dd70c11d7952c0986b3e2a962799f921201290f1b92d4c40b2c717daa635c246

Analysis

max time kernel
1275s
max time network
1278s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
21-09-2024 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WindowsToolbox.bat
Size

156KB
MD5

2be2af971d62345dee8241432121dfd4
SHA1

819f7fa0f1f3bececd5b441a988bab5421867b6e
SHA256

dd70c11d7952c0986b3e2a962799f921201290f1b92d4c40b2c717daa635c246
SHA512

2e97d8911daff9c8b4833796dfbc9cc8cb26f20adad0fb2dd89169e300c31f5b9e3396beb18fc74446c5cad81cde1a78359d953cd3a514d5c7b8dac44144df6a
SSDEEP

1536:EcAizX5Sj8KH2Yoj1XzTAssI84Ugfd6uIkrZN9n1sIPtimn1xVR5BeZ6ZW8HaMrb:W2Yoj1XzLwyJpjR

Score

10^/10

defense_evasion discovery evasion execution impact persistence ransomware

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0"	Optimizer-16.0.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490
Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\software_reporter_tool.exe	Optimizer-16.0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\software_reporter_tool.exe\Debugger = "%windir%\\System32\\taskkill.exe"	Optimizer-16.0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe	Optimizer-16.0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe\Debugger = "%windir%\\System32\\taskkill.exe"	Optimizer-16.0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeviceCensus.exe	Optimizer-16.0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeviceCensus.exe\Debugger = "%windir%\\System32\\taskkill.exe"	Optimizer-16.0.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1360	icacls.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
110	raw.githubusercontent.com
1	raw.githubusercontent.com
4	discord.com
48	discord.com
49	discord.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4732	sc.exe
1696	sc.exe
4472	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fortnite_Settings (@TheTulantro).exe

Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4844	vssadmin.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter	Optimizer-16.0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	Optimizer-16.0.exe

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\StickyKeys\Flags = "506"	Optimizer-16.0.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\Keyboard Response\Flags = "122"	Optimizer-16.0.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\ToggleKeys\Flags = "58"	Optimizer-16.0.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack	Optimizer-16.0.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack	Optimizer-16.0.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	Optimizer-16.0.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	Optimizer-16.0.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	Optimizer-16.0.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack\ShowedToastAtLevel = "1"	Optimizer-16.0.exe
Key created	\REGISTRY\USER\.DEFAULT	Optimizer-16.0.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Optimizer-16.0.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Diagnostics	Optimizer-16.0.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133713598690849973"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Privacy	Optimizer-16.0.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Privacy\TailoredExperiencesWithDiagnosticDataEnabled = "0"	Optimizer-16.0.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3761892313-3378554128-2287991803-1000\{997C3CE2-411A-443F-9106-8B9151C3404D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Copy To	Optimizer-16.0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Copy To\ = "{C2FBB630-2971-11D1-A18C-00C04FD75D13}"	Optimizer-16.0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Move To	Optimizer-16.0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Move To\ = "{C2FBB631-2971-11D1-A18C-00C04FD75D13}"	Optimizer-16.0.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Clixke Tweaks UPDATED.zip:Zone.Identifier	msedge.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2616	regedit.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1580	chrome.exe
1580	chrome.exe
2268	msedge.exe
2268	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
660	msedge.exe
660	msedge.exe
4876	identity_helper.exe
4876	identity_helper.exe
3336	msedge.exe
3336	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
1488	msedge.exe
1488	msedge.exe
3136	Optimizer-16.0.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe
Token: SeShutdownPrivilege	1580	chrome.exe
Token: SeCreatePagefilePrivilege	1580	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
1580	chrome.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2448	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 4464	3328	cmd.exe	79
PID 3328 wrote to memory of 4464	3328	cmd.exe	79
PID 1580 wrote to memory of 3712	1580	chrome.exe	83
PID 1580 wrote to memory of 3712	1580	chrome.exe	83
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 3248	1580	chrome.exe	84
PID 1580 wrote to memory of 2312	1580	chrome.exe	85
PID 1580 wrote to memory of 2312	1580	chrome.exe	85
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86
PID 1580 wrote to memory of 3932	1580	chrome.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\WindowsToolbox.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  PID:4464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff942cccc40,0x7ff942cccc4c,0x7ff942cccc58
  2⤵
  PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1872,i,314737975012558640,12794993699291672950,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1432,i,314737975012558640,12794993699291672950,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2212,i,314737975012558640,12794993699291672950,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,314737975012558640,12794993699291672950,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3144,i,314737975012558640,12794993699291672950,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4352,i,314737975012558640,12794993699291672950,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4440,i,314737975012558640,12794993699291672950,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4640,i,314737975012558640,12794993699291672950,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4376,i,314737975012558640,12794993699291672950,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3500,i,314737975012558640,12794993699291672950,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3440,i,314737975012558640,12794993699291672950,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3784 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3800,i,314737975012558640,12794993699291672950,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5104,i,314737975012558640,12794993699291672950,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  PID:576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3436,i,314737975012558640,12794993699291672950,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3468 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4972,i,314737975012558640,12794993699291672950,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4848,i,314737975012558640,12794993699291672950,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4456,i,314737975012558640,12794993699291672950,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:2872

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff943053cb8,0x7ff943053cc8,0x7ff943053cd8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2652 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2528 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,876752920094850031,8796630502968920135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2108

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E4
1⤵
PID:4764

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2448

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3676

C:\Users\Admin\AppData\Local\Temp\Temp1_Clixke Tweaks UPDATED.zip\Clixke Tweaks UPDATED\Clixke Tweaks\FORTNITE TWEAKS\Fortnite_Settings (@TheTulantro).exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Clixke Tweaks UPDATED.zip\Clixke Tweaks UPDATED\Clixke Tweaks\FORTNITE TWEAKS\Fortnite_Settings (@TheTulantro).exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2416

C:\Users\Admin\AppData\Local\Temp\Temp1_Clixke Tweaks UPDATED.zip\Clixke Tweaks UPDATED\Clixke Tweaks\OPTIMIZER MUST DO AFTER ALL\Optimizer-16.0.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Clixke Tweaks UPDATED.zip\Clixke Tweaks UPDATED\Clixke Tweaks\OPTIMIZER MUST DO AFTER ALL\Optimizer-16.0.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Event Triggered Execution: Image File Execution Options Injection
- Modifies Internet Explorer Phishing Filter
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3136
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C sc config "RemoteRegistry" start= disabled
  2⤵
  PID:3304
- - C:\Windows\system32\sc.exe
    sc config "RemoteRegistry" start= disabled
    3⤵
    - Launches sc.exe
    PID:4732
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /for=c: /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.bat""
  2⤵
  PID:1820
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016"
    3⤵
    PID:1188
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016" /disable
    3⤵
    PID:1104
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016"
    3⤵
    PID:4356
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016" /disable
    3⤵
    PID:4636
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack"
    3⤵
    PID:4496
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack" /disable
    3⤵
    PID:4888
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn"
    3⤵
    PID:4764
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn" /disable
    3⤵
    PID:4176
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Mail" /v "EnableLogging" /t REG_DWORD /d 0 /f
    3⤵
    PID:1600
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Mail" /v "EnableLogging" /t REG_DWORD /d 0 /f
    3⤵
    PID:560
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Calendar" /v "EnableCalendarLogging" /t REG_DWORD /d 0 /f
    3⤵
    PID:3912
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Calendar" /v "EnableCalendarLogging" /t REG_DWORD /d 0 /f
    3⤵
    PID:2536
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Word\Options" /v "EnableLogging" /t REG_DWORD /d 0 /f
    3⤵
    PID:4472
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Word\Options" /v "EnableLogging" /t REG_DWORD /d 0 /f
    3⤵
    PID:3040
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\15.0\OSM" /v "EnableLogging" /t REG_DWORD /d 0 /f
    3⤵
    PID:4612
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\OSM" /v "EnableLogging" /t REG_DWORD /d 0 /f
    3⤵
    PID:1248
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\15.0\OSM" /v "EnableUpload" /t REG_DWORD /d 0 /f
    3⤵
    PID:1620
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\OSM" /v "EnableUpload" /t REG_DWORD /d 0 /f
    3⤵
    PID:2620
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\Common\ClientTelemetry" /v "DisableTelemetry" /t REG_DWORD /d 1 /f
    3⤵
    PID:1360
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry" /v "DisableTelemetry" /t REG_DWORD /d 1 /f
    3⤵
    PID:1656
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\Common\ClientTelemetry" /v "VerboseLogging" /t REG_DWORD /d 0 /f
    3⤵
    PID:2728
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry" /v "VerboseLogging" /t REG_DWORD /d 0 /f
    3⤵
    PID:2064
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Common" /v "QMEnable" /t REG_DWORD /d 0 /f
    3⤵
    PID:2240
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common" /v "QMEnable" /t REG_DWORD /d 0 /f
    3⤵
    PID:4136
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Common\Feedback" /v "Enabled" /t REG_DWORD /d 0 /f
    3⤵
    PID:1828
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Feedback" /v "Enabled" /t REG_DWORD /d 0 /f
    3⤵
    PID:2144
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe" /s "C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.reg"
  2⤵
  - Runs .reg file with regedit
  PID:2616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C schtasks.exe /change /disable /tn "\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB"
  2⤵
  PID:1844
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /change /disable /tn "\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB"
    3⤵
    PID:2216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C schtasks.exe /change /disable /tn "\Mozilla\Firefox Default Browser Agent D2CEEC440E2074BD"
  2⤵
  PID:3580
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /change /disable /tn "\Mozilla\Firefox Default Browser Agent D2CEEC440E2074BD"
    3⤵
    PID:3944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C schtasks.exe /change /tn NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable
  2⤵
  PID:4784
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /change /tn NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable
    3⤵
    PID:3284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C schtasks.exe /change /tn NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable
  2⤵
  PID:292
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /change /tn NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable
    3⤵
    PID:1012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C schtasks.exe /change /tn NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable
  2⤵
  PID:4212
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /change /tn NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable
    3⤵
    PID:3960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C net.exe stop NvTelemetryContainer
  2⤵
  PID:2332
- - C:\Windows\system32\net.exe
    net.exe stop NvTelemetryContainer
    3⤵
    PID:1344
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop NvTelemetryContainer
      4⤵
      PID:3992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C sc.exe config NvTelemetryContainer start= disabled
  2⤵
  PID:3536
- - C:\Windows\system32\sc.exe
    sc.exe config NvTelemetryContainer start= disabled
    3⤵
    - Launches sc.exe
    PID:1696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C sc.exe stop NvTelemetryContainer
  2⤵
  PID:2976
- - C:\Windows\system32\sc.exe
    sc.exe stop NvTelemetryContainer
    3⤵
    - Launches sc.exe
    PID:4472
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C icacls C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger /deny SYSTEM:`(OI`)`(CI`)F
  2⤵
  PID:420
- - C:\Windows\system32\icacls.exe
    icacls C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger /deny SYSTEM:`(OI`)`(CI`)F
    3⤵
    - Modifies file permissions
    PID:1360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Optimizer\Required\DisableTelemetryTasks.bat""
  2⤵
  PID:3720
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator"
    3⤵
    PID:4732
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /disable
    3⤵
    PID:908
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\BthSQM"
    3⤵
    PID:1132
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\BthSQM" /disable
    3⤵
    PID:4812
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask"
    3⤵
    PID:1820
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /disable
    3⤵
    PID:2764
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip"
    3⤵
    PID:3124
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /disable
    3⤵
    PID:2632
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\Uploader"
    3⤵
    PID:2204
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\Uploader" /disable
    3⤵
    PID:4644
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser"
    3⤵
    PID:4152
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /disable
    3⤵
    PID:2136
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater"
    3⤵
    PID:108
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /disable
    3⤵
    PID:4480
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Application Experience\StartupAppTask"
    3⤵
    PID:3944
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Application Experience\StartupAppTask" /disable"
    3⤵
    PID:3100
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector"
    3⤵
    PID:912
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /disable
    3⤵
    PID:5048
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver"
    3⤵
    PID:1860
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver" /disable
    3⤵
    PID:3628
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem"
    3⤵
    PID:2956
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem" /disable
    3⤵
    PID:2000
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Shell\FamilySafetyMonitor"
    3⤵
    PID:3092
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Shell\FamilySafetyMonitor" /disable
    3⤵
    PID:4272
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Shell\FamilySafetyRefresh"
    3⤵
    PID:4056
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Shell\FamilySafetyRefresh" /disable
    3⤵
    PID:1096
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Shell\FamilySafetyUpload"
    3⤵
    PID:3268
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Shell\FamilySafetyUpload" /disable
    3⤵
    PID:1112
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Autochk\Proxy"
    3⤵
    PID:792
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Autochk\Proxy" /disable
    3⤵
    PID:4044
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Maintenance\WinSAT"
    3⤵
    PID:320
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Maintenance\WinSAT" /disable
    3⤵
    PID:2952
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Application Experience\AitAgent"
    3⤵
    PID:3960
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Application Experience\AitAgent" /disable
    3⤵
    PID:480
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Windows Error Reporting\QueueReporting"
    3⤵
    PID:3244
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Windows Error Reporting\QueueReporting" /disable
    3⤵
    PID:4892
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\CloudExperienceHost\CreateObjectTask"
    3⤵
    PID:4816
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\CloudExperienceHost\CreateObjectTask" /disable
    3⤵
    PID:1344
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\DiskFootprint\Diagnostics"
    3⤵
    PID:4648
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\DiskFootprint\Diagnostics" /disable
    3⤵
    PID:3184
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\FileHistory\File History (maintenance mode)"
    3⤵
    PID:2380
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\FileHistory\File History (maintenance mode)" /disable
    3⤵
    PID:1696
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\PI\Sqm-Tasks"
    3⤵
    PID:4176
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\PI\Sqm-Tasks" /disable
    3⤵
    PID:3560
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\NetTrace\GatherNetworkInfo"
    3⤵
    PID:2884
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\NetTrace\GatherNetworkInfo" /disable
    3⤵
    PID:3056
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\AppID\SmartScreenSpecific"
    3⤵
    PID:3316
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\AppID\SmartScreenSpecific" /disable
    3⤵
    PID:2396
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /Disable
    3⤵
    PID:4844
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "\Microsoft\Windows\Time Synchronization\ForceSynchronizeTime" /Disable
    3⤵
    PID:1620
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "\Microsoft\Windows\Time Synchronization\SynchronizeTime" /Disable
    3⤵
    PID:3324
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\HelloFace\FODCleanupTask"
    3⤵
    PID:3768
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\HelloFace\FODCleanupTask" /disable
    3⤵
    PID:2620
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Feedback\Siuf\DmClient"
    3⤵
    PID:1644
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Feedback\Siuf\DmClient" /disable
    3⤵
    PID:4136
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload"
    3⤵
    PID:1828
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload" /disable
    3⤵
    PID:2144
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Application Experience\PcaPatchDbTask"
    3⤵
    PID:784
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Application Experience\PcaPatchDbTask" /disable
    3⤵
    PID:3716
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Device Information\Device"
    3⤵
    PID:972
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Device Information\Device" /disable
    3⤵
    PID:4232
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Device Information\Device User"
    3⤵
    PID:4080
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Device Information\Device User" /disable
    3⤵
    PID:2248

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2208

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Optimizer\Optimizer.log

Filesize
295B

MD5
4c8a16c29fd0677ab4f4ce16fbdf8e57

SHA1
1e9b43eda39593c594df278a3139ee5172afe097

SHA256
fae4ca55627040c6f36615114ecb3f827f0f50f70825c761402ebe659e05f1d5

SHA512
863a2dff7adafd10cb7a50b9e4e371c505742dfc2047a2870edb9beab4f061303111457aa0faa3db4c2ed53651e0b1060315eeb35136756bfedcbdc97a9a3b1f

Download Submit
C:\ProgramData\Optimizer\Optimizer.log

Filesize
803B

MD5
1a1984a226e91969125c4b59b01c6a4d

SHA1
40db9bd08dccc248468db8edc5bd048a269fc484

SHA256
b5cce78bd197e9053855b3f2283af311567b6a9e0d1e8f1e08a0c23e5c439dd2

SHA512
66947bf53ddbad5d3c5c0c07b3f30d52872888f8c277ffa83451fe0ff8862efa4aeab8efcc05e504f7b64c6ae14be75fddbd92ff0b3d7af340a56900e057c69a

Download Submit
C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.bat

Filesize
2KB

MD5
74d8445be29f93a57f3427d36307a650

SHA1
dac24aad0dffa278693e219f6773d04a700a8540

SHA256
9b4e4f516b45f4d8c6fc399b5fe25797298fd51782c922a1372a57807635b3ef

SHA512
bacac50ceb07d80553e7391df29eab746eeffee16009173fa48f93fc042c405e543d50bbd22ba1970238319312c121e5d8a28515d7f382ef61eeda0282f078d1

Download Submit
C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.reg

Filesize
648B

MD5
7f7b192506491e4105e2ae1cf5ea9067

SHA1
5dafd2516bd4a4b3d230624f8ea590f640e2c381

SHA256
41cf9db9e395349b94ec7a1ee99db68062f27bf95c3b364aa6b035dc39ff1dc0

SHA512
5fcfbec12316f24bdbadb3d4a018945de9afb849fcfc026e601728b1dce107eaf1b8ce56d5e646461006a45bb305f16e3160d760649f7716b70a3e2fd195763f

Download Submit
C:\ProgramData\Optimizer\Required\DisableTelemetryTasks.bat

Filesize
5KB

MD5
0080a81e8536bacfa428f3e39ed0d219

SHA1
76747a47c577b6cfa1dd0af116448315d988b227

SHA256
a65f9f4b5859e4154d5b78b85ac3343b8cf76bfa78120cdb50ef92cb27c6ba49

SHA512
eaa2eaa6ab1733497105a2a76f9d3c4add4a72c6d8dc2cfda7f0afb005e44c7b507657866b20c3bf3a2b2205e83832ee0bfe8fe4605c0d0dc38ec40b276accdd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
295333d03a279d3db129e207e3c96df5

SHA1
380f9211e67e416fbc613e2bd62eb009c28533fc

SHA256
94aad14f9063f90c94023409874dec52bb649ae1bc2c8e0c1efa9abbe2c85dc6

SHA512
a35b889c88e7336932d39f756a7281fada288d7c932a5718d844d86a477b31ccf26d7c3ca7e96f2895f639574bb804d4c0a16673ed43631d72df70215cd337a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\03ae0658db22f33f_0

Filesize
289B

MD5
419d450e57a9e9f314eee0d2aed85450

SHA1
a9f126ea872e1f6ddf09e52a8c3b61382cd43355

SHA256
0a821835432ee6d4c99525ed6ccece5c06c6e57372d5ab9b828ff70b15875847

SHA512
5883e7bd1c20b2761ffec9f839d9148ec3c41182f716e64eabc05c7dc1f34242dbaa63b2aa42111f3ddeedaa72e36761d2fd7bec55b4c9047545e88d1aae90d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\f1e238929875955b_0

Filesize
370KB

MD5
9db054883b0b119ffbadc2f251530694

SHA1
924c3f7e73310529cc2eac39012c915c5b28c8cb

SHA256
a224a5a5a7ce0ce74b1a927b6c819a51ff69e7417e000adda385fbdab20603d3

SHA512
577df65a3bb26dee04b7ad79ae713d151c798440d39222e2a2120aae848122e27f6b4a6b87b9c69ab8f14c27d8e3e36a845d18fd54019277bbcaaecd13ba81d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
6d1d98e3b3cf4b99f8fa69e73a02ed23

SHA1
9070349a25fada28b15df1a91ba0fbdfcc9615cd

SHA256
169a541b068636a70d4bc119f4a3583191604cbd94ebbe2afad09384521cee80

SHA512
7eefab47706d4dd6b6201792675d13d36147e4e9dd86e61c84b329c52157f304eb333272ecd5a66778b5c62a8099fdf03666822ab4dcef50ad74efacc48fb0ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
0ae0c6c6bb5bb904396d01db335e9aff

SHA1
15705e3763f62a7c80d657af56eed42cbad8c77f

SHA256
e00485ae5442386cbe08a7cf2502e76f8509a24d418eddbf7b0396ce44bfb515

SHA512
5f7fbd7a78d336f78c82f4715900897ca2b832ddc55f684f285ef27413cc8b540fec6b1466603ae2144507cf2f1cb77ab0633e155d9bb1cc6b9f6da8deb45f00

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
51c4bb1bce458b8c749d7f4b65d89340

SHA1
660b849b0e446726a19e3d421d398c7c67d2804a

SHA256
3c83194b1435231916f7b82b5b69cd275b7575397161ceb530f56610619c5211

SHA512
9bf6ae2e5ea724f2414739d32e4fc3d1f1b2dea76536cd238c171c00d2248163a730f0a5c566479207d9ec9f14a26725dbcd02d06a63b66f99e39f6fe24e3297

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
c8fb5a7c0bc9a6a8d470315064ffc46c

SHA1
a033daee1991be77a9291fd5f0dd1923976cde93

SHA256
fe3ebf3520210be0d77f30886d49f2735510f234076692d218d57c7db5d01e77

SHA512
545fcabc9a5770bbbcf0defa87d11a3048497c9c8aec9f830fe99d247c7ad29ff2ff6d7c01e02d4b5e4c161a34c4b297b3f6ebd1b65023c5060f90ce0ca5a6ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
b19f43ada966e62435cbc3fab9d3b46a

SHA1
30f97312633f9d061b640a9f05905192938214c8

SHA256
8ffe7dbaf19c58aec25d3d33e954bebf28aaa6a98db0525e40f42a29b3908528

SHA512
304dcd34f74c6680800190cb9c3abce0ec1434649239a04a48150f8c501a5d09b556c51ad0d7b9f42ca5759d0c8617802085607914429782069319dfb2c91348

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e3c4d1fa37d86d5de877f6cba655ffb8

SHA1
07f1d6015cea09f4372f7af1e994248db5c6b41c

SHA256
003fed2dfe14bff27a78dfc9b8874f24d630e3a1599f8cd00a821ad97a697f24

SHA512
a9c10f8de67acbd86885875c1ad7df9b7160c132b9e876b9a3b1fe37ba2f5b76570cdb2e939347adfc22fd62be2ba1f15519aa0b16e8861f0d7d3d5dcff4c57a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
602a5c9d3f0581a33972ab253518d6ec

SHA1
469bfa4f8017f81b960bf4f65e05a1fd8487e94b

SHA256
4ea8402096cb155ca36e7c69d2500d707ada700b11e6205575e774dad6b2f6bf

SHA512
819a0c10614a29766a1c2392e2c181ee965f3b971bfc9ed1ee74e123554eda10acf5cc86195b2563cc8b3d82dfd7286001f733bc8e607c66cd6eff059fc2e0ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
027bd35257dd62d67007a7d803da00a7

SHA1
033db538340b0302473304231104138ec2b6d189

SHA256
56b37e149414cc2834a4ef1fdd51b67101efa9898a7089a9f1a76226dda19907

SHA512
1b3a805d46abdbc0e269466f02d1c8da0c6343add3267af0f2ca535f6d96b4e8977dc95b8a6479f1e4947b701a3a00443770abc829f22efafe299eaad61a8f1d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
13KB

MD5
99f947971e27e3fa038d01a24064042b

SHA1
c3edc62701b105094a609dc386dbc494af154c5f

SHA256
62500263c97f6a88916b749dce8085a8774458fed05822fa0e75e328eb9a2232

SHA512
820955925ce9ba24876d3faa620ae66aa496820f5e245c5bb16e7e4d7e7fa062b01434972b64715da95d19adb39a52afc7bec5b74c97595d55ea649673e98608

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a5502c67-2de2-42ca-810d-37fe5bfe11fd.tmp

Filesize
9KB

MD5
cf95c32d0c92b0c2bfb09564ff8a5384

SHA1
6e27f67e5cb3bd15ad290025bfa68ffa58a784bc

SHA256
daf671a1bc0dc22cfadeda1364056d6ee8f996baeaa62112b47d5ab9cfc501c8

SHA512
4b70a1441395cd022fac8b8c3cd25aac9b891a37e498a689b5281b5c7c34d72cab0e3ca09673fd08cfee0564da89b72f06849f911ca79b60f0ad92bba19f6eba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
568cd6a820e70f68e67dcd01755d0a0f

SHA1
0914edbf7935bdd5cd0d877b096e3040d8759432

SHA256
00cd62407c88ed7fd62547af0ce86945c74da1c139cbbd871da294c08f122c49

SHA512
3681ff9de6cae9c02a7692a9217e4309c4f966d5315e3222f701e09ea7c58d346faed69a14377d3f42b0e003d9c71b697d95f2ca84cfb19188f7928958b7196a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
213KB

MD5
aaeba5b02170c9940fea36d53979f3b2

SHA1
06428dbbffd783475163395c0a3c44b9075e561f

SHA256
03135e3ffbb01ec519619bbd0239f63192fa61d79432963ede20c29837d39562

SHA512
3f6b0b53b3f8318fa3dc722a3d907dd956c9e980fafd917f1a51e4d4a0d4f34489c83a037f0e1e3cf5b6c77d9bb8d4919d31d601f9f5611fdb4bee07d1ea2cdc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
213KB

MD5
60e8f131dbe80f5d4a1e698c0c3685f1

SHA1
3d4b731334518e3519e648bdb5b232ad787dcbfb

SHA256
7b1b1af46da498a16637d8f81d710734a04ed9c1515eba4d7fc8dc7877861256

SHA512
05c55fb33957927a2eb0e68d7f88fc42f1c36c1d9b23169ab3d54bd5e96b0c86c7d37ff1898106dda064affea4a5689623c3d2e3c367fb04d5e71d7d2304c67d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
213KB

MD5
1e9635adf20cb229e5a7fa262afeb9eb

SHA1
e13429d6f6a762c0ada791ee4a6853c3f767bcff

SHA256
abe5f54f5ac8fbf6c92cdce26686d0e71253926435e13eda29cb402eb9e99251

SHA512
bb21f8f0e6c83b699eb0df51c262e69b58ff8db00a9846703d670ea0e348e3d0cbc738412f1a87574c1d66ee0ca69e557ec611773b3474da62c8a2b7e6f58ec3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
213KB

MD5
718f310c2ac989b6480255f0bcd3e476

SHA1
823e08f864a19f7924285f42133c267cb24c06e1

SHA256
68c95da65487d7609ff1f4fc007b13bde9ecd58e62e239b766832cf6d63b0b36

SHA512
7dc5b5a4d94776c1ab3446a3b87f58dc31274e9cc3f2d805f3e2c385bb4bc3d063a04f2012e5fa3d7480ee886582f7b09acbc24d53e12e58a1e19df92438354b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
6fa28481f0be657d7124a91addf9fa99

SHA1
38fba9d3e8b449758f961ef7e8b12760114fecba

SHA256
0e790b82a9bdd8ef588b22fd65fb02e337767268869716fc88fd023ea96d22b5

SHA512
2854273cc20dc0adfc1cafa54d7af2c58021f3ba317e2c5d0733ae34549b9ef8d69f0e6391808dccf4e9285e84ca262529f00bfc41f578f1b8caa7c52f18c43d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c4a10f6df4922438ca68ada540730100

SHA1
4c7bfbe3e2358a28bf5b024c4be485fa6773629e

SHA256
f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02

SHA512
b4d407341989e0bbbe0cdd64f7757bea17f0141a89104301dd7ffe45e7511d3ea27c53306381a29c24df68bdb9677eb8c07d4d88874d86aba41bb6f0ce7a942c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c3889d3f0d2246f800c495aec7c3f7c

SHA1
dd38e6bf74617bfcf9d6cceff2f746a094114220

SHA256
0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4

SHA512
2d6cb23e2977c0890f69751a96daeb71e0f12089625f32b34b032615435408f21047b90c19de09f83ef99957681440fdc0c985e079bb196371881b5fdca68a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000072

Filesize
229KB

MD5
1e4be5d18e998503949eef043d8be4ab

SHA1
6f818b7b58ec2e2d9d2ccf3821602f19d3ae98b5

SHA256
52ff5087ef3e5ffe020fee4f35623ba0f18f76232e842cc464772371e4860bac

SHA512
564fbc63b2b1ee50504f4d39544752565e7aebc7ba46affead23b4fb9918587de7e0f193e441404f78fde344e533b604adb400a786ff44586a49ed002adea13d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
4KB

MD5
d3c1ac979d22674e824ca246110f6905

SHA1
79333027c38afd72a6fd032d7f7001d63d1e3482

SHA256
e3fae1046ee533b27f10ec9b5bbf518956b993d8c6f3fda042badff9c2913e5a

SHA512
2666411d5a45a509b0658cd81821f90e19a3165de60c3b3d8010caad2a75e7a4a975e8e0cfa0bb9a601518eedf77ae648dee05bd54cb4d21770d9c37098cfa4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
40845c522fdd348841c175e03cd33b5c

SHA1
894dde975fa6d22355ffcf5df11dc62e3a249a49

SHA256
a13ead0e66c8e6afb78dcaf41ac37cb08c6801b902097480b0639597e0e81da7

SHA512
957b34db55df02e026748b129afe7d6d0f6b0b86ce5c7278247b8b0240d40f33069b3d716c1ce89d449eb32fee9668dba4adcd3f07f34ad099661659335eaf9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0d8051b83deff6c728948c6dca4377d0

SHA1
bd7529571008b52cd5e1b2b68cdeb8a1619f7947

SHA256
8463f0c8b13882db43610a111108c96421adf4709fdc10c20d37c9b91b623afe

SHA512
65f2fdb682709c0d34685a41e0f95fe4e13cc33b08fc4475cc36a7b79736701d64b23530b077a72bb9d482203a33198f64ae4203475e17548647582326c19dc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
73469b1c804688f3d29326b93d521e45

SHA1
ddc0a8edcf6e1be1c6ce6a35f6345905fdb472a8

SHA256
b2811d1a2a9cac4863e797248c798c808432cc806b39718fe7b4fa11f192a767

SHA512
e71dd05cb629bd00403910d4802e062d4a2879bf635db27952339b1b25615a8a94cc989e98b0ccb4057077df1cca22a31fe00b680ba1d04f110fa1d4d89df7ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
138ed2e3828580f859258ede954c783b

SHA1
a735922d2c9252c981bf5e33f53913e624d0a871

SHA256
0d7a017556b43dd57571b3f6e52574df76d75fe15ac62ed42b0cd3690118e26a

SHA512
69d5acbfeace56ab75f3efd11a1a21c7863f98e1be37d29a27a0dc6999a5b8ba42cf217e8c1e6f3bbd5fbae8da3b6c69087196058ee3a6f38225b7a1536fd9ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3fb5071d3db678a6fd363db43c8a7b0d

SHA1
29a89b028098b3688c42aca55bed2796d43b0ff1

SHA256
86d5459d7dc0e8c03118b2af7658aae6ded14868055ab731cc0a1f20d2c932d0

SHA512
290bf60472a94d6af8f1a5c2f7718e4dd19620c65c57156252604d11f64bfe75016bdb119b97d55d2af5057fa8e1da00da18eab64771bd7e2fe11076ed6ad861

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
278cbd5ad7f460bdc04569c977db0488

SHA1
9022508392d32a9f74207a74098051dd56c18dfd

SHA256
1ca88bac0ffdd031761d89aa15e54221d2c14c467c0843313e3f8539dbb0149f

SHA512
8858f5510668abbc3c54eeff71e4f9a1c603eb5b4cc9ec67ae69bb927beeeafb531bcde69fe47b1baccd75c11d37db7bca29213ab7f30966a05e256b77638731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d5b4c699aefcdf6d397d04769d71731a

SHA1
b6adb11be6a9f0ca91d4a10c479f9c63b839086f

SHA256
f0900bc9c736772b04c186e9e3f75a8ff7fb7a8399c60389b8201ee565554d01

SHA512
59a02c590718a5e4753d9a604f0be8611360636df645e6cfc3bd1ae31d4d69a0744dc453e330763324df922c7799581721fc9982b558bc674d824253f6321b15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
53ae6f6e79105d6a2b296d291d603288

SHA1
095ac1c241e55bb3b863049b0fb7360cecbda073

SHA256
903e7d19f8bd990aa957e29fc371cb1aaaab58230ea28a05174f79fbf0fbd668

SHA512
307fc1fc7e92feac331a8d38f1b34e604560c5573dffa7b1b960eb72e0a8853853574795a8f0636ec6910a797e9ea58a883f83a61b24af7da7e0800649294186

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1debff4f49e47f9156282f0c0752967c

SHA1
105fc9e4b3c06a5f0e9ca039b5ce83520f12685a

SHA256
8d44d30dad7d990327fdd9d5e5e34624931e14fb5d72add5333af222fb3ee7d0

SHA512
d94604c4ca111e88f1d2e6f568b508bc18cd037d059672845c55a3cd37e99582a80fba3e60c68c5478e5b8f0e96579c5a87415541d738dcfdcccff8e19d996ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
eee49902283d60a3033e0039a2b0c670

SHA1
ab598ab867ddcd1516a73aa382120f5c202bb0bc

SHA256
dd3cc65af220088b64e0b9e8a8a7789870a6c70df6530585d9cdcf53604678b8

SHA512
22648731d010b92d71c1207c719f169669715daa18874458c5eff6cdfb320064c20b1813655c693ada969395597d3da26c2c698f14d1b806a31ee4f58ef331af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1461f53a77aa46c312e13545ce4982e4

SHA1
4b70dc0d6b11b1a760e3e28fb4e37e1de1702312

SHA256
5f5c95c490a0e651b1c8e57b434dca7493f08cd658aee7066219c1fc1efc5e91

SHA512
8b73ddb7e05346086a34838371af4ac49a5b8f1377065e2a528901862562e7b7de0315f6fb82fe6ad9722ab7b34b370eb04051bf94d08c0a7f92b499a2cc0b15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5c9b831887561944fbf17f1b9ecc16e4

SHA1
84d30a02b1c86e14d74165e62da69b26c9ce5e99

SHA256
c25ca547abae7299696ead68f7424dc68cac225a2476a30a9d0ae9e1ce42d0bb

SHA512
924b8cc5238b4d63b7559648f5350cbbd36eeabaa417ca4733ede9cad91e26e12ff04d28bbb4e630321cb16eda16ffd5e36d73e3da5878e59e11978fa48238a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b2bc5edba9fb2cb62fce8cc6aa9f103d

SHA1
0badbe91ccd7f94f5c7cfa98d372938aec1d53a3

SHA256
162d5ce456b5e86444eee48c31f6f0702f43260c9843ec1aba5a591fe4a0fc18

SHA512
0cd7bab0b723100b5f4513ca4b9dabfd483a478b46aba644c27547f9e33010a544cd7b73294d89c7b6342e44731fc4e2db38298764191122cdb6e1dd7b536728

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
750d06c4e023894a87b7747e91efcc39

SHA1
6741cc5e3eaf88aa9ba27e23c2998b9329972244

SHA256
94555c5356140a328a65a8e3d061d52c2ad90e4e7e136ec931bbe839c47aa68d

SHA512
c57d6d3c5a79b2b06526996ccbb83d96f7ba127aa72c8319924f5ee33b6cf3bb61d4d59c91f5f290205321b063463398692be2649d5973a18185ea795fdf66d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59168c.TMP

Filesize
1KB

MD5
170ba6962370a948605d1f4d6fb8f873

SHA1
25f85f9c747f7996dbc04d83a4ced870e3a33c6d

SHA256
1f4cc76892472e4de9aaadeee0e777e71f40e2c2e0d50619dec218fbec6bcb2f

SHA512
e7412b08bd8a59d02aea9c0eecc2624b60bddcf68dabcb37fed5575653050296161a8e153778e412f7050e5a3f0aea0255a9a5f80480c074a31df385430c8a0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
54b716fc536575e2b14afa7656b0cd8e

SHA1
04276991fb9063e6d6aa6af00be791b8951f9e3f

SHA256
97143b63e4b3003f50b41925210cc8d391f3f6bf6b6b7c120a7ce264cfe7685d

SHA512
805ecdd428749ff2b77e6e4cb7f83b1e67f01fb431c0c76b58d2f8dd7483b8771655075152858c5db130c4e76653851cae8665d05bab3072aa9e3867c0aa2417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5f1ca924fe5548fbc0fe2178571e18ab

SHA1
0959201c7f86083e58e0016f96b16c916eae708f

SHA256
6eb01d623cecb416bbc1d7517ba3ebc0fd144c4d231c541fc9dac4d287cc3d97

SHA512
3b8cecda06246a0e8f85dd510fe1c194ac386db94ed1737cdbb8c013ca969af80bad58b7dee8e0ceffc50a0b98d9f276f3c090758242b1f4449035766fa2c76d

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
d12e797f18cb79137ad12b5e5139e1b8

SHA1
f15fb437b1be86b714e278ce927b315fa0e16ea3

SHA256
afb0f4a0229174f8118ab512b569fdb9eb3ebb0389cb11c9f4a0a2aa88ec258b

SHA512
f6e8f99bcd0ecff7683c8e56fa2ffa3fdff16d6c17a2066b36bc3d78e2838130b5b23059a239b29a7ebdd0b5ca36b3f9cf388945bf1aad50a3f91cb8091223cd

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
2bf8b49ae726b6251ed4b98c8bde132e

SHA1
5e5b4f295fec6133c97b3a2b9b313e1504177e6b

SHA256
39e0a94897e8550f2f35ea74bf31a0c49173ce6586a1a89465e771302714e83b

SHA512
0d1d7752934de65768c01269eee5b96cbb2aba4a56a750bf5df7da55f14784e0513d642aad8e01c2fc47cd7c106f86d6b277e8aee3744221e10468d38a9d8844

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_trrdja3j.soe.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Clixke Tweaks UPDATED.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/2416-1216-0x0000000007180000-0x0000000007225000-memory.dmp

Filesize
660KB

Download
memory/2416-1189-0x0000000006C50000-0x0000000006C62000-memory.dmp

Filesize
72KB

Download
memory/2416-1224-0x000000000B830000-0x000000000B843000-memory.dmp

Filesize
76KB

Download
memory/2416-1225-0x000000000BF80000-0x000000000BFA8000-memory.dmp

Filesize
160KB

Download
memory/2416-1221-0x000000000B830000-0x000000000B843000-memory.dmp

Filesize
76KB

Download
memory/2416-1217-0x0000000007550000-0x0000000007559000-memory.dmp

Filesize
36KB

Download
memory/2416-1163-0x0000000008BA0000-0x0000000009789000-memory.dmp

Filesize
11.9MB

Download
memory/2416-1197-0x0000000006DC0000-0x0000000006DFA000-memory.dmp

Filesize
232KB

Download
memory/2416-1196-0x0000000006C70000-0x0000000006C8D000-memory.dmp

Filesize
116KB

Download
memory/2416-1193-0x0000000006C70000-0x0000000006C8D000-memory.dmp

Filesize
116KB

Download
memory/2416-1185-0x0000000006C10000-0x0000000006C25000-memory.dmp

Filesize
84KB

Download
memory/2416-1182-0x0000000006C10000-0x0000000006C25000-memory.dmp

Filesize
84KB

Download
memory/2416-1178-0x0000000006BB0000-0x0000000006BCF000-memory.dmp

Filesize
124KB

Download
memory/2416-1177-0x0000000006A90000-0x0000000006A9C000-memory.dmp

Filesize
48KB

Download
memory/2416-1174-0x0000000006A90000-0x0000000006A9C000-memory.dmp

Filesize
48KB

Download
memory/2416-1173-0x0000000006D00000-0x0000000006DB4000-memory.dmp

Filesize
720KB

Download
memory/2416-1170-0x0000000006D00000-0x0000000006DB4000-memory.dmp

Filesize
720KB

Download
memory/2416-1213-0x0000000007180000-0x0000000007225000-memory.dmp

Filesize
660KB

Download
memory/2416-1200-0x0000000006DC0000-0x0000000006DFA000-memory.dmp

Filesize
232KB

Download
memory/2416-1220-0x0000000007550000-0x0000000007559000-memory.dmp

Filesize
36KB

Download
memory/2416-1167-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2416-1208-0x0000000006CA0000-0x0000000006CA6000-memory.dmp

Filesize
24KB

Download
memory/2416-1205-0x0000000006CA0000-0x0000000006CA6000-memory.dmp

Filesize
24KB

Download
memory/2416-1204-0x0000000006EF0000-0x0000000006FD9000-memory.dmp

Filesize
932KB

Download
memory/2416-1181-0x0000000006BB0000-0x0000000006BCF000-memory.dmp

Filesize
124KB

Download
memory/2416-1201-0x0000000006EF0000-0x0000000006FD9000-memory.dmp

Filesize
932KB

Download
memory/2416-1159-0x0000000007620000-0x0000000007FA9000-memory.dmp

Filesize
9.5MB

Download
memory/2416-1162-0x0000000007620000-0x0000000007FA9000-memory.dmp

Filesize
9.5MB

Download
memory/2416-1186-0x0000000006C50000-0x0000000006C62000-memory.dmp

Filesize
72KB

Download
memory/2416-1209-0x0000000006E00000-0x0000000006E09000-memory.dmp

Filesize
36KB

Download
memory/2416-1212-0x0000000006E00000-0x0000000006E09000-memory.dmp

Filesize
36KB

Download
memory/3136-1307-0x0000020970940000-0x000002097095C000-memory.dmp

Filesize
112KB

Download
memory/3136-1308-0x0000020970960000-0x000002097096A000-memory.dmp

Filesize
40KB

Download
memory/3136-1309-0x00000209709D0000-0x00000209709F6000-memory.dmp

Filesize
152KB

Download
memory/3136-1297-0x000002096DAB0000-0x000002096DACE000-memory.dmp

Filesize
120KB

Download
memory/3136-1325-0x0000020971080000-0x0000020971092000-memory.dmp

Filesize
72KB

Download
memory/3136-1295-0x0000020953AC0000-0x0000020953AE2000-memory.dmp

Filesize
136KB

Download
memory/3136-1294-0x000002096E380000-0x000002096E3F6000-memory.dmp

Filesize
472KB

Download
memory/3136-1273-0x000002096DAE0000-0x000002096DB92000-memory.dmp

Filesize
712KB

Download
memory/3136-1272-0x0000020953350000-0x00000209535A4000-memory.dmp

Filesize
2.3MB

Download