hxxps://github[.]com/hellzerg/optimizer/releases

Analysis

max time kernel
63s
max time network
72s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
21-12-2024 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/hellzerg/optimizer/releases

Score

10^/10

discovery evasion execution

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0"	Optimizer-16.7.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\International\Geo\Nation	Optimizer-16.7.exe

Executes dropped EXE 1 IoCs

pid	Process
1700	Optimizer-16.7.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
72	raw.githubusercontent.com
73	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\303c2cf4-0b9c-47a4-8846-11873fc844f7.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241221151503.pma	setup.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5516	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\Desktop\AutoEndTasks = "1"	Optimizer-16.7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\Desktop\HungAppTimeout = "1000"	Optimizer-16.7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\Desktop\WaitToKillAppTimeout = "2000"	Optimizer-16.7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\Desktop\LowLevelHooksTimeout = "1000"	Optimizer-16.7.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings\DownloadMode = "0"	Optimizer-16.7.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Copy To	Optimizer-16.7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Copy To\ = "{C2FBB630-2971-11D1-A18C-00C04FD75D13}"	Optimizer-16.7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Move To	Optimizer-16.7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Move To\ = "{C2FBB631-2971-11D1-A18C-00C04FD75D13}"	Optimizer-16.7.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 350852.crdownload:SmartScreen	msedge.exe

Runs .reg file with regedit 3 IoCs

pid	Process
5728	regedit.exe
6020	regedit.exe
4868	regedit.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
3208	msedge.exe
3208	msedge.exe
1348	identity_helper.exe
1348	identity_helper.exe
1556	msedge.exe
1556	msedge.exe
1700	Optimizer-16.7.exe
1700	Optimizer-16.7.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	Optimizer-16.7.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 1460	3208	msedge.exe	81
PID 3208 wrote to memory of 1460	3208	msedge.exe	81
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 1060	3208	msedge.exe	82
PID 3208 wrote to memory of 4604	3208	msedge.exe	83
PID 3208 wrote to memory of 4604	3208	msedge.exe	83
PID 3208 wrote to memory of 792	3208	msedge.exe	84
PID 3208 wrote to memory of 792	3208	msedge.exe	84
PID 3208 wrote to memory of 792	3208	msedge.exe	84
PID 3208 wrote to memory of 792	3208	msedge.exe	84
PID 3208 wrote to memory of 792	3208	msedge.exe	84
PID 3208 wrote to memory of 792	3208	msedge.exe	84
PID 3208 wrote to memory of 792	3208	msedge.exe	84
PID 3208 wrote to memory of 792	3208	msedge.exe	84
PID 3208 wrote to memory of 792	3208	msedge.exe	84
PID 3208 wrote to memory of 792	3208	msedge.exe	84
PID 3208 wrote to memory of 792	3208	msedge.exe	84
PID 3208 wrote to memory of 792	3208	msedge.exe	84
PID 3208 wrote to memory of 792	3208	msedge.exe	84
PID 3208 wrote to memory of 792	3208	msedge.exe	84
PID 3208 wrote to memory of 792	3208	msedge.exe	84
PID 3208 wrote to memory of 792	3208	msedge.exe	84
PID 3208 wrote to memory of 792	3208	msedge.exe	84
PID 3208 wrote to memory of 792	3208	msedge.exe	84
PID 3208 wrote to memory of 792	3208	msedge.exe	84
PID 3208 wrote to memory of 792	3208	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/hellzerg/optimizer/releases
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffbea0e46f8,0x7ffbea0e4708,0x7ffbea0e4718
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,377808479974180669,742706354354609890,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,377808479974180669,742706354354609890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,377808479974180669,742706354354609890,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,377808479974180669,742706354354609890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,377808479974180669,742706354354609890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,377808479974180669,742706354354609890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1416
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x140,0x254,0x7ff7a9e05460,0x7ff7a9e05470,0x7ff7a9e05480
    3⤵
    PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,377808479974180669,742706354354609890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,377808479974180669,742706354354609890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,377808479974180669,742706354354609890,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,377808479974180669,742706354354609890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,377808479974180669,742706354354609890,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,377808479974180669,742706354354609890,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,377808479974180669,742706354354609890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,377808479974180669,742706354354609890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,377808479974180669,742706354354609890,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7060 /prefetch:8
  2⤵
  PID:3128
- C:\Users\Admin\Downloads\Optimizer-16.7.exe
  "C:\Users\Admin\Downloads\Optimizer-16.7.exe"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies Control Panel
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C sc config "RemoteRegistry" start= disabled
    3⤵
    PID:5472
  - - C:\Windows\system32\sc.exe
      sc config "RemoteRegistry" start= disabled
      4⤵
      Launches sc.exe
      PID:5516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.bat""
    3⤵
    PID:5544
  - - C:\Windows\system32\schtasks.exe
      schtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016"
      4⤵
      PID:5596
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016" /disable
      4⤵
      PID:5612
  - - C:\Windows\system32\schtasks.exe
      schtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016"
      4⤵
      PID:5628
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016" /disable
      4⤵
      PID:5644
  - - C:\Windows\system32\schtasks.exe
      schtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack"
      4⤵
      PID:5660
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack" /disable
      4⤵
      PID:5676
  - - C:\Windows\system32\schtasks.exe
      schtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn"
      4⤵
      PID:5692
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn" /disable
      4⤵
      PID:5708
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Mail" /v "EnableLogging" /t REG_DWORD /d 0 /f
      4⤵
      PID:5724
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Mail" /v "EnableLogging" /t REG_DWORD /d 0 /f
      4⤵
      PID:5740
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Calendar" /v "EnableCalendarLogging" /t REG_DWORD /d 0 /f
      4⤵
      PID:5756
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Calendar" /v "EnableCalendarLogging" /t REG_DWORD /d 0 /f
      4⤵
      PID:5772
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Word\Options" /v "EnableLogging" /t REG_DWORD /d 0 /f
      4⤵
      PID:5788
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Word\Options" /v "EnableLogging" /t REG_DWORD /d 0 /f
      4⤵
      PID:5804
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\15.0\OSM" /v "EnableLogging" /t REG_DWORD /d 0 /f
      4⤵
      PID:5820
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\OSM" /v "EnableLogging" /t REG_DWORD /d 0 /f
      4⤵
      PID:5836
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\15.0\OSM" /v "EnableUpload" /t REG_DWORD /d 0 /f
      4⤵
      PID:5852
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\OSM" /v "EnableUpload" /t REG_DWORD /d 0 /f
      4⤵
      PID:5868
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\Common\ClientTelemetry" /v "DisableTelemetry" /t REG_DWORD /d 1 /f
      4⤵
      PID:5884
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry" /v "DisableTelemetry" /t REG_DWORD /d 1 /f
      4⤵
      PID:5900
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\Common\ClientTelemetry" /v "VerboseLogging" /t REG_DWORD /d 0 /f
      4⤵
      PID:5916
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry" /v "VerboseLogging" /t REG_DWORD /d 0 /f
      4⤵
      PID:5932
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Common" /v "QMEnable" /t REG_DWORD /d 0 /f
      4⤵
      PID:5948
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common" /v "QMEnable" /t REG_DWORD /d 0 /f
      4⤵
      PID:5964
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Common\Feedback" /v "Enabled" /t REG_DWORD /d 0 /f
      4⤵
      PID:5980
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Feedback" /v "Enabled" /t REG_DWORD /d 0 /f
      4⤵
      PID:5996
- - C:\Windows\regedit.exe
    "C:\Windows\regedit.exe" /s "C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.reg"
    3⤵
    - Runs .reg file with regedit
    PID:6020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Optimizer\Required\EnableOfficeTelemetryTasks.bat""
    3⤵
    PID:6084
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016" /enable
      4⤵
      PID:6136
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016" /enable
      4⤵
      PID:3128
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack" /enable
      4⤵
      PID:4204
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn" /enable
      4⤵
      PID:5132
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Mail" /v "EnableLogging" /t REG_DWORD /d 1 /f
      4⤵
      PID:5148
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Mail" /v "EnableLogging" /t REG_DWORD /d 1 /f
      4⤵
      PID:5164
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Word\Options" /v "EnableLogging" /t REG_DWORD /d 1 /f
      4⤵
      PID:5192
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Word\Options" /v "EnableLogging" /t REG_DWORD /d 1 /f
      4⤵
      PID:5212
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Calendar" /v "EnableCalendarLogging" /t REG_DWORD /d 1 /f
      4⤵
      PID:5228
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Calendar" /v "EnableCalendarLogging" /t REG_DWORD /d 1 /f
      4⤵
      PID:5244
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\15.0\OSM" /v "EnableLogging" /t REG_DWORD /d 1 /f
      4⤵
      PID:1520
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\OSM" /v "EnableLogging" /t REG_DWORD /d 1 /f
      4⤵
      PID:4672
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\15.0\OSM" /v "EnableUpload" /t REG_DWORD /d 1 /f
      4⤵
      PID:4516
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\OSM" /v "EnableUpload" /t REG_DWORD /d 1 /f
      4⤵
      PID:5344
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\Common\ClientTelemetry" /v "DisableTelemetry" /t REG_DWORD /d 0 /f
      4⤵
      PID:2276
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry" /v "DisableTelemetry" /t REG_DWORD /d 0 /f
      4⤵
      PID:5292
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\Common\ClientTelemetry" /v "VerboseLogging" /t REG_DWORD /d 1 /f
      4⤵
      PID:5288
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry" /v "VerboseLogging" /t REG_DWORD /d 1 /f
      4⤵
      PID:5328
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Common" /v "QMEnable" /t REG_DWORD /d 1 /f
      4⤵
      PID:5404
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common" /v "QMEnable" /t REG_DWORD /d 1 /f
      4⤵
      PID:5356
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Common\Feedback" /v "Enabled" /t REG_DWORD /d 1 /f
      4⤵
      PID:5372
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Feedback" /v "Enabled" /t REG_DWORD /d 1 /f
      4⤵
      PID:5388
- - C:\Windows\regedit.exe
    "C:\Windows\regedit.exe" /s "C:\ProgramData\Optimizer\Required\EnableOfficeTelemetryTasks.reg"
    3⤵
    - Runs .reg file with regedit
    PID:4868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.bat""
    3⤵
    PID:4956
  - - C:\Windows\system32\schtasks.exe
      schtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016"
      4⤵
      PID:2460
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016" /disable
      4⤵
      PID:5416
  - - C:\Windows\system32\schtasks.exe
      schtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016"
      4⤵
      PID:4888
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016" /disable
      4⤵
      PID:5452
  - - C:\Windows\system32\schtasks.exe
      schtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack"
      4⤵
      PID:5440
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack" /disable
      4⤵
      PID:5428
  - - C:\Windows\system32\schtasks.exe
      schtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn"
      4⤵
      PID:3260
  - - C:\Windows\system32\schtasks.exe
      schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn" /disable
      4⤵
      PID:3496
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Mail" /v "EnableLogging" /t REG_DWORD /d 0 /f
      4⤵
      PID:2296
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Mail" /v "EnableLogging" /t REG_DWORD /d 0 /f
      4⤵
      PID:724
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Calendar" /v "EnableCalendarLogging" /t REG_DWORD /d 0 /f
      4⤵
      PID:5524
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Calendar" /v "EnableCalendarLogging" /t REG_DWORD /d 0 /f
      4⤵
      PID:5508
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Word\Options" /v "EnableLogging" /t REG_DWORD /d 0 /f
      4⤵
      PID:5488
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Word\Options" /v "EnableLogging" /t REG_DWORD /d 0 /f
      4⤵
      PID:5464
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\15.0\OSM" /v "EnableLogging" /t REG_DWORD /d 0 /f
      4⤵
      PID:2852
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\OSM" /v "EnableLogging" /t REG_DWORD /d 0 /f
      4⤵
      PID:1788
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\15.0\OSM" /v "EnableUpload" /t REG_DWORD /d 0 /f
      4⤵
      PID:4396
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\OSM" /v "EnableUpload" /t REG_DWORD /d 0 /f
      4⤵
      PID:5556
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\Common\ClientTelemetry" /v "DisableTelemetry" /t REG_DWORD /d 1 /f
      4⤵
      PID:5600
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry" /v "DisableTelemetry" /t REG_DWORD /d 1 /f
      4⤵
      PID:5612
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\Common\ClientTelemetry" /v "VerboseLogging" /t REG_DWORD /d 0 /f
      4⤵
      PID:5628
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry" /v "VerboseLogging" /t REG_DWORD /d 0 /f
      4⤵
      PID:5644
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Common" /v "QMEnable" /t REG_DWORD /d 0 /f
      4⤵
      PID:5660
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common" /v "QMEnable" /t REG_DWORD /d 0 /f
      4⤵
      PID:5676
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Common\Feedback" /v "Enabled" /t REG_DWORD /d 0 /f
      4⤵
      PID:5692
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Feedback" /v "Enabled" /t REG_DWORD /d 0 /f
      4⤵
      PID:5708
- - C:\Windows\regedit.exe
    "C:\Windows\regedit.exe" /s "C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.reg"
    3⤵
    - Runs .reg file with regedit
    PID:5728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Optimizer\Optimizer.json

Filesize
2KB

MD5
dfa5e07ad0441b69b619c7088bf2acb7

SHA1
34ee739f6d541b005f977ae6987c5bc9dc7b6935

SHA256
d4b95e76a84159c9cddf091dadaddb8d703d5e91326570a730e7d7de5a4c410e

SHA512
2ee1667bf35e7616f5dfb2aa0c659d81be0cccf0b19e6224a71ebf0d9cb218b0e0dedc97f40d919eafcb1efc779a490bec6fbe9cbdf43ba785b1ec43b4424c29

Download Submit
C:\ProgramData\Optimizer\Optimizer.log

Filesize
313B

MD5
e036d9dfc34c5d33eda6301e4fb3f242

SHA1
981986e90869734ccad41dd0ec625cb0605ee035

SHA256
ba63f34403e64a5f5110811fc1b32c6c4cf27daeb567ef4a52f43cf3905d02b8

SHA512
67133b708bf848c57db3aae2cf2947ee1cee4aaad6e942a930b747fb07a9c45d8130b50dc0097afa0a5d1f3e3bf99a14fb50cf131a8144bda0deee3a10f1379d

Download Submit
C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.bat

Filesize
2KB

MD5
fed75b5cb9d9f4ec5ee22b8fd304ccf7

SHA1
1b4bdac9ac71fdee3bae90e52fcec60c88d7fa9d

SHA256
d884c0d04ba09b113d9439d2f8c0b7ed322111ae2e3ed802f6a95278ff8e0ac2

SHA512
36bed8311050f8c79e766678c59bb65177630279af8b4d2302aaf6146157887e1fb744785ac7f3290519778a592fb4d90fb7b7b9420e7346efdfec1085bf34e9

Download Submit
C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.reg

Filesize
648B

MD5
7f7b192506491e4105e2ae1cf5ea9067

SHA1
5dafd2516bd4a4b3d230624f8ea590f640e2c381

SHA256
41cf9db9e395349b94ec7a1ee99db68062f27bf95c3b364aa6b035dc39ff1dc0

SHA512
5fcfbec12316f24bdbadb3d4a018945de9afb849fcfc026e601728b1dce107eaf1b8ce56d5e646461006a45bb305f16e3160d760649f7716b70a3e2fd195763f

Download Submit
C:\ProgramData\Optimizer\Required\EnableOfficeTelemetryTasks.bat

Filesize
2KB

MD5
8e83aac7a144bb7460a3d7235442b802

SHA1
c06944f89a4922574e8be07a0b0770cf1c9dba58

SHA256
275f9e1a0701f097c4cb9505d42e1ef3d5dd0ae9aba2cbb399f7ebb23e3e8773

SHA512
61906d0791fee3341e995e3043067855750428fbcc3edcefcda78a08a03ffe1f149bd5930d24009132405b66d187ad7bd805f645e304af956a37651c4568492d

Download Submit
C:\ProgramData\Optimizer\Required\EnableOfficeTelemetryTasks.reg

Filesize
466B

MD5
496768ea845782927c2a9e0dd172d241

SHA1
4bd07eab1936fd36206846a5b0d4cfb03f7db154

SHA256
6a8f76c97fd957afec1f416363df1e56843c8a56e0f2c470aae66d9be8cd2a1a

SHA512
5d6019c96db49b94ca0e5790c18ce626610790e763ccd0f475cd0c25837cb44b0ebb7e7ede76186f07e9b111bdafb56d11354fbc0a716c78e4a8a5cc8d60b80e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9fc751d5fa08ca574eba851a781b900

SHA1
963c71087bd9360fa4aa1f12e84128cd26597af4

SHA256
360b095e7721603c82e03afa392eb3c3df58e91a831195fc9683e528c2363bbb

SHA512
ecb8d509380f5e7fe96f14966a4d83305cd9a2292bf42dec349269f51176a293bda3273dfe5fba5a32a6209f411e28a7c2ab0d36454b75e155fc053974980757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d9a93ee5221bd6f61ae818935430ccac

SHA1
f35db7fca9a0204cefc2aef07558802de13f9424

SHA256
a756ec37aec7cd908ea1338159800fd302481acfddad3b1701c399a765b7c968

SHA512
b47250fdd1dd86ad16843c3df5bed88146c29279143e20f51af51f5a8d9481ae655db675ca31801e98ab1b82b01cb87ae3c83b6e68af3f7835d3cfa83100ad44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
c73a6c5ee09ad09097f82049eceba578

SHA1
a4cbe21827fa378b1018f46204f4c075caa3c3e2

SHA256
6cad11774854049a0d82d913ffcc770e5749151ca02dcd36fc40a91c3681bdfd

SHA512
0b6e5eceee05b032d20576110e9b4462a595f8cd7430fc0e731be9e280e5754bc5b1abfbd75fd491063dac6bb8f7c5a17478107397de864a0b85dedaddc36863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3b3181435168a9a19fa6e60f39f4dc9f

SHA1
d89041b4d4a2af4c4b4440f633b8a0d49792387b

SHA256
be8ced73bf0127346745e949a12afcaf733b388413b1674f79155b9dd73c2652

SHA512
3d63d59c9fb9360db5fcb4e9ad2e65dfb4bc98a2961c371ad6cbb9ef3873873fe62380ab1fdec6700a62c163d75a6538c08747375fdeeefd6552031c31d13f24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
37f84cab8d7d110c7202437becb2a290

SHA1
83942ef781fd99e7f95d7f0838ec5b3a8d8840a2

SHA256
86628e09e9e02d8e092a053414fc7b4c081b9aa3de8baa03746fb936acb58a63

SHA512
9928c908804fc71000cbe4b0ca45eb413506a4021fe6ddc02abfeeb0693471af82b5643752baaf4888f2f192477aaf15dfa21f7d58949eb576f2f2a7bab0dfa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
886357f8a73582ffe513944612ed8143

SHA1
23fe2005c827d24cda0a677307b73e443572d375

SHA256
b8effacde4e2e6bcaf9ae26072c73840235965836be67f410a0382c4cc38a82b

SHA512
974dc6781f448affd7c00d12850df6356a47b8ff5a0e44180b2c1a0701dd8db2c6c9856b3264994362daac1a6479ade6bb8ef30ac9a2fd861f055062d6ab274a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
77c20390add1833728ac637d6ae8b92d

SHA1
bb8714072e0769fa7c2d7810d108fe93fcb4eeb0

SHA256
27d00572a390d6ef12d8ffcef0bbeb23276dc78f9f970cf1edb400b686d1a66b

SHA512
624ce1d8de1e5a39d422094d547aa092b33861f2f209346538b22fc39b7c54ef8e54add8cd02ddda73d5cfcf55ef21e43cb9b072166a110e16397d0622363545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5a3161f03c31f94838441bb1fb8b1d0c

SHA1
77284068f2cf92d51c46c6bb3b1292b1d3e97f80

SHA256
5ba9a50a261a7cecf1e9ff9b7bd48d0d4e39732c1a114e5c3ac987c4e527ab18

SHA512
984fdeda883ca54791e257b8147fa0fe3537d070bb5e027a720bbe5652cd2569a4f8ec702317f5f1a4684f82421ca0687be76c6946bb511691082325c6d2828b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f9055ea0f42cb1609ff65d5be99750dc

SHA1
6f3a884d348e9f58271ddb0cdf4ee0e29becadd4

SHA256
1cacba6574ba8cc5278c387d6465ff72ef63df4c29cfbec5c76fbaf285d92348

SHA512
b1937bc9598d584a02c5c7ac42b96ed6121f16fe2de2623b74bb9b2ca3559fc7aff11464f83a9e9e3002a1c74d4bb0ee8136b0746a5773f8f12f857a7b2b3cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d3412a01d4c3df1df43f94ecd14a889a

SHA1
2900a987c87791c4b64d80e9ce8c8bd26b679c2f

SHA256
dd1511db0f7bf3dc835c2588c1fdd1976b6977ad7babe06380c21c63540919be

SHA512
7d216a9db336322310d7a6191ebac7d80fd4fa084413d0474f42b6eff3feb1baf3e1fb24172ea8abcb67d577f4e3aea2bc68fdb112205fc7592a311a18952f7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
943fe5b547f90593a63bfe3c92ba587a

SHA1
be22bab5920c662758a44b19030471b8247b9733

SHA256
3de05ea0b0cdcc1a97c2502970f66e33e9a4b3ccb9c0a277c18ce34bb616aa4b

SHA512
b2b87660bb5f085525b2e91ff5e3952671ea732bfbc6b80ad55dd29b6d3e1f86ba76bab29fc7a64a6e640480520cba9c265db61deb267dbafc141866673b1ea5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
63df9deaa12f9a9808dfcad9163cf9a7

SHA1
8e2d33f169ebc34ecb90e1f6328c4fdb516a821e

SHA256
44930a6eb52f63b3c777acc2869f97898d6d6aa2b94166e3d9530056b12ebe92

SHA512
ab0574cc6766106a9f915733187813356a572624e24bfa407a8cd18f1fd2eca4304cc976ad14a70e9076ea7543d4e4fe5effe15b41fc7b4507c4016761239da8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5821db.TMP

Filesize
874B

MD5
16194fce18e05ddf98d5a3cf27340d3f

SHA1
fd1592df42252fa10961a3ef830aff3cc399635b

SHA256
54b9475348bf04c6a7a1b5c03d56722d8c3286d0709bdf29cfad6368791d5883

SHA512
04c7893824070e9985b1ca28e557acc7c064df2c0e65f157dbf7673086aee45a010a98b2c93fedd20f0b0cce4204cc4db7fc2ae88b3b87eb08dae943107d8603

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0977f54acc2e07fa365bee4ebb3690f4

SHA1
d80a774b457880edfad9e97368063618038cce69

SHA256
3c321379bd7719bd190a515f3cef2076cc41d67fdf36f49962cebf4222dda3d5

SHA512
7b16038785dbabf67a0bd0f8d519625de88d552262dc360e1395f8565a1de2f416181e93e9495334bd12016734ddfb7f6c80df0307615f2987d7cf8cb4398ef6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
751f24bf0883a1df0ddc2699905aff20

SHA1
6bbe1d740e0e4af0c12fcc7941fa3025afe0d79d

SHA256
9567f5b3603b7ec62b9dd21433d1ddbf2bcf41bbb3f443c52be7007ea51711aa

SHA512
9186b87b965357404e8154a070de570d735ec8a9bdfae5b191f8abde8b1b29b1fe11f806e2b32700823d36ef60ade4ba8b56145aa9eb8c4625f4c6d9be7b3c67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
22ac9080c7a813500997d86c4816d52e

SHA1
a20b846a0111f84e09592495c67dfccda2ecb088

SHA256
ff80f7c86b2c4cda3e00d4c80c59a7c80408b57a85975c928194a15f06dc6392

SHA512
c6ba750b756c8fc1534e5abd165645c6c8faa3a6fcf0f746f2cdb5482faf23597bf0b3f609555bf3ba10e994dca0760c9f0de89c4ece7a380715fb16af35e4d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ilnrytsu.4t4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
5c5e3741ef9d907b4a93ec832680380d

SHA1
47a24ad6ea26c07b8862801d3d74c19be046801c

SHA256
9d585d4172c709e8bd6f76c51769a73aa4372dcc2744616506c50397e6a3b6fc

SHA512
137872a0a367720782b387148cc7e6485ba48cbee0c72378455c7eaf2dc3c290c8ef2631b99e10b2e964a6e25fc3ef02de015e2f3f2e740b4f6d8e8595fa1bb4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
bcd40ab014d48139dd0633274556ccc9

SHA1
ca6f21bbd3a0f858b0df8d5708589eca8c6a470f

SHA256
f1dc2a6dafb3418a785af363c20139a2e5285ee75959cc49511317153ea010f3

SHA512
3fe3d81e5804aa723ae3433ed347ee50a708be495f7c0680293d18187c8c8e0b22502ffc54c0c107f4a22702a4f1848e17fed0be7dbd198b80387338c9b01dde

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 350852.crdownload

Filesize
2.5MB

MD5
7f57207f221db2b08e27d64bc9121b28

SHA1
3bfc4b12a533ee1ce62e5d348027d4ac90ab49db

SHA256
03a234060541b686ac4265754aff43df9325c21383f90e17f831e67965d717f8

SHA512
7cc44ff1c3210db2478f4e37fef23669f0425b1b1672fc5f53956890daccb84b32fa25c8da9f7ce0cd1deb9e697e46cdae0762a0af818f98b93544b8e39f8a25

Download Submit
memory/1700-389-0x000001FFCD720000-0x000001FFCD736000-memory.dmp

Filesize
88KB

Download
memory/1700-409-0x000001FFCD4E0000-0x000001FFCD52C000-memory.dmp

Filesize
304KB

Download
memory/1700-325-0x000001FFAEEF0000-0x000001FFAF16A000-memory.dmp

Filesize
2.5MB

Download
memory/1700-407-0x000001FFCDFB0000-0x000001FFCDFC2000-memory.dmp

Filesize
72KB

Download
memory/1700-326-0x000001FFB0E50000-0x000001FFB0F02000-memory.dmp

Filesize
712KB

Download
memory/1700-391-0x000001FFCD7B0000-0x000001FFCD7D6000-memory.dmp

Filesize
152KB

Download
memory/1700-390-0x000001FFCD740000-0x000001FFCD74A000-memory.dmp

Filesize
40KB

Download
memory/1700-347-0x000001FFC9EC0000-0x000001FFC9F36000-memory.dmp

Filesize
472KB

Download
memory/1700-348-0x000001FFC97D0000-0x000001FFC97F2000-memory.dmp

Filesize
136KB

Download
memory/1700-359-0x000001FFCA9B0000-0x000001FFCA9CE000-memory.dmp

Filesize
120KB

Download