aa24ce75db9c573a6e1f17923157ac37dcc080f5f248874731db78334eab76bd

Analysis

max time kernel
227s
max time network
231s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
24-11-2022 19:46

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

wrar401.exe
Size

4.6MB
MD5

75e38ca41d5d7aad3812f23929b8b5f0
SHA1

4fd0c5ad493489a9741f8ec41ca4c984158ce39b
SHA256

936d435ddbfcaa21c9c701d8472367f0bd7992834e9dda1c8eeebf1b06ad3018
SHA512

cca1aa74b6b199a0b6d056686728598a015ef85df6c50aebc19e59b6b43839c3d91a0ea9323210b39bdef1fa852a58e940b099fcd68ea0c67557f7e86ddfb91c
SSDEEP

98304:npTFjZOpPOKvL6AwSRg9ZXznICl4OYn3s1Hpt+xrFqF1NrblGfzqINtForkDe2:nsmKG4Gv0Clgn8NyxUbllEzqINXKkN

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 7 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

OneDrive.exeOneDriveSetup.exeOneDrive.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDrive.exe

Executes dropped EXE 6 IoCs

Processes:

installer.exeinstall.exeOneDriveSetup.exeOneDriveSetup.exeFileSyncConfig.exeOneDrive.exe

pid process

2908 installer.exe
1896 install.exe
4344 OneDriveSetup.exe
3424 OneDriveSetup.exe
1996 FileSyncConfig.exe
4860 OneDrive.exe

pid	process
2908	installer.exe
1896	install.exe
4344	OneDriveSetup.exe
3424	OneDriveSetup.exe
1996	FileSyncConfig.exe
4860	OneDrive.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

OneDriveSetup.exeOneDrive.exeOneDrive.exeFileSyncConfig.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileSyncShell.dll"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_CLASSES\WOW6432NODE\CLSID\{389510B7-9E58-40D7-98BF-60B911CB0EA9}\LOCALSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /cci"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\LocalServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\amd64\\FileSyncShell64.dll"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileSyncShell.dll"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\""	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe /cci /client=Personal"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_CLASSES\WOW6432NODE\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\INPROCSERVER32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INPROCSERVER32	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileCoAuthLib64.dll"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_CLASSES\WOW6432NODE\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\LOCALSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\LocalServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\amd64\\FileSyncShell64.dll"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_CLASSES\WOW6432NODE\CLSID\{6BB93B4E-44D8-40E2-BD97-42DBCF18A40F}\LOCALSERVER32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\LocalServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\LocalServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\amd64\\FileSyncShell64.dll"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\SysWow64\\shell32.dll"	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\LocalServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\LocalServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\ThreadingModel = "Both"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\Microsoft.SharePoint.exe\""	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuthLib.dll"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_CLASSES\WOW6432NODE\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\INPROCSERVER32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_CLASSES\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LOCALSERVER32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_CLASSES\WOW6432NODE\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LOCALSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileSyncShell.dll"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_CLASSES\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\INPROCSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /cci /client=Personal"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_CLASSES\CLSID\{389510B7-9E58-40D7-98BF-60B911CB0EA9}\LOCALSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\amd64\\FileSyncShell64.dll"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\""	OneDriveSetup.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

OneDrive.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Control Panel\International\Geo\Nation	OneDrive.exe

Loads dropped DLL 37 IoCs

Processes:

FileSyncConfig.exeOneDrive.exe

pid	process
1996	FileSyncConfig.exe
1996	FileSyncConfig.exe
1996	FileSyncConfig.exe
1996	FileSyncConfig.exe
1996	FileSyncConfig.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

OneDriveSetup.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\""	OneDriveSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

File opened (read-only) \??\D: explorer.exe

description	ioc	process
File opened (read-only)	\??\D:	explorer.exe

Drops file in System32 directory 11 IoCs

Processes:

installer.exe

description	ioc	process
File created	C:\Windows\SysWOW64\__tmp_rar_sfx_access_check_240555906	installer.exe
File created	C:\Windows\SysWOW64\install.exe	installer.exe
File opened for modification	C:\Windows\SysWOW64\wrar401.exe	installer.exe
File created	C:\Windows\SysWOW64\install.pdb	installer.exe
File created	C:\Windows\SysWOW64\install.exe.config	installer.exe
File opened for modification	C:\Windows\SysWOW64\install.exe.config	installer.exe
File opened for modification	C:\Windows\SysWOW64\install.pdb	installer.exe
File opened for modification	C:\Windows\SysWOW64\install.exe	installer.exe
File created	C:\Windows\SysWOW64\wrar401.exe	installer.exe
File created	C:\Windows\SysWOW64\Siticone.UI.dll	installer.exe
File opened for modification	C:\Windows\SysWOW64\Siticone.UI.dll	installer.exe

Drops file in Windows directory 7 IoCs

Processes:

SearchUI.exeexplorer.exetaskmgr.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	SearchUI.exe
File created	C:\Windows\rescache\_merged\4032412167\2900507189.pri	explorer.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	explorer.exe
File created	C:\Windows\rescache\_merged\3418783148\1077508030.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\2717123927\3950266016.pri	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 29 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

explorer.exetaskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

OneDrive.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OneDrive.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OneDrive.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

SearchUI.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4904 taskkill.exe

pid	process
4904	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

Processes:

OneDrive.exetaskmgr.exeexplorer.exeOneDrive.exeOneDriveSetup.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\TypedURLs	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	OneDrive.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Modifies registry class 64 IoCs

Processes:

OneDriveSetup.exeOneDrive.exeOneDrive.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Interface\{f0440f4e-4884-4a8F-8a45-ba89c00f96f2}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Interface\{f0440f4e-4884-4a8F-8a45-ba89c00f96f2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\Interface\{e9de26a1-51b2-47b4-b1bf-c87059cc02a7}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\TypeLib	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\SyncEngineFileInfoProvider.SyncEngineFileInfoProvider.1	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}\ProxyStubClsid32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\Interface\{0776ae27-5ab9-4e18-9063-1836da63117a}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Interface\{e9de26a1-51b2-47b4-b1bf-c87059cc02a7}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\VersionIndependentProgID\ = "SyncEngineCOMServer.SyncEngineCOMServer"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\FileSyncClient.AutoPlayHandler.1\CLSID\ = "{5999E1EE-711E-48D2-9884-851A709F543D}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\""	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\Interface\{9D613F8A-B30E-4938-8490-CB5677701EBF}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\Interface\{5d65dd0d-81bf-4ff4-aeea-6effb445cb3f}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\Interface\{c1439245-96b4-47fc-b391-679386c5d40f}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\Interface\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\TypeLib	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Interface\{466F31F7-9892-477E-B189-FA5C59DE3603}\ = "ISyncEngineHoldFile"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\TypeLib\{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}\1.0\FLAGS	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Interface\{31508CC7-9BC7-494B-9D0F-7B1C7F144182}\TypeLib\ = "{C9F3F6BB-3172-4CD8-9EB7-37C9BE601C87}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\Microsoft.SharePoint.exe\""	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\Interface\{B05D37A9-03A2-45CF-8850-F660DF0CBF07}\ProxyStubClsid32\ = "{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\Interface\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}\TypeLib\Version = "1.0"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Interface\{c1439245-96b4-47fc-b391-679386c5d40f}\ProxyStubClsid32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Interface\{b5c25645-7426-433f-8a5f-42b7ff27a7b2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Interface\{1EDD003E-C446-43C5-8BA0-3778CC4792CC}\TypeLib	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\Interface\{c1439245-96b4-47fc-b391-679386c5d40f}\TypeLib	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}\ = "IGetSyncStatusCallback"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\TypeLib\Version = "1.0"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_CLASSES\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\TYPELIB	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\Interface\{5D5DD08F-A10E-4FEF-BCA7-E73E666FC66C}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\TypeLib	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\VersionIndependentProgID\ = "StorageProviderUriSource.StorageProviderUriSource"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Interface\{B05D37A9-03A2-45CF-8850-F660DF0CBF07}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}\ = "IFileSyncClient5"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\Interface\{f0440f4e-4884-4a8F-8a45-ba89c00f96f2}\ = "IUnmapLibraryCallback"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\ProgID\ = "FileSyncCustomStatesProvider.FileSyncCustomStatesProvider.1"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_CLASSES\INTERFACE\{DA82E55E-FA2F-45B3-AEC3-E7294106EF52}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_CLASSES\INTERFACE\{10C9242E-D604-49B5-99E4-BF87945EF86C}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileSyncShell.dll"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_CLASSES\INTERFACE\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\TYPELIB	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Interface\{9D613F8A-B30E-4938-8490-CB5677701EBF}\ = "IFileSyncClient"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Interface\{2EB31403-EBE0-41EA-AE91-A1953104EA55}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\TypeLib\{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\SyncEngine.dll\\2"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\Interface\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_CLASSES\WOW6432NODE\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\VERSIONINDEPENDENTPROGID	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\TypeLib	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_CLASSES\INTERFACE\{1B7AED4F-FCAF-4DA4-8795-C03E635D8EDC}\TYPELIB	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}\TypeLib\Version = "1.0"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\WOW6432Node\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\VersionIndependentProgID	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\odopen\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe"	OneDrive.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

Processes:

explorer.exeOneDrive.exeOneDrive.exe

pid process

4352 explorer.exe
3092 OneDrive.exe
4860 OneDrive.exe

pid	process
4352	explorer.exe
3092	OneDrive.exe
4860	OneDrive.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

taskmgr.exe

pid	process
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exetaskmgr.exe

pid process

4352 explorer.exe
4768 taskmgr.exe

pid	process
4352	explorer.exe
4768	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

taskmgr.exeinstall.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	4768	taskmgr.exe
Token: SeSystemProfilePrivilege	4768	taskmgr.exe
Token: SeCreateGlobalPrivilege	4768	taskmgr.exe
Token: SeDebugPrivilege	1896	install.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exeexplorer.exe

pid	process
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exeexplorer.exe

pid	process
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4768	taskmgr.exe
4768	taskmgr.exe
4768	taskmgr.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4768	taskmgr.exe
4352	explorer.exe
4768	taskmgr.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4768	taskmgr.exe
4768	taskmgr.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

SearchUI.exeexplorer.exeOneDrive.exetaskmgr.exeOneDrive.exeLogonUI.exe

pid	process
520	SearchUI.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
4352	explorer.exe
3092	OneDrive.exe
4768	taskmgr.exe
4860	OneDrive.exe
4860	OneDrive.exe
4860	OneDrive.exe
4768	taskmgr.exe
4768	taskmgr.exe
3428	LogonUI.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

wrar401.execmd.exeinstaller.exeinstall.exetaskmgr.exeexplorer.exeOneDrive.exeOneDriveSetup.exe

description	pid	process	target process
PID 2684 wrote to memory of 4832	2684	wrar401.exe	cmd.exe
PID 2684 wrote to memory of 4832	2684	wrar401.exe	cmd.exe
PID 4832 wrote to memory of 2908	4832	cmd.exe	installer.exe
PID 4832 wrote to memory of 2908	4832	cmd.exe	installer.exe
PID 4832 wrote to memory of 2908	4832	cmd.exe	installer.exe
PID 2908 wrote to memory of 1896	2908	installer.exe	install.exe
PID 2908 wrote to memory of 1896	2908	installer.exe	install.exe
PID 1896 wrote to memory of 3520	1896	install.exe	arp.exe
PID 1896 wrote to memory of 3520	1896	install.exe	arp.exe
PID 1896 wrote to memory of 4196	1896	install.exe	arp.exe
PID 1896 wrote to memory of 4196	1896	install.exe	arp.exe
PID 1896 wrote to memory of 4956	1896	install.exe	arp.exe
PID 1896 wrote to memory of 4956	1896	install.exe	arp.exe
PID 4768 wrote to memory of 4352	4768	taskmgr.exe	explorer.exe
PID 4768 wrote to memory of 4352	4768	taskmgr.exe	explorer.exe
PID 4352 wrote to memory of 3092	4352	explorer.exe	OneDrive.exe
PID 4352 wrote to memory of 3092	4352	explorer.exe	OneDrive.exe
PID 4352 wrote to memory of 3092	4352	explorer.exe	OneDrive.exe
PID 3092 wrote to memory of 4344	3092	OneDrive.exe	OneDriveSetup.exe
PID 3092 wrote to memory of 4344	3092	OneDrive.exe	OneDriveSetup.exe
PID 3092 wrote to memory of 4344	3092	OneDrive.exe	OneDriveSetup.exe
PID 3424 wrote to memory of 1996	3424	OneDriveSetup.exe	FileSyncConfig.exe
PID 3424 wrote to memory of 1996	3424	OneDriveSetup.exe	FileSyncConfig.exe
PID 3424 wrote to memory of 1996	3424	OneDriveSetup.exe	FileSyncConfig.exe
PID 4768 wrote to memory of 4904	4768	taskmgr.exe	taskkill.exe
PID 4768 wrote to memory of 4904	4768	taskmgr.exe	taskkill.exe
PID 4768 wrote to memory of 3760	4768	taskmgr.exe	shutdown.exe
PID 4768 wrote to memory of 3760	4768	taskmgr.exe	shutdown.exe
PID 4768 wrote to memory of 700	4768	taskmgr.exe	shutdown.exe
PID 4768 wrote to memory of 700	4768	taskmgr.exe	shutdown.exe

C:\Users\Admin\AppData\Local\Temp\wrar401.exe
"C:\Users\Admin\AppData\Local\Temp\wrar401.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2684

C:\Windows\System32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7D14.tmp\7D25.tmp\7D26.bat C:\Users\Admin\AppData\Local\Temp\wrar401.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4832

C:\Users\Admin\AppData\Local\Temp\7D14.tmp\installer.exe
installer.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2908

C:\Windows\SysWOW64\install.exe
"C:\Windows\System32\install.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\System32\arp.exe
"C:\Windows\System32\arp.exe" -a
5⤵
PID:3520

C:\Windows\System32\arp.exe
"C:\Windows\System32\arp.exe" -a
5⤵
PID:4196

C:\Windows\System32\arp.exe
"C:\Windows\System32\arp.exe" -a
5⤵
PID:4956

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
2⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
3⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3092

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart
4⤵
- Executes dropped EXE
PID:4344

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode
5⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Registers COM server for autorun
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3424

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"
6⤵
- Executes dropped EXE
- Registers COM server for autorun
- Loads dropped DLL
PID:1996

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
/updateInstalled /background
6⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Registers COM server for autorun
- Checks computer location settings
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4860

C:\Windows\system32\taskkill.exe
"C:\Windows\system32\taskkill.exe" /im explorer.exe /f /t
2⤵
- Kills process with taskkill
PID:4904

C:\Windows\system32\shutdown.exe
"C:\Windows\system32\shutdown.exe" -r -t 10
2⤵
PID:3760

C:\Windows\system32\shutdown.exe
"C:\Windows\system32\shutdown.exe" -a
2⤵
PID:700

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:520

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4872

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3aad855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3428

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7D14.tmp\7D25.tmp\7D26.bat
Filesize
53B

MD5
24b4606a069ed7aaa553f26822ebcb51

SHA1
b45a99b7d2616595434bc58508e15c64bf559803

SHA256
3093270c3898f401c67e18769b332f6b57328f2507d109e291b4890fb65b9e95

SHA512
1b6a0a3f8645d481e58dee90f5cc9bfa4a6f8c90cfbcf36d3dd547ace06145a7f26dd6950afe7d77aefcad317df61d0c941277d4aa5129b6d0f351cc550bd0ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\7D14.tmp\installer.exe
Filesize
4.7MB

MD5
36e6eb3fd16bf95570ae873050bb6eb7

SHA1
75ef13f9bebc47f3afdf811ba0d47c9979a10054

SHA256
6724f52f4651393a7a3e6350b4805d03d70ee07e53440d910526d0833cff1e6c

SHA512
2fc3159583b70b3152b79cceb7fc5d43acbfbfda542c88494feee7a72dec42f9e30cac053c07449aece817dbbefe39e439421ac1d3eb6e9fadfefaf2175cb6a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7D14.tmp\installer.exe
Filesize
4.7MB

MD5
36e6eb3fd16bf95570ae873050bb6eb7

SHA1
75ef13f9bebc47f3afdf811ba0d47c9979a10054

SHA256
6724f52f4651393a7a3e6350b4805d03d70ee07e53440d910526d0833cff1e6c

SHA512
2fc3159583b70b3152b79cceb7fc5d43acbfbfda542c88494feee7a72dec42f9e30cac053c07449aece817dbbefe39e439421ac1d3eb6e9fadfefaf2175cb6a9

Download Submit
C:\Users\Admin\Downloads\AddSuspend.DVR
Filesize
442KB

MD5
f3af7895f1042403222dddfa8431a1a9

SHA1
d8270631af0b54172cc69dbc2ffdd86e8b775f7a

SHA256
196392785b9de846a269b2e79e1790f389c66bc45ee93e921f5fc82488eda3d1

SHA512
a0794ce9cd48533fa3a0a7ef6c0b4d0ad55328b5c4b970eb8e11998f4ee828a1536365e67a2d6351029dda575c30d0b09bb012edc21603bd83933d9c9f31441e

Download Submit
C:\Users\Admin\Downloads\AssertInitialize.tiff
Filesize
374KB

MD5
ebc5b9b0c3710a87e629ad99a41055e1

SHA1
5b100253245065ab54629e2556965f8ae9bdcd94

SHA256
dbea84eed2db2cc3e65a047d7869996bb4bb19feaec0ae7d9f903586bebe8052

SHA512
7e60e15f89ebedca9346b9a4b19717f512bda8aa5e5b15c17b4c75669173bf23e50558e3aebf425925b8d817de233d0f833b9b08b96cd1850862e0402dda67a7

Download Submit
C:\Users\Admin\Downloads\ClearComplete.sys
Filesize
452KB

MD5
ff817f59ed58984bc1602e975e7a96cd

SHA1
184fa04cce4c4c058f68e821ab8d8c0c444b2b7e

SHA256
24b7b2309382ce9bcd808eee54698254a63685ba1a8e3aaccbb1ac1a94252ad5

SHA512
869e88ecbf74f630f622d29bfa37fa1f808253048a9870958a187b73668ce89200834f4522a23577f8742bad41f149e31f853ec53d475c02cacbc9c9529d0e6b

Download Submit
C:\Users\Admin\Downloads\ClearUse.hta
Filesize
471KB

MD5
d305e41e7849757d77ec42ed04eaec70

SHA1
cb0b812ea0b669b5be2a6a933ddb2f84d8f0eb41

SHA256
b5da6345d7409074863eeada485225487132408cb2c12131f9da527540d8d174

SHA512
fb91f5bc7c72e861412bac0b9dff6fe20720088e10a21163e3ed4b8f964b29b9337455c90f540d14a4002bc01cc052dfd01679babf3130d150565c9bddefc24a

Download Submit
C:\Users\Admin\Downloads\CompareUnpublish.avi
Filesize
491KB

MD5
8cd89674db1975548aa4314d181874a4

SHA1
d646707b035f4af02c186e3753afe14c7979afcc

SHA256
9d9bf3d6ec080453dfe54d9a8d3bf52decdf4db1febbb90a37cf82202fd0093d

SHA512
ec8f9912ffdcb12d0d95406ab3ec0689becb4e5b503448d1588e0fbed43f2f81ebb100fd3bdd53bd89c4f800fc922f1d46997228b7e0d7041a3a6e7bc18638bb

Download Submit
C:\Users\Admin\Downloads\CompleteDeny.TS
Filesize
364KB

MD5
b5e76a3bf8b21fbc768635ecda21a370

SHA1
6123535c0accd835d11ceb869ba3131d922847a0

SHA256
20d9e7836fe2a6be34554eded28aff6e8dfa5a5c91a02e54aa772fb9386fbc4f

SHA512
51f7abf24e9886e957ce4ba3427afc11e66f2c3e1c9eb2613beb835ea091e3b7044d06a5c48eeb5372dd3877e3771925e8469b6143e726134249aa418357be1e

Download Submit
C:\Users\Admin\Downloads\CompleteSearch.mht
Filesize
520KB

MD5
8d8ef5e8738fa02f32e4ef659e6c77e0

SHA1
1d719c708054e5996e0516e8e865f5000ed5ef51

SHA256
3bef12c4b62d88dfb78283bfad0f279450ff707c353bcf5bc23dcea7ef28bdd5

SHA512
69ec00f0b77b7d78edcd33980a5f7dc996c54f1090434b12e2db0296ec5bca102551898d0a26153b7e5300ce6c89a0a1a950c3387e0d554b636f6080b2f39c6e

Download Submit
C:\Users\Admin\Downloads\CompressWait.emf
Filesize
316KB

MD5
9e84fd2e205254dd317f6d1714b00f48

SHA1
c8ed52c07f337d5aefbc8b328210a6c1f3dc445a

SHA256
743a716e67e4a8b7e80a01be641a7483807f600e6725e311f29465aba8e123a6

SHA512
7947eb6f19dc60f363cc40b77e3bc301a961c3dbe36f6646af13de10c860a08ab17f4d0fe9acb1f842a591916d9695082b426ea31e55051cdef9428f22367922

Download Submit
C:\Users\Admin\Downloads\CopyMeasure.tiff
Filesize
403KB

MD5
92ef66517eff9ddaa106b801faa5c1de

SHA1
c60740f5e238b1fd4c884bd45ddfa4d3c67f778f

SHA256
2142016f7f41f22412ccaa8b97e4e0f845444712248582bc20c0f8bcc7339266

SHA512
e31809b9979057f28a0b6d1aa7cfcb1d615c06b02004b5ac514138e5c1337665d9ef0a7a6e894c9e4939398300d3bbe7e78dca2f9098d96e789f90dfe7bffa9a

Download Submit
C:\Users\Admin\Downloads\DismountCompress.ADTS
Filesize
306KB

MD5
64625ab9d615e57bb3d37281331f4b11

SHA1
2ad7d7a7e71739d0da0720af78253a148cf63c32

SHA256
2bf1bb709edb8f642b1aaf1364737aa32ff9a469e97d880618c7ebe5333d4338

SHA512
6c7f10531b04976d331dcc4b556fb90cfce444507d42c80193ee4344d1e02667fd8c8c1364c7676633591cbea5820cff0d7cd27139bbc9b09c9512dc12b9888d

Download Submit
C:\Users\Admin\Downloads\EnableSubmit.avi
Filesize
286KB

MD5
a972ace8674b61abb9a7069dc7968b3e

SHA1
5f0ffd973898c630ee1c77db780d6ffcb532502d

SHA256
a9e3c19eee3c903a2eaf74a5f3226a2169a6ebe3db189997f6670bfcad3a4b48

SHA512
86abc4251c5dd62168df961c78a5531036c9bfd7483016dd0bf48569726625eadf5f9260d04d72a2160ef54c3a8bd90f5c185158439d5f6532eec47038db38ba

Download Submit
C:\Users\Admin\Downloads\ImportCheckpoint.easmx
Filesize
393KB

MD5
509251727cefe9cda4fcf0411b40c50f

SHA1
bd375ef7ac41c1c07b7eaabee1d40eb3d4ef43e6

SHA256
b6189e79c3c5549d5b5361d47d475402baafb11a71e4142695b67b4159d40030

SHA512
ee5305ad16a2e5ccc467b17f1ff1b251259935331fb8b8bca6deb119dbf3533ea47aeeb6753654275daa213d2c8462757a0452224441b27b42be34e4f8bd3bc2

Download Submit
C:\Users\Admin\Downloads\InstallConvertTo.asf
Filesize
461KB

MD5
2f8fafbeedc9284c595a04290fea9540

SHA1
2433e0228224be2a59858b4ff56bfb7d0c987e35

SHA256
9a464102b7747d1670a20130bb25763ba7cce252d387c1c28bda499a3332d281

SHA512
9b516aab0562dadfc5b3de42ed0e3f46d0e67f80c5e539501fbfd5b0f58ee98e2f1645324785867a6e1762b531c43573785cf80c8ec524d787ea37ae19bbb119

Download Submit
C:\Users\Admin\Downloads\LimitWatch.wav
Filesize
189KB

MD5
8f69bba1ad7f6177dbf85f6d66453eac

SHA1
06d011ab89cb248997cb93d52073d51fb0ae813d

SHA256
0a6d7fdc2da9331ae9d0f4d85c020c1d0121d11e344bf650bd4a9938473c1a2c

SHA512
0ca54e876c18a9ab0c63bbee5534fd3a97a91632dc01b6dbff90e4542f69195089db4dbc992bda491ac4763fdb6a589e5b6c9d3022f30b8c1f1c5eeae37ceebd

Download Submit
C:\Users\Admin\Downloads\MoveSelect.dxf
Filesize
296KB

MD5
385be7051b9dafdd46c2b849647e4419

SHA1
12a7222855ed235a57e2ee505b135449057630d3

SHA256
4ad2726e74b2dd542918da19cddd0126e04ed1bb528b1798dae8d3fbbe3a9470

SHA512
6ae2d8ca962c55c343eb5af907fe7c8ce2690af3506a17e352600a0ad986453e97654a1ee7fd2662f18e21be9952310d420523d47eead869e38e944930e09139

Download Submit
C:\Users\Admin\Downloads\OpenGrant.wmv
Filesize
218KB

MD5
15dc5c005155055a15194969514a74e4

SHA1
fac92da6997133f9622d3ab52562e7798e327b6a

SHA256
77ad45562c4f5d41c36eadcff58a5b2bf2a11584a3bcd9837a839ee3c4803761

SHA512
9313196f393578c3351d476a251243b43cd1341c1c9719ba8b7856a25c5cbb859294f60d30edd4e88d1d79bf6d37bd7bd714c2ffa119b84c4f298ec2aaafca95

Download Submit
C:\Users\Admin\Downloads\OptimizeBlock.bin
Filesize
432KB

MD5
12503b3176a40fb90111b8a1ae472cde

SHA1
b401010ceb4de5a8078391ea8ef26e43889bf18f

SHA256
13ce4f5a6eb26551faa6e524891b659f371f2b7f7c6bcdb320504a43e33aee16

SHA512
1fb2b9b842f1b0a6a394c38df4662e77745f7860f02d23f1dc1d2ce0e3882107caeb26b5c7c3b395d0fe00e7ff7c72936af9a76a42a12ff911fec1d92c913d04

Download Submit
C:\Users\Admin\Downloads\OptimizeSync.mpa
Filesize
277KB

MD5
58bbfec924705687fead87555b384281

SHA1
29ecb5d48b38015d5e58ac472a6430152d9dfdca

SHA256
61a6365a59af29787852753c646ac552084636cc01b8fb1c638765817f1a6186

SHA512
27c00ca7089ba6ec4b69dddcc0169766d2a37ff06f96f5d9fb97387b8babdd85f8b9ac33d43bb5658c3bc0ea2725869105f3587d73f86466133777173f4ff0dd

Download Submit
C:\Users\Admin\Downloads\OptimizeSync.svg
Filesize
199KB

MD5
c7d967ffed0eac19cd78e46a61604d2d

SHA1
bad0fdac55d40cd796cfecc14d2aec6239e8cbf1

SHA256
2c28343cfd050554137880731576ebb6f25a010a01effb313e2cd6be8205e553

SHA512
c91c7651c426bce4e71abfbda0b7124559b12a2b3186d2f29bceb4dde897bf4b9eab37e72a5d1cb9cd86034639e6faf3235283486ae20f1bb7d10dd8e98a3bb5

Download Submit
C:\Users\Admin\Downloads\PingConvert.htm
Filesize
413KB

MD5
63ec9b04831e843d6a912f1c8a7592c7

SHA1
c57bd2de056b7988cce6579e45460b78d47b2869

SHA256
d80d56256c010105842a2dc8edfc2c813094c64d5ea2be811de0a4fed78e151c

SHA512
43c0ae2479d9e4c21a2d63cd39526f08a8f5b8dc4a9041ebae0de56ed4bc29625d09ce1c930fe73c0a79656112f62ac05b1156edb3244338e96745d7405357be

Download Submit
C:\Users\Admin\Downloads\PingTest.ogg
Filesize
510KB

MD5
757073c9917a4584f36770c37a1591fd

SHA1
629751fd087c932de2119a4508d3f73fbb36bef3

SHA256
b286449625afaf64a4603985de82a81e72ecf9dd0d5cf72ca6c641748430a46a

SHA512
5577287d3c96eb796d94f8a487160f7fa1131bf9d3261b6c1423d1cf36591640aca6b5c083365f29586cf7f09ebdc43dffbf64c4d5613afd410702e6f9a19727

Download Submit
C:\Users\Admin\Downloads\PopBackup.xps
Filesize
335KB

MD5
64f8fde24e72298b78b231ba667ce028

SHA1
a902ccc0254e21c8e53f20b2335f7a9923ff0ed3

SHA256
6082e520df71810d86a583d5712ce20ad2a78bd151998360a3f6bf3d1138858b

SHA512
51edb0bb1654b0307892be424c9217ef9f87be06363add9b364a44dd05b62a4cd9a22e6fa1f6126b5f795abe3767b87abf5b5ba4f278840fd5cf4a8fc5aa4555

Download Submit
C:\Users\Admin\Downloads\PushSuspend.html
Filesize
710KB

MD5
25709b338afa9f64b141834794990d83

SHA1
d88ac13376693dc3bd67a0b5d00f1f5f54e3de6d

SHA256
56a0dd56089909a6b76892159c47373cde577ccc1ef5ebea28ab4aabca384a60

SHA512
737b56ae052667c513dde74a3fb932cf0ecf14f39bc605ec00fbea26bf537573b783516de527f3a88a6d8d9dc631a34def0bb880540cb1ca551f7b0d124565f2

Download Submit
C:\Users\Admin\Downloads\RegisterOpen.rle
Filesize
354KB

MD5
03c856a96e267fbd8565238f0f23952c

SHA1
4f73265204e1035be58737542c356669e1ba27b1

SHA256
69f63d72b940760cee6cbfc5dd5cf75917e4d82267cc396af47b0c08d9e2018f

SHA512
ca9ce0462c4f310e5a1844f0cc93f86941a2631ea51173c420ab10c517ee4a554fa6850197c1d44c7baacf2b17f620e37802425f18faf25c30b254b389e46d29

Download Submit
C:\Users\Admin\Downloads\RegisterSend.dwfx
Filesize
247KB

MD5
872448a3af62720637de921a3ef521f1

SHA1
9b511223f7d88079ebad5257af974ec7b8f11afd

SHA256
c8fff90c09e38a03c7bfe4c4935331d308dd5fbe8205ee9a474fc596945f2cb4

SHA512
b79ed162c9cae5d692bd5fecf361a0de686483334cd3523b4b4722ea6132b30a15edf73e657fc2600825058ed65869ab9e24995791f3b28a12074a6501591834

Download Submit
C:\Users\Admin\Downloads\ResetExpand.xltx
Filesize
422KB

MD5
582697fd382bf472e28da7d356658c92

SHA1
c39ab8270084de2baaae5bd0cc5aee3720b323cd

SHA256
bd0e4f826f76248e51a044b135b9ba881dbb781f5c0987e1e8703287bf737089

SHA512
cf4efea8062632a0df7a2c13eceacab975374a8df4bedfab2887df7ddf35259d4e77283cd64a3059eb324fe41ec18d321b01e562ae16fe63c3fa50410e251a7a

Download Submit
C:\Users\Admin\Downloads\ResizeConfirm.TS
Filesize
179KB

MD5
96ac94ae870e5c769e637da9718d900b

SHA1
0b819aaefd35f0dd29921761a49b6ac64b6671b1

SHA256
c9efcb3f9ec35c3cb8e53e012290bbf359a213235e4d65674a9e785d228bdd74

SHA512
9efae7737e5ebfb71973b3cba752d4a2bcf64e53c936ad8e10214e23fd9fb6d091bd780f13715b80d58460ee4c6b271ba8095b6f7b9bf8d1eff2cab18bab9c8a

Download Submit
C:\Users\Admin\Downloads\ResizeReceive.pot
Filesize
500KB

MD5
00c86585ebd4fa54c2a73ee1f5925d34

SHA1
0541cd9e8f2a7f4d5143d3e5438bb82286406649

SHA256
76cb4b664a7d2a40897af9b984638d0ad4619425fa017f79860b056fdcc9a8d3

SHA512
16011c37ba3484fe56e0b3ef81c546767d5a853c31ba4df6efddef7bbc0994c95c72c8f849c895efa6cce8818c97f9b0777e486a8ceef68f3b60bffe1e0bb943

Download Submit
C:\Users\Admin\Downloads\ResolveUndo.zip
Filesize
325KB

MD5
9ee1aeacf2c00757b5777a5819174c2b

SHA1
01fd808d500009ef25b098a3f44487923e26dc9d

SHA256
3efe0153c06ec222f1b65112af478b47ad310cf6b00a73c12398dd32c27e7a16

SHA512
c4801b2cd2e556ca456732d19ce585f377a8a95c0a1e671fed46179a651358105a80776c988b6c3f89865cfc45c3091279bad96e5745503db0da0b66e8087805

Download Submit
C:\Users\Admin\Downloads\ResumeComplete.wmx
Filesize
228KB

MD5
86621c93880e4448fa14d7ef740e1f4e

SHA1
039f727e8574fbc4e0914883bcd3a2cf995e5ffa

SHA256
1974b852629455ed669cdd6a08bea3e7911ecae0f11e4886f28f00ecc94372ef

SHA512
725ccc1abd776ed42644d2def547b11c264378650b2c43c2afcd24bbf7b6b125eaf3a661f36d9bddbfa019e5b3a8fd0db1e65b830a7664b1c2dc8f53697ec697

Download Submit
C:\Users\Admin\Downloads\ResumeStep.ex_
Filesize
238KB

MD5
c1cac5daf08f694f202360ba1c325e5c

SHA1
6323395148e039be682cc2c59d296d9c25916146

SHA256
e30c607b38b88906e2b46cb758adcf0d07a4b5a5ef867c47c89b86081e445e39

SHA512
82d4b53fe54b524d0093802d9fca50078102a50c6750e90868d8f67109e8421bd2955a4e97eff97feb810657c7c5b37ebc7748fbab4858a28314fa926e6cbc86

Download Submit
C:\Users\Admin\Downloads\SelectUnlock.vdw
Filesize
209KB

MD5
cf8b16d53c96c074980a48689892cea7

SHA1
930cc8ca686e81935a310da42fa691fc716a19b5

SHA256
9f70d76ccc1c14448a5600eb298a57769bf8bd083d6ff0645082babead9fa40e

SHA512
15b2dae6cb07f0847378bf63cd29f4f3bf01fae5f2357137a18414f8ed0dd43de37a9aa9d792539d0e6a9fc32261fce99a13c85c02511310b0fb98b533e0e616

Download Submit
C:\Users\Admin\Downloads\SetHide.sys
Filesize
481KB

MD5
611166337c7712a569c5c56c6eddf085

SHA1
80b8117799fd61fcce5f1ffa02533991f8860861

SHA256
6ac8239d280c2ea2027050949e61c6d7dd9c19c57d69764cf45367ccfb2d2c63

SHA512
212f243771e7ff5361f37454ab6dfee242979897c7fe287a0d0c733058484e1b159086ce5cf1e71f2194abbb1dcc837eb7f3f43a392d9582e43e35d52ea3e81e

Download Submit
C:\Users\Admin\Downloads\ShowDisable.3gp2
Filesize
345KB

MD5
42a224ccc65a7ea5f5b235f6259c232d

SHA1
9c08db7c5fa476d316ba6c716a2279a44d0eeabc

SHA256
5a9250ca78c4b20b3377cc38cbfd7afb41ffe861c54fa8be0c3c5158e375555e

SHA512
692c489afd313a6f27aabb6fe5676ce100d863a365e83aec9ceaf8c532a5deb45c4e6b38bbebb74756c6dac88712beea0688277fe6a57f9bee5fda16763b36cb

Download Submit
C:\Users\Admin\Downloads\StartSet.pot
Filesize
257KB

MD5
d461930f3f4c323437369ecec3ca2955

SHA1
6a6a452363a56c12a360b3ff56c6128015ee8c16

SHA256
1823e6b45b2eccd4fdcfe8df294f42fe4a283d60fe45df4522cf7039ed2d907a

SHA512
0b8ff0029e0519c1b2135875a4d1f8d59622f9485b09622eb93feb987b5b56f8701d71931b46139f81aac5ccb0f6fbb1481bccd55069f9a1cab99dece76acfa7

Download Submit
C:\Users\Admin\Downloads\UnpublishFind.wma
Filesize
384KB

MD5
8fab1601ffebd173cbd873ce8656fb3d

SHA1
fcfb4c0e8f1ad8a7affcb154558d269c92073147

SHA256
5f1c41b0e6a6cdbf109fbcc7dbf7cbb64216a00a1fb64562e673f80c0476a968

SHA512
b142c1453bd29ade543a9660927ec4c23c4f1ca43f543998766f6dc9fac652805e00105a30b573c3d95ca8fbfdcedcfb93ba5078e5c32dcf59889fb8d3519851

Download Submit
C:\Users\Admin\Downloads\UsePush.mp4
Filesize
267KB

MD5
0f81d94b705a695cd5811327309afead

SHA1
336d3c5f46bfb0c13088c97c86c08f448f0c435d

SHA256
4ed6d7b0042550f2922521f17d0d67e0c5b5fe339af8d340a03723cdbf4cfc55

SHA512
37239cfce2717ad2a61129fffcddd60fb4dbe8d3cda191c40e639ac3130825f6dcabfe4921a3e8abda657d9daab2d8a6c5543719ea1238174e71e0c5ef87fb38

Download Submit
C:\Users\Admin\Music\ExportUnregister.pps
Filesize
275KB

MD5
25f5d0544cd57e4bd6ea0258a87418eb

SHA1
3046d0fea81a4ab846eea66365c7674c10d244f7

SHA256
5ba2ccd8feda456d87b030b51a25880fb18a6ca59b069ba71a26245f684849fc

SHA512
6ae13e9f649dc89c6bc2090ca689ff0a138789624275035bb1e1a37f79839caaf4f8847b5f59e30448067febd27d9e3099abe18dd153bfe661843efcc29b98ec

Download Submit
C:\Users\Admin\Music\HideConfirm.bmp
Filesize
359KB

MD5
038a464a8001bb837ee6ed7d2fd150a5

SHA1
9e09e1fba3e50c43803133674f941afb8287e847

SHA256
dc486e7aae71f94ce04e430698808b29837f87c3f1c87484fd60cef68065c18f

SHA512
129506b352a74d6ebc5816aa4e2563b7db4b54da98f7b9fdcafa20123f0e94f9b5972d4db2f44c4448ef0d265c05302a2f82756e2cc082a6c29f4093392ccb07

Download Submit
C:\Users\Admin\Music\InitializeDebug.easmx
Filesize
416KB

MD5
73e076c20d6d7c8e5ff5d78e7124889b

SHA1
7069965dd0b1b13e5c3114a948665a0fba8f5d1e

SHA256
6bf8b548c008485204272cfcf0824e4c588ebee54ffe65b307f7165c5ea49e16

SHA512
e11ba4c634cf476a44c56b5ede11b176625e68af9cd74817e24585a808ff02df2dca38d8b14ee82565619f7e9850743d2d9b38f763df1a0a68f479ceb9a166de

Download Submit
C:\Users\Admin\Music\LockPop.html
Filesize
345KB

MD5
2d333aa9ae7953c416e791c4ea072286

SHA1
ab81180f355c22f26468d817402a2dde7f1520e1

SHA256
d07467c83ade51b5e7d3cf8eab18aa0a5f6a3de9c6459cf17ebed438519f210c

SHA512
70154408a5cbdf303e8f3907bacc6944ba26f25407e181ae4a9bf4c4cb147e799780c373fbc78322788dbf8028af5351a6c05d8888cafa8842667d039c503afc

Download Submit
C:\Users\Admin\Music\MeasureUndo.cmd
Filesize
500KB

MD5
a6fc11688352af656bf42278f822c9fa

SHA1
f5df177eec87db66753925ae727070bda5b91da0

SHA256
043405d2070ec7a20bf58a6f945588351db3886da7d0d16088bf7f0920c87193

SHA512
c8abd1e7c3eab87b93ccde4bf9f949e0697cef762a083cb4d63e85dd262de8beb38fe3fd7d802b6d91d7a7e3d56252b1599623f7e6278028aec185fdd8523a42

Download Submit
C:\Users\Admin\Music\OutSet.dwfx
Filesize
430KB

MD5
a34c65c879fda420ac92a59b58d0373c

SHA1
0055ce191f6cc3e03081ef9eaf785ab14c59db18

SHA256
20a63576eaa1588eb6d1b4bd0fad11a32ad3d827df240551d6e4f63d8a539fe5

SHA512
759d694cf08886efe0dc9d424ec4a7c76ee4a3c07bf5cd826aee4c57d16c9703c33104eb950cdf209eb5bdd61052fe3d9a6aff9ad1ec9ca6c291073954b59267

Download Submit
C:\Users\Admin\Music\PingUnblock.3gp
Filesize
613KB

MD5
e10c66eaad45e91621a8d60a47f9a529

SHA1
791d481d3253bfa0f1b2372e6fe60d0b6ac590fa

SHA256
17db0747d246c761b66d6f1e789ab8bcbb04618295edbdcf9fb98105c2a9dac3

SHA512
0e3f40d0919d9e7dbd3cd24e3faa85f3d79cef253ba2671141586986071537e73a68789a2c0a3bd60f7f4adb1af9ec731b8f3a90caa7463629fcb57cf86963cc

Download Submit
C:\Users\Admin\Music\ReceiveInitialize.emf
Filesize
444KB

MD5
1bc7c9643a9a34abc9f5f1d03233da0c

SHA1
20b7fc5a3174763f74bd99f1ee4f596a8834a002

SHA256
f86051fcd1d6a554db85f7202e9b10d7886418ecc56bddf66b99d98f4d901a0a

SHA512
d6879091a014cbc2bf2ec9c9b626a7de8a59638656e914c107b8f5221b87810650b654fbe3129283bbc07983377b2d655f51d38a660d55b6550ba6c7cc74310b

Download Submit
C:\Users\Admin\Music\RegisterAssert.eprtx
Filesize
331KB

MD5
53f0923de9132a7533616e4b2097f088

SHA1
55c2abc2de98304ae71e109a3c738879b4252b28

SHA256
dd5098cad089f2083779886a5c49e47dbf999461eed40561bdd1b88a5c154259

SHA512
50bb0b37868e7b811eb1809718117d7f616da9fab77402b800f9be5a8d11b6f15f648139437205bb9ccc3949bf4084cca3e5e151513ba71dcbff7e7c278f002c

Download Submit
C:\Users\Admin\Music\RegisterWait.ogg
Filesize
289KB

MD5
c2b4be17b21b6b8e44920b7dd5d57801

SHA1
b739e704f2ddc8cde118c79d90dfe5e4564af46d

SHA256
7a2797b251beca87389ffa4437f6d37ddcd6870578fb6a58d53907eafb6d42bc

SHA512
e1f483676e22304dc6a58e9bf5694b7bb739f579ca94e6edf5ea80c77debfb96d5b9f7170ac2dc392ce8d1055f7668d89ed7c84253dc71500dd292377f4a269b

Download Submit
C:\Users\Admin\Music\RequestExit.dll
Filesize
669KB

MD5
e8b3115c95f4f558c79ab1d000cff45b

SHA1
25971d90948fc28a72ac1906cd62a8e511e54ee1

SHA256
957124bdd15dd29782c00ac98f1ddd800db795af22e86e7e65f0c8bca8551392

SHA512
849ec8c86942e969aa9132c2216c5f2ef8744a88bed14140bdca228606526003f70ec04da2534880c421e3420042706d52d8c377a4655846088bf7b81561e535

Download Submit
C:\Users\Admin\Music\SaveUnlock.vdx
Filesize
303KB

MD5
0cff8cad6365cf39eb5ca9be652da94d

SHA1
58fe78f2baaa5fa2701b7ca34da1acd133caed3a

SHA256
685281c8fdfd95b2eed6a932d85882865d7f2165519d9120193038ae80ffe23a

SHA512
120475c2eee15a291c3ee608ba946482f1a75713368e135771fd4d1a0902c0b8efaaebd6419695a7edaaa561ead020951f337ad5d4d204d8ffa40e84add8d5f8

Download Submit
C:\Users\Admin\Music\SearchCompare.vssm
Filesize
514KB

MD5
a94c748a573bc56440119db99e963f84

SHA1
16e57470896685c870ab4f49368dabfad98cd74e

SHA256
c54c968f79ffdd3479d7934f5d4539e43b5bf24c87c4e33f616a9be108157a71

SHA512
c17674416bc9987616a6f9738c384b776bbdc007ec8c00597dd80109118ebe5c814fa78e5b97f604cb82b0c36e4f1e9a6254e5d2326bb3f297e508c937b5e2b5

Download Submit
C:\Users\Admin\Music\ShowDismount.3gp
Filesize
543KB

MD5
283513c2c0a648acfd74f7ec05de9545

SHA1
33d966fd6916cc14eb2505cd1b153fb85fdb84f8

SHA256
2b7e8bd84ec11dfc3c236c3440a6c2780c54782144090e827bc20d3eb0088a15

SHA512
29eabafdd0e6437dafa7eb69340d73afcaccfd87b8a2d6fdb977d86ee82031e0099b3550a5f9c675481c8a9a34629e36ec4d4e9386070d1247dd382b42b11adb

Download Submit
C:\Users\Admin\Music\SplitSet.3g2
Filesize
401KB

MD5
127c01de0eeebf362016f8e938028198

SHA1
8c181afb37071d1fdb14140ff76fbc4a58fd5bbb

SHA256
3d3b8e78cf270f104b1cb5c63c3a1817537d27c46d12afde7d35c19088f41b43

SHA512
976335d85dd863b6942f6d99cfb76aa36f8dce2575cba3ceeeb7c59a19b9922fce08c173f18b41faeab612e4bc4c48606cd7ae7c954d6e5419bcb29255127c91

Download Submit
C:\Users\Admin\Music\StopDisconnect.pptx
Filesize
585KB

MD5
8e2ee4dbd373cf0a36139836fd78cb71

SHA1
3af604e6a4629cf127eb1ce40e05a3f7e417f10d

SHA256
7dd35d6a9a7448a8db3e28f0fe0449864f95d2bbf0cc6b6dad18f17c5ff22ad7

SHA512
300d690aecf129f61c5baf19cf05913b674f2e5d12563b554c9f309f9e8f306d13e538392927b4d262b9272b7834e043721cd008abbe9cedc554c482fa7f3163

Download Submit
C:\Users\Admin\Music\SubmitTest.xsl
Filesize
373KB

MD5
eb2e40ba636b6d48d93005c4f691ec17

SHA1
84d84c584a245d4d36e3554ef77443b0760d0975

SHA256
3d98d781b721f0673eaa4b2a41393aec2b9c7651e4f6225a904b010c18b86637

SHA512
b8b060eaa7888987855ec06e8bcb6370a7fd77db586ca209c43f6f73bf29db8c62b0873ba2c96c43428676d8b1bf1cc3bba30ae2273df9d717dfac9d7ba8e0a4

Download Submit
C:\Users\Admin\Music\SuspendOptimize.dib
Filesize
571KB

MD5
dbbf2fa1756f864fc9e1bcf1cc4e35a0

SHA1
1a8fab0895fc51e1957ad8672a138c2646f5db88

SHA256
6712bce750b4dfbd5865849fb8b9e7908b0c8f31fbec59b102be9a52fff1e194

SHA512
ee6049f477c40c8cbe1eeabe34f89e127eea9ae670ce7cfa5ef3c2123ada74a816072c3beeb149570242c7e446a4cb73e19a637d3d5decb11d79b5080ee29c65

Download Submit
C:\Users\Admin\Music\TraceSync.ps1
Filesize
557KB

MD5
655321567b88b21f6bc4ac1ff97135c4

SHA1
f6fa900f09fd7e9353e347281ad1e8d19a370b0a

SHA256
60d0b33cc0c8fbf6d0dc8dcb02a0489488a851ffba9ff1881f21697015ebcf71

SHA512
d66010e32f29f4aff179fc36d403d153919473c9ae4e04d698df7e3d8bf52be1440148ef7aa0ebd3eabb292f5e01db518d8741473f7f7e131d1a554d1d80c806

Download Submit
C:\Users\Admin\Music\UnblockSplit.ini
Filesize
317KB

MD5
4ca245444c8cf855be8adf8edc9370ff

SHA1
7c126e6c489b2bbdb8b7947282e693c5388e574d

SHA256
89444865f106354001adddd042ec1ebea7b4ddde988a6cfa43e7de9803a5d65d

SHA512
39dccb39dae4e70f21eb38b97ad970bb6976e3b8ed23cf3a9989bfba60be37e4b4fe7bd282e30f86e92e10572b967ad2a0e28756d3155589a590afde972e21d0

Download Submit
C:\Users\Admin\Music\UnblockUnregister.vsd
Filesize
641KB

MD5
c4abc061a2ca2d5983280e3f747e27de

SHA1
b994e603af49330f736c534029b3911a02c4d7ec

SHA256
91061cfcd702e7890b6a64f37ff1c0aef7b5d10c2636583b075fa906902053c9

SHA512
176a0d14d2e8bfbeb6e86b321a9a169103744e227b3be09f4fad09290941d56b0ec2f1e53d884161ef148eeeb6a6416f1dcf5117f51277a5d5624f38f7799f96

Download Submit
C:\Windows\SysWOW64\install.exe
Filesize
197KB

MD5
1bfe99a81e04895a39171cd9ead96b02

SHA1
a8c6c3c4278d6cca85b00590ea8d6ba3dffb474f

SHA256
4885cced8c555984ea03f00590ddbcf3a579e4ac6baafec8414ea645dc20f24c

SHA512
09f58b75f6bc0b173248b5dadae39ef2da022d0a4e4b6229925ee1157cb90212b73825fb22e4707d16c8c9a59377108aa6151bab99f26fead92db5ff1947754b

Download Submit
C:\Windows\SysWOW64\install.exe
Filesize
197KB

MD5
1bfe99a81e04895a39171cd9ead96b02

SHA1
a8c6c3c4278d6cca85b00590ea8d6ba3dffb474f

SHA256
4885cced8c555984ea03f00590ddbcf3a579e4ac6baafec8414ea645dc20f24c

SHA512
09f58b75f6bc0b173248b5dadae39ef2da022d0a4e4b6229925ee1157cb90212b73825fb22e4707d16c8c9a59377108aa6151bab99f26fead92db5ff1947754b

Download Submit
C:\Windows\SysWOW64\install.exe.config
Filesize
189B

MD5
9dbad5517b46f41dbb0d8780b20ab87e

SHA1
ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e

SHA256
47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf

SHA512
43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8

Download Submit
memory/700-959-0x0000000000000000-mapping.dmp

Download
memory/1896-232-0x0000000000000000-mapping.dmp

Download
memory/1896-237-0x0000016F4C100000-0x0000016F4C136000-memory.dmp

Filesize
216KB

Download
memory/1996-706-0x0000000000000000-mapping.dmp

Download
memory/2684-132-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-123-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-156-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-157-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-158-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-159-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-160-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-161-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-162-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-163-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-164-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-117-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-155-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-165-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-118-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-119-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-120-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-121-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-122-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-152-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-124-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-125-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-151-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-150-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-149-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-148-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-146-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-147-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-145-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-144-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-143-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-142-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-141-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-153-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-116-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-140-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-139-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-138-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-137-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-136-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-135-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-134-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-133-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-154-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-131-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-130-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-129-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-128-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-126-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2684-127-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2908-179-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2908-176-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2908-171-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2908-172-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2908-182-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2908-175-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2908-170-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2908-178-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2908-173-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2908-180-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2908-185-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2908-168-0x0000000000000000-mapping.dmp

Download
memory/2908-181-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2908-184-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2908-183-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/3092-294-0x0000000000000000-mapping.dmp

Download
memory/3520-238-0x0000000000000000-mapping.dmp

Download
memory/3760-958-0x0000000000000000-mapping.dmp

Download
memory/4196-239-0x0000000000000000-mapping.dmp

Download
memory/4344-454-0x0000000000000000-mapping.dmp

Download
memory/4352-245-0x00000000059F0000-0x0000000005A00000-memory.dmp

Filesize
64KB

Download
memory/4352-293-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/4352-292-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/4352-253-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4352-254-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/4352-252-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4352-251-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4352-250-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/4352-249-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/4352-248-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4352-247-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4352-246-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4352-244-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4352-243-0x0000000002960000-0x0000000002970000-memory.dmp

Filesize
64KB

Download
memory/4352-595-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4352-594-0x0000000002960000-0x0000000002970000-memory.dmp

Filesize
64KB

Download
memory/4352-596-0x0000000005A10000-0x0000000005A20000-memory.dmp

Filesize
64KB

Download
memory/4352-597-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4352-599-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4352-598-0x0000000005A10000-0x0000000005A20000-memory.dmp

Filesize
64KB

Download
memory/4352-600-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4352-602-0x0000000002990000-0x00000000029A0000-memory.dmp

Filesize
64KB

Download
memory/4352-601-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4352-604-0x00000000059D0000-0x00000000059E0000-memory.dmp

Filesize
64KB

Download
memory/4352-603-0x0000000002960000-0x0000000002970000-memory.dmp

Filesize
64KB

Download
memory/4352-606-0x00000000059D0000-0x00000000059E0000-memory.dmp

Filesize
64KB

Download
memory/4352-605-0x00000000059D0000-0x00000000059E0000-memory.dmp

Filesize
64KB

Download
memory/4352-607-0x0000000002960000-0x0000000002970000-memory.dmp

Filesize
64KB

Download
memory/4352-608-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4352-609-0x0000000007E20000-0x0000000007E30000-memory.dmp

Filesize
64KB

Download
memory/4352-610-0x0000000005A30000-0x0000000005A40000-memory.dmp

Filesize
64KB

Download
memory/4352-611-0x0000000005A30000-0x0000000005A40000-memory.dmp

Filesize
64KB

Download
memory/4352-612-0x0000000002960000-0x0000000002970000-memory.dmp

Filesize
64KB

Download
memory/4352-613-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4352-614-0x00000000068C0000-0x00000000068D0000-memory.dmp

Filesize
64KB

Download
memory/4352-615-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4352-616-0x00000000068C0000-0x00000000068D0000-memory.dmp

Filesize
64KB

Download
memory/4352-617-0x0000000005990000-0x00000000059A0000-memory.dmp

Filesize
64KB

Download
memory/4352-618-0x0000000002960000-0x0000000002970000-memory.dmp

Filesize
64KB

Download
memory/4352-619-0x00000000059A0000-0x00000000059B0000-memory.dmp

Filesize
64KB

Download
memory/4352-620-0x00000000059A0000-0x00000000059B0000-memory.dmp

Filesize
64KB

Download
memory/4352-621-0x0000000002960000-0x0000000002970000-memory.dmp

Filesize
64KB

Download
memory/4352-622-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4352-624-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4352-623-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/4352-626-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4352-625-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/4352-627-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/4352-628-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/4352-630-0x0000000005970000-0x0000000005980000-memory.dmp

Filesize
64KB

Download
memory/4352-629-0x0000000005970000-0x0000000005980000-memory.dmp

Filesize
64KB

Download
memory/4352-633-0x0000000005A10000-0x0000000005A20000-memory.dmp

Filesize
64KB

Download
memory/4352-635-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4352-634-0x0000000002960000-0x0000000002970000-memory.dmp

Filesize
64KB

Download
memory/4352-637-0x0000000005A20000-0x0000000005A30000-memory.dmp

Filesize
64KB

Download
memory/4352-636-0x0000000005A20000-0x0000000005A30000-memory.dmp

Filesize
64KB

Download
memory/4352-638-0x0000000005A20000-0x0000000005A30000-memory.dmp

Filesize
64KB

Download
memory/4352-639-0x0000000005A20000-0x0000000005A30000-memory.dmp

Filesize
64KB

Download
memory/4352-640-0x0000000002990000-0x00000000029A0000-memory.dmp

Filesize
64KB

Download
memory/4352-641-0x00000000059D0000-0x00000000059E0000-memory.dmp

Filesize
64KB

Download
memory/4352-642-0x0000000007E20000-0x0000000007E30000-memory.dmp

Filesize
64KB

Download
memory/4352-643-0x0000000005A30000-0x0000000005A40000-memory.dmp

Filesize
64KB

Download
memory/4352-644-0x00000000068C0000-0x00000000068D0000-memory.dmp

Filesize
64KB

Download
memory/4352-241-0x0000000000000000-mapping.dmp

Download
memory/4832-166-0x0000000000000000-mapping.dmp

Download
memory/4904-907-0x0000000000000000-mapping.dmp

Download
memory/4956-240-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads