote to memory of 868	2032	cmd.exe	42
PID 2020 wrote to memory of 1172	2020	Optimizer-14.9.exe	43
PID 2020 wrote to memory of 1172	2020	Optimizer-14.9.exe	43
PID 2020 wrote to memory of 1172	2020	Optimizer-14.9.exe	43
PID 1172 wrote to memory of 752	1172	cmd.exe	45
PID 1172 wrote to memory of 752	1172	cmd.exe	45
PID 1172 wrote to memory of 752	1172	cmd.exe	45
PID 2020 wrote to memory of 564	2020	Optimizer-14.9.exe	46
PID 2020 wrote to memory of 564	2020	Optimizer-14.9.exe	46
PID 2020 wrote to memory of 564	2020	Optimizer-14.9.exe	46
PID 564 wrote to memory of 1552	564	cmd.exe	48
PID 564 wrote to memory of 1552	564	cmd.exe	48
PID 564 wrote to memory of 1552	564	cmd.exe	48
PID 564 wrote to memory of 676	564	cmd.exe	49
PID 564 wrote to memory of 676	564	cmd.exe	49
PID 564 wrote to memory of 676	564	cmd.exe	49
PID 564 wrote to memory of 1252	564	cmd.exe	50
PID 564 wrote to memory of 1252	564	cmd.exe	50
PID 564 wrote to memory of 1252	564	cmd.exe	50
PID 564 wrote to memory of 968	564	cmd.exe	51
PID 564 wrote to memory of 968	564	cmd.exe	51
PID 564 wrote to memory of 968	564	cmd.exe	51
PID 564 wrote to memory of 300	564	cmd.exe	52
PID 564 wrote to memory of 300	564	cmd.exe	52
PID 564 wrote to memory of 300	564	cmd.exe	52
PID 564 wrote to memory of 1312	564	cmd.exe	53
PID 564 wrote to memory of 1312	564	cmd.exe	53
PID 564 wrote to memory of 1312	564	cmd.exe	53
PID 564 wrote to memory of 1088	564	cmd.exe	54
PID 564 wrote to memory of 1088	564	cmd.exe	54
PID 564 wrote to memory of 1088	564	cmd.exe	54
PID 564 wrote to memory of 276	564	cmd.exe	55
PID 564 wrote to memory of 276	564	cmd.exe	55
PID 564 wrote to memory of 276	564	cmd.exe	55
PID 564 wrote to memory of 1284	564	cmd.exe	56
PID 564 wrote to memory of 1284	564	cmd.exe	56
PID 564 wrote to memory of 1284	564	cmd.exe	56
PID 564 wrote to memory of 292	564	cmd.exe	57
PID 564 wrote to memory of 292	564	cmd.exe	57
PID 564 wrote to memory of 292	564	cmd.exe	57
PID 564 wrote to memory of 1168	564	cmd.exe	58
PID 564 wrote to memory of 1168	564	cmd.exe	58
PID 564 wrote to memory of 1168	564	cmd.exe	58
PID 564 wrote to memory of 2040	564	cmd.exe	59

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments\ScanWithAntiVirus = "1"	Optimizer-14.9.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Optimizer-14.9.exe
"C:\Users\Admin\AppData\Local\Temp\Optimizer-14.9.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies visibility of file extensions in Explorer
- Sets file execution options in registry
- Modifies Control Panel
- Modifies Internet Explorer Phishing Filter
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C sc config "RemoteRegistry" start= disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Windows\system32\sc.exe
    sc config "RemoteRegistry" start= disabled
    3⤵
    - Launches sc.exe
    PID:1636
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /for=c: /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:240
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C powercfg -h off
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:520
- - C:\Windows\system32\powercfg.exe
    powercfg -h off
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C powercfg -h off
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\system32\powercfg.exe
    powercfg -h off
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C fsutil behavior set disablelastaccess 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\system32\fsutil.exe
    fsutil behavior set disablelastaccess 1
    3⤵
    PID:752
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016"
    3⤵
    PID:1552
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016" /disable
    3⤵
    PID:676
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016"
    3⤵
    PID:1252
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016" /disable
    3⤵
    PID:968
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack"
    3⤵
    PID:300
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack" /disable
    3⤵
    PID:1312
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn"
    3⤵
    PID:1088
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn" /disable
    3⤵
    PID:276
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Mail" /v "EnableLogging" /t REG_DWORD /d 0 /f
    3⤵
    PID:1284
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Mail" /v "EnableLogging" /t REG_DWORD /d 0 /f
    3⤵
    PID:292
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Calendar" /v "EnableCalendarLogging" /t REG_DWORD /d 0 /f
    3⤵
    PID:1168
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Calendar" /v "EnableCalendarLogging" /t REG_DWORD /d 0 /f
    3⤵
    PID:2040
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Word\Options" /v "EnableLogging" /t REG_DWORD /d 0 /f
    3⤵
    PID:1272
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Word\Options" /v "EnableLogging" /t REG_DWORD /d 0 /f
    3⤵
    PID:1240
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\15.0\OSM" /v "EnableLogging" /t REG_DWORD /d 0 /f
    3⤵
    PID:1972
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\OSM" /v "EnableLogging" /t REG_DWORD /d 0 /f
    3⤵
    PID:1624
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\15.0\OSM" /v "EnableUpload" /t REG_DWORD /d 0 /f
    3⤵
    PID:1672
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\OSM" /v "EnableUpload" /t REG_DWORD /d 0 /f
    3⤵
    PID:1744
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\Common\ClientTelemetry" /v "DisableTelemetry" /t REG_DWORD /d 1 /f
    3⤵
    PID:1480
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry" /v "DisableTelemetry" /t REG_DWORD /d 1 /f
    3⤵
    PID:880
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\Common\ClientTelemetry" /v "VerboseLogging" /t REG_DWORD /d 0 /f
    3⤵
    PID:760
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry" /v "VerboseLogging" /t REG_DWORD /d 0 /f
    3⤵
    PID:1464
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Common" /v "QMEnable" /t REG_DWORD /d 0 /f
    3⤵
    PID:1504
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common" /v "QMEnable" /t REG_DWORD /d 0 /f
    3⤵
    PID:1048
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Common\Feedback" /v "Enabled" /t REG_DWORD /d 0 /f
    3⤵
    PID:1736
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Feedback" /v "Enabled" /t REG_DWORD /d 0 /f
    3⤵
    PID:208
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe" /s "C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.reg"
  2⤵
  - Runs .reg file with regedit
  PID:216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C schtasks.exe /change /disable /tn "\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB"
  2⤵
  PID:228
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /change /disable /tn "\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB"
    3⤵
    PID:1068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C schtasks.exe /change /disable /tn "\Mozilla\Firefox Default Browser Agent D2CEEC440E2074BD"
  2⤵
  PID:240
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /change /disable /tn "\Mozilla\Firefox Default Browser Agent D2CEEC440E2074BD"
    3⤵
    PID:1920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C schtasks.exe /change /tn NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable
  2⤵
  PID:1268
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /change /tn NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable
    3⤵
    PID:1692
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C schtasks.exe /change /tn NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable
  2⤵
  PID:1976
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /change /tn NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable
    3⤵
    PID:1172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C schtasks.exe /change /tn NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable
  2⤵
  PID:1916
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /change /tn NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable
    3⤵
    PID:1960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C net.exe stop NvTelemetryContainer
  2⤵
  PID:468
- - C:\Windows\system32\net.exe
    net.exe stop NvTelemetryContainer
    3⤵
    PID:1636
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop NvTelemetryContainer
      4⤵
      PID:852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C sc.exe config NvTelemetryContainer start= disabled
  2⤵
  PID:968
- - C:\Windows\system32\sc.exe
    sc.exe config NvTelemetryContainer start= disabled
    3⤵
    - Launches sc.exe
    PID:1792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C sc.exe stop NvTelemetryContainer
  2⤵
  PID:816
- - C:\Windows\system32\sc.exe
    sc.exe stop NvTelemetryContainer
    3⤵
    - Launches sc.exe
    PID:1312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C icacls C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger /deny SYSTEM:`(OI`)`(CI`)F
  2⤵
  PID:1588
- - C:\Windows\system32\icacls.exe
    icacls C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger /deny SYSTEM:`(OI`)`(CI`)F
    3⤵
    - Modifies file permissions
    PID:1544
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\ProgramData\Optimizer\Required\DisableTelemetryTasks.bat""
  2⤵
  PID:296
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator"
    3⤵
    PID:1640
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /disable
    3⤵
    PID:1172
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\BthSQM"
    3⤵
    PID:976
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\BthSQM" /disable
    3⤵
    PID:1312
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask"
    3⤵
    PID:1304
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /disable
    3⤵
    PID:1272
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip"
    3⤵
    PID:452
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /disable
    3⤵
    PID:224
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\Uploader"
    3⤵
    PID:1268
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\Uploader" /disable
    3⤵
    PID:964
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser"
    3⤵
    PID:1916
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /disable
    3⤵
    PID:1172
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater"
    3⤵
    PID:1252
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /disable
    3⤵
    PID:1552
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Application Experience\StartupAppTask"
    3⤵
    PID:676
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Application Experience\StartupAppTask" /disable"
    3⤵
    PID:1380
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector"
    3⤵
    PID:1124
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /disable
    3⤵
    PID:432
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver"
    3⤵
    PID:1988
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver" /disable
    3⤵
    PID:1320
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem"
    3⤵
    PID:816
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem" /disable
    3⤵
    PID:1256
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Shell\FamilySafetyMonitor"
    3⤵
    PID:1292
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Shell\FamilySafetyMonitor" /disable
    3⤵
    PID:292
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Shell\FamilySafetyRefresh"
    3⤵
    PID:276
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Shell\FamilySafetyRefresh" /disable
    3⤵
    PID:536
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Shell\FamilySafetyUpload"
    3⤵
    PID:1624
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Shell\FamilySafetyUpload" /disable
    3⤵
    PID:924
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Autochk\Proxy"
    3⤵
    PID:1480
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Autochk\Proxy" /disable
    3⤵
    PID:1048
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Maintenance\WinSAT"
    3⤵
    PID:212
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Maintenance\WinSAT" /disable
    3⤵
    PID:1744
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Application Experience\AitAgent"
    3⤵
    PID:1852
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Application Experience\AitAgent" /disable
    3⤵
    PID:1588
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Windows Error Reporting\QueueReporting"
    3⤵
    PID:1728
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Windows Error Reporting\QueueReporting" /disable
    3⤵
    PID:564
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\CloudExperienceHost\CreateObjectTask"
    3⤵
    PID:1680
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\CloudExperienceHost\CreateObjectTask" /disable
    3⤵
    PID:812
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\DiskFootprint\Diagnostics"
    3⤵
    PID:1796
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\DiskFootprint\Diagnostics" /disable
    3⤵
    PID:220
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\FileHistory\File History (maintenance mode)"
    3⤵
    PID:1692
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\FileHistory\File History (maintenance mode)" /disable
    3⤵
    PID:1356
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\PI\Sqm-Tasks"
    3⤵
    PID:752
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\PI\Sqm-Tasks" /disable
    3⤵
    PID:1804
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\NetTrace\GatherNetworkInfo"
    3⤵
    PID:1844
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\NetTrace\GatherNetworkInfo" /disable
    3⤵
    PID:1476
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\AppID\SmartScreenSpecific"
    3⤵
    PID:1960
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\AppID\SmartScreenSpecific" /disable
    3⤵
    PID:1708
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /Disable
    3⤵
    PID:1920
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "\Microsoft\Windows\Time Synchronization\ForceSynchronizeTime" /Disable
    3⤵
    PID:1192
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "\Microsoft\Windows\Time Synchronization\SynchronizeTime" /Disable
    3⤵
    PID:1636
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\HelloFace\FODCleanupTask"
    3⤵
    PID:468
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\HelloFace\FODCleanupTask" /disable
    3⤵
    PID:860
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Feedback\Siuf\DmClient"
    3⤵
    PID:1632
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Feedback\Siuf\DmClient" /disable
    3⤵
    PID:1524
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload"
    3⤵
    PID:968
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload" /disable
    3⤵
    PID:300
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Application Experience\PcaPatchDbTask"
    3⤵
    PID:1548
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Application Experience\PcaPatchDbTask" /disable
    3⤵
    PID:788
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Device Information\Device"
    3⤵
    PID:984
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Device Information\Device" /disable
    3⤵
    PID:1284
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Device Information\Device User"
    3⤵
    PID:2040
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Device Information\Device User" /disable
    3⤵
    PID:1856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
1⤵
PID:1320

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

File Deletion

T1107

File and Directory Permissions Modification

T1222

Hidden Files and Directories

T1158

Impair Defenses

T1562

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Optimizer\Optimizer.json

Filesize
2KB

MD5
24c8a4a835a55211dd99e00688a8ab54

SHA1
86f7acc9933c94fa6329b6bb95c7089c80605210

SHA256
2ee9cd453ff0057c4e85b95a1531e47b4d284fa7d69b3fd46241a0a2f16cdb34

SHA512
0cdd1a5b855b4c8949d5365991111e7eb5dc9211b8fd2705a5260b7b1b0df881bc693721e095800c19323104a348d6a077f146e4a75bd3830110f41da9cdce75

Download Submit
C:\ProgramData\Optimizer\Optimizer.log

Filesize
789B

MD5
a0138d1905f70d4aa1af22c10c8039d7

SHA1
4820ccf2f419a7f03a455f513155b898e3f0c4fa

SHA256
eddfa1c1a7af4b9332ca5bfefdfa17ff12248e449a3188af05800a536d465ab4

SHA512
0d6c2d5f68759b261440257fd60cb01cea231163269af48762b3abcef7f4dbe566fd1d0c7b6461cea44ab5974efe9cfa5bf5b6ecce07bdcc5119cd095e65d271

Download Submit
C:\ProgramData\Optimizer\Optimizer.log

Filesize
789B

MD5
a0138d1905f70d4aa1af22c10c8039d7

SHA1
4820ccf2f419a7f03a455f513155b898e3f0c4fa

SHA256
eddfa1c1a7af4b9332ca5bfefdfa17ff12248e449a3188af05800a536d465ab4

SHA512
0d6c2d5f68759b261440257fd60cb01cea231163269af48762b3abcef7f4dbe566fd1d0c7b6461cea44ab5974efe9cfa5bf5b6ecce07bdcc5119cd095e65d271

Download Submit
C:\ProgramData\Optimizer\Optimizer.log

Filesize
289B

MD5
cc9959c976ec578e99adb50949128da0

SHA1
b7a5556a82c70fa899c4175fe90301d21782593e

SHA256
cbb7abb8aa100eb5ea50621bb31bb7c774bffefe7471fbfe959bcea2332bfbfc

SHA512
ed55cee448db0ed95e494f9b8e68cde7fcb913dc3276b3267cf7cf54c734d02c569c0630c2df91cd6a7908b558b0fe789f38ca9dff40ae4f6c004f9f998fbac0

Download Submit
C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.bat

Filesize
2KB

MD5
fed75b5cb9d9f4ec5ee22b8fd304ccf7

SHA1
1b4bdac9ac71fdee3bae90e52fcec60c88d7fa9d

SHA256
d884c0d04ba09b113d9439d2f8c0b7ed322111ae2e3ed802f6a95278ff8e0ac2

SHA512
36bed8311050f8c79e766678c59bb65177630279af8b4d2302aaf6146157887e1fb744785ac7f3290519778a592fb4d90fb7b7b9420e7346efdfec1085bf34e9

Download Submit
C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.bat

Filesize
2KB

MD5
fed75b5cb9d9f4ec5ee22b8fd304ccf7

SHA1
1b4bdac9ac71fdee3bae90e52fcec60c88d7fa9d

SHA256
d884c0d04ba09b113d9439d2f8c0b7ed322111ae2e3ed802f6a95278ff8e0ac2

SHA512
36bed8311050f8c79e766678c59bb65177630279af8b4d2302aaf6146157887e1fb744785ac7f3290519778a592fb4d90fb7b7b9420e7346efdfec1085bf34e9

Download Submit
C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.reg

Filesize
649B

MD5
2446deb7e8dfd6336a44e1d53df9cf33

SHA1
b293c203ce60d883e541f84331fbffbe439e455a

SHA256
61b217ef0ff73b6f35d8ff86096f2db483785cb7532687ebdf0d4cd029ebab2a

SHA512
d4b522d0c8b1b691b7f5b1968689c690eb886ad767e5fc42b98be1a9afb24f302e16f1243fdc368da147717bb195bfd3761b7049beb03873c9bf7ccc4a3562f6

Download Submit
C:\ProgramData\Optimizer\Required\DisableTelemetryTasks.bat

Filesize
5KB

MD5
cb03c3144aaff8fb1c3497c403c2b60f

SHA1
ba4380abb20eaaeb638cdb142452def731817212

SHA256
abd9b7c86e9186c4af174c2a630629588ec89a716d3ff04d357d2610e490c8d3

SHA512
d76cf1fa9662bbafc931eb3720213e30a99de34ae0d92ff90a52a761555fc934fc9822c6beeddb882fabf990b30b17e8bf35b8acbc9d9898618d38fc259e9660

Download Submit
C:\ProgramData\Optimizer\Required\DisableTelemetryTasks.bat

Filesize
5KB

MD5
cb03c3144aaff8fb1c3497c403c2b60f

SHA1
ba4380abb20eaaeb638cdb142452def731817212

SHA256
abd9b7c86e9186c4af174c2a630629588ec89a716d3ff04d357d2610e490c8d3

SHA512
d76cf1fa9662bbafc931eb3720213e30a99de34ae0d92ff90a52a761555fc934fc9822c6beeddb882fabf990b30b17e8bf35b8acbc9d9898618d38fc259e9660

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cd96566b342b1b5e986203c3038d29a

SHA1
61a4feffc66a150914613491c95fd4e28fb1ab43

SHA256
0e97c604af8d65a3e26f0898bda983683ef61cbae8b8c7b4e61a4144212589e6

SHA512
18b031da5c1d5e209b3b2d9247adad26e76245d09d9d12f3eb21a8ed1122d8ca8031003aaf290b6506cb2460675c76e09204fcda82b94665ab49e157059e1c5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99d9be5d305ec3f3cd182b95191bda5e

SHA1
4a3c6aea58fbfdf3b8fd88517444926d2c5aebc3

SHA256
766c7c434e8da23b0fbb5f91b6b0b5763bca500c79bcc69868297f3ac8eb19f8

SHA512
190465fc2933c189d26ef3c4bff64553d593e557152aae383518adb79b54a4f9bfe4bb513971a8297f5e0a4218e6008732eac5af682e45627c92619f0f344875

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d58126a91bbb4bc16b5cf8da14a458bc

SHA1
492738be7c764b0f1b88033752fc8c9ab6ebaadd

SHA256
922f722b0fc16cfc44935691be81c9e94e559a702618f25bea5b91a124b3b2c5

SHA512
d4e01eca0170bc282b1518e42650168aba3b05539693c9e315fbf29f432de69a6e4365f47e311383a5a068cb6bdd0834612abd19f05d929ab26511b9860492cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCAD6.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
memory/2020-155-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-317-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-166-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-157-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-156-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-54-0x0000000000DF0000-0x000000000100E000-memory.dmp

Filesize
2.1MB

Download
memory/2020-79-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-78-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-77-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-76-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-75-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-316-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-315-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-165-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-318-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-319-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-320-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-321-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-55-0x000000001AD70000-0x000000001AE22000-memory.dmp

Filesize
712KB

Download
memory/2020-324-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-325-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-326-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-327-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-328-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-329-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-330-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-331-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download
memory/2020-332-0x000000001B0E0000-0x000000001B160000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads