0ef148055e86c1f926d15787a95c08528a2d786ba5954cbcd2ac02837cf0ebda

Resubmissions

24-04-2023 12:34

230424-pr1wwsbg72 10

24-04-2023 12:28

230424-pnbsladd6y 10

Analysis

max time kernel
138s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2023 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ef148055e86c1f926d15787a95c08528a2d786ba5954cbcd2ac02837cf0ebda.one
Size

2.8MB
MD5

cbe556164d8ee03c93fa5db83fa4dbcf
SHA1

91f785f85880003c81cd210c23199615d5e0a678
SHA256

0ef148055e86c1f926d15787a95c08528a2d786ba5954cbcd2ac02837cf0ebda
SHA512

88229b3a9bf8085be0e7ec4948907b92916cfee46d4abeb6637dc39571871bf7dee49f2be8e378dc802f7e35d317e6471d599962000ebff35cb4f7a7c5923a8b
SSDEEP

49152:yrFGOOTLCTFQq5iNZ4hS5WPvwaqB/nREYVoB5JSHawNxx:drTLmTpc/nREYKd8

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE is not expected to spawn this process	3492	100	msiexec.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	1932	rundll32.exe	102

Blocklisted process makes network request 6 IoCs

flow	pid	Process
60	524	WScript.exe
62	524	WScript.exe
64	524	WScript.exe
66	524	WScript.exe
71	4972	powershell.exe
73	4972	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	aipackagechainer.exe

Executes dropped EXE 1 IoCs

pid	Process
2952	aipackagechainer.exe

Loads dropped DLL 7 IoCs

pid	Process
4652	MsiExec.exe
4652	MsiExec.exe
4652	MsiExec.exe
4652	MsiExec.exe
4652	MsiExec.exe
4652	MsiExec.exe
4652	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI49B6.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5651.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58487e.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4ED9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5031.tmp	msiexec.exe
File created	C:\Windows\Installer\e584881.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI55B4.tmp	msiexec.exe
File created	C:\Windows\Installer\e58487e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4DBE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI51E8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI545B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI52B4.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6F2B0DF6-4010-4F62-BA54-CAFC72ACC942}	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000206f4107d723b55a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000206f41070000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900206f4107000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000206f410700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000206f410700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ONENOTE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ONENOTE.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	ONENOTE.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	aipackagechainer.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
100	ONENOTE.EXE
100	ONENOTE.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
100	ONENOTE.EXE
100	ONENOTE.EXE
3296	msiexec.exe
3296	msiexec.exe
4972	powershell.exe
4972	powershell.exe
3380	powershell.exe
3380	powershell.exe
1488	powershell.exe
1488	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3492	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3492	msiexec.exe
Token: SeSecurityPrivilege	3296	msiexec.exe
Token: SeCreateTokenPrivilege	3492	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3492	msiexec.exe
Token: SeLockMemoryPrivilege	3492	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3492	msiexec.exe
Token: SeMachineAccountPrivilege	3492	msiexec.exe
Token: SeTcbPrivilege	3492	msiexec.exe
Token: SeSecurityPrivilege	3492	msiexec.exe
Token: SeTakeOwnershipPrivilege	3492	msiexec.exe
Token: SeLoadDriverPrivilege	3492	msiexec.exe
Token: SeSystemProfilePrivilege	3492	msiexec.exe
Token: SeSystemtimePrivilege	3492	msiexec.exe
Token: SeProfSingleProcessPrivilege	3492	msiexec.exe
Token: SeIncBasePriorityPrivilege	3492	msiexec.exe
Token: SeCreatePagefilePrivilege	3492	msiexec.exe
Token: SeCreatePermanentPrivilege	3492	msiexec.exe
Token: SeBackupPrivilege	3492	msiexec.exe
Token: SeRestorePrivilege	3492	msiexec.exe
Token: SeShutdownPrivilege	3492	msiexec.exe
Token: SeDebugPrivilege	3492	msiexec.exe
Token: SeAuditPrivilege	3492	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3492	msiexec.exe
Token: SeChangeNotifyPrivilege	3492	msiexec.exe
Token: SeRemoteShutdownPrivilege	3492	msiexec.exe
Token: SeUndockPrivilege	3492	msiexec.exe
Token: SeSyncAgentPrivilege	3492	msiexec.exe
Token: SeEnableDelegationPrivilege	3492	msiexec.exe
Token: SeManageVolumePrivilege	3492	msiexec.exe
Token: SeImpersonatePrivilege	3492	msiexec.exe
Token: SeCreateGlobalPrivilege	3492	msiexec.exe
Token: SeBackupPrivilege	3320	vssvc.exe
Token: SeRestorePrivilege	3320	vssvc.exe
Token: SeAuditPrivilege	3320	vssvc.exe
Token: SeBackupPrivilege	3296	msiexec.exe
Token: SeRestorePrivilege	3296	msiexec.exe
Token: SeRestorePrivilege	3296	msiexec.exe
Token: SeTakeOwnershipPrivilege	3296	msiexec.exe
Token: SeRestorePrivilege	3296	msiexec.exe
Token: SeTakeOwnershipPrivilege	3296	msiexec.exe
Token: SeRestorePrivilege	3296	msiexec.exe
Token: SeTakeOwnershipPrivilege	3296	msiexec.exe
Token: SeRestorePrivilege	3296	msiexec.exe
Token: SeTakeOwnershipPrivilege	3296	msiexec.exe
Token: SeRestorePrivilege	3296	msiexec.exe
Token: SeTakeOwnershipPrivilege	3296	msiexec.exe
Token: SeRestorePrivilege	3296	msiexec.exe
Token: SeTakeOwnershipPrivilege	3296	msiexec.exe
Token: SeRestorePrivilege	3296	msiexec.exe
Token: SeTakeOwnershipPrivilege	3296	msiexec.exe
Token: SeRestorePrivilege	3296	msiexec.exe
Token: SeTakeOwnershipPrivilege	3296	msiexec.exe
Token: SeRestorePrivilege	3296	msiexec.exe
Token: SeTakeOwnershipPrivilege	3296	msiexec.exe
Token: SeRestorePrivilege	3296	msiexec.exe
Token: SeTakeOwnershipPrivilege	3296	msiexec.exe
Token: SeRestorePrivilege	3296	msiexec.exe
Token: SeTakeOwnershipPrivilege	3296	msiexec.exe
Token: SeRestorePrivilege	3296	msiexec.exe
Token: SeTakeOwnershipPrivilege	3296	msiexec.exe
Token: SeRestorePrivilege	3296	msiexec.exe
Token: SeTakeOwnershipPrivilege	3296	msiexec.exe
Token: SeRestorePrivilege	3296	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3492	msiexec.exe
3492	msiexec.exe
2952	aipackagechainer.exe
2952	aipackagechainer.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
100	ONENOTE.EXE
100	ONENOTE.EXE
100	ONENOTE.EXE
100	ONENOTE.EXE
100	ONENOTE.EXE
100	ONENOTE.EXE
100	ONENOTE.EXE
100	ONENOTE.EXE
100	ONENOTE.EXE
100	ONENOTE.EXE
100	ONENOTE.EXE
100	ONENOTE.EXE
100	ONENOTE.EXE
100	ONENOTE.EXE
100	ONENOTE.EXE
100	ONENOTE.EXE
100	ONENOTE.EXE
100	ONENOTE.EXE
100	ONENOTE.EXE
100	ONENOTE.EXE

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 100 wrote to memory of 3492	100	ONENOTE.EXE	84
PID 100 wrote to memory of 3492	100	ONENOTE.EXE	84
PID 3296 wrote to memory of 364	3296	msiexec.exe	97
PID 3296 wrote to memory of 364	3296	msiexec.exe	97
PID 3296 wrote to memory of 4652	3296	msiexec.exe	99
PID 3296 wrote to memory of 4652	3296	msiexec.exe	99
PID 3296 wrote to memory of 4652	3296	msiexec.exe	99
PID 3296 wrote to memory of 2952	3296	msiexec.exe	100
PID 3296 wrote to memory of 2952	3296	msiexec.exe	100
PID 3296 wrote to memory of 2952	3296	msiexec.exe	100
PID 2952 wrote to memory of 524	2952	aipackagechainer.exe	101
PID 2952 wrote to memory of 524	2952	aipackagechainer.exe	101
PID 2952 wrote to memory of 524	2952	aipackagechainer.exe	101
PID 2952 wrote to memory of 4972	2952	aipackagechainer.exe	104
PID 2952 wrote to memory of 4972	2952	aipackagechainer.exe	104
PID 2952 wrote to memory of 4972	2952	aipackagechainer.exe	104
PID 4972 wrote to memory of 3380	4972	powershell.exe	106
PID 4972 wrote to memory of 3380	4972	powershell.exe	106
PID 4972 wrote to memory of 3380	4972	powershell.exe	106
PID 4972 wrote to memory of 1488	4972	powershell.exe	108
PID 4972 wrote to memory of 1488	4972	powershell.exe	108
PID 4972 wrote to memory of 1488	4972	powershell.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE
"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "C:\Users\Admin\AppData\Local\Temp\0ef148055e86c1f926d15787a95c08528a2d786ba5954cbcd2ac02837cf0ebda.one"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:100
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{5C5AAFA8-7052-4FBC-A10A-703971BD4426}\NT\0\2.msi"
  2⤵
  - Process spawned unexpected child process
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3492

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:364
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 42A89516B92CA8CE4290421EF41828B8
  2⤵
  - Loads dropped DLL
  PID:4652
- C:\Users\Admin\AppData\Roaming\Azure\Microsoft Azure\prerequisites\aipackagechainer.exe
  "C:\Users\Admin\AppData\Roaming\Azure\Microsoft Azure\prerequisites\aipackagechainer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Azure\Microsoft Azure\prerequisites\1\563860.wsf"
    3⤵
    - Blocklisted process makes network request
    PID:524
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -NoLogo -ExecutionPolicy RemoteSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_A544.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Azure\Microsoft Azure\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Azure\Microsoft Azure\prerequisites\aipackagechainer.exe' -retry_count 10"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3380
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1488

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\ProgramData\aq2B7wGiC3vzSE9.tmp,Motd
1⤵
- Process spawned unexpected child process
PID:2164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e584880.rbs

Filesize
9KB

MD5
b96bec2578050a5675e8c17c528cda5d

SHA1
8fdc755606aa1f92931792e14d5b73b89d19e475

SHA256
6707b35adb2d0c28208f6aac7264bf9921b7cb545636cb0a25088c2ecc4a4613

SHA512
af25c791df03c2dbba8db91f3c66d8b38c3b37040c8a4044e2398b5382ab4d9d91de8ac94f3b4c339776fd0c6c5ec00cc9b4af49604b3ce0551e285c367efea5

Download Submit
C:\Config.Msi\e584882.rbs

Filesize
392B

MD5
fd647ce5883f335cbe3ba298f0ad8bc0

SHA1
5bda096067b73172a43db0815854463909a89302

SHA256
0962a5d75cb66496bffe6746df74f2d8ff1c0ba6f3bffd5d691274fbc2be2f27

SHA512
fcbcc2afd9f59dc3705a70b1c5b459e0952354ce494138019a57b871fc3c8c578bc63c62078534bc043559b6144a92ee67cb1968007fe89c49ecd45547e2b0c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BL.bin

Filesize
70KB

MD5
b5bb2cede3bcf84d1eb9fa003e18097e

SHA1
6090bc9594d7ac8fc0430e55bd963f704946c10f

SHA256
33cf7f76de3c18dae7d6c9aff7aff3f394151ef55812b68c2152fb2e7921720a

SHA512
f38eafa198cffb9dd4c349d11f659ccf0222ac7cf86715f3b74a79ce31c0ae360620e35d40c8453775d7cd22ac4ebff11cc1a2c8203286f6308e915090a5d97c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BM.bin

Filesize
276B

MD5
c1dfd596b0bfc3ffd047d155ccf3b5b3

SHA1
d17e4dab7fa5f7e241dbadab4273a37b9478768a

SHA256
04a5e1fdb2e82b9346254eaa2cf5201308948a0c1f7be997791011e8999108e0

SHA512
65763868fe78d55bd4a1da79143e5cc6262bae79937d2f2a73b83b61509dbc0e38f43dee34732f8263f6d793823ec2310aec92e48871aed4caa2a443381d055c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BN.bin

Filesize
1KB

MD5
df42de22f39ea1917a34e802b16af206

SHA1
291993e10df2db8585729e11ffad7c719cb087cc

SHA256
c062af67778bb2b7893e871b16898014a907ba82fb3e3765fb954ab217775c89

SHA512
c6bc8f3857411b57506431928b4c4eb52ed6a20c3af271ee5889a2e89deb25111c497b5ef60475145feb929d23fda9fa716284fbde233f6f34e2f9bc33869dd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BO.bin

Filesize
4KB

MD5
8aad8a45f3aa9a41a09e5da3ebccca11

SHA1
07164513df37f6e0f1ac471e7947976d4cac70d9

SHA256
e578e4bb5726e5d0d3542c986ded781384489b842a0b71f33e0cd27a51e54956

SHA512
bacda28d229a81f54dd4bdd8b62597196cd949875a675a10696e413719ab4e5e16ada9d28b9b125d64dda06c0702c6df4cc4ff3ea15e8b66582d3d190bcfa397

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BP.bin

Filesize
2.7MB

MD5
8056b3bafd82ce7e6156f1b3f314db52

SHA1
f9d8c441676c2360ea849f4312cd3d7da0686011

SHA256
0f5c4c0240eea04d4b1f688eee6256eb9b089c1fc03938c6d06345b7532b0669

SHA512
dde4b0ea96ed2034d4620e4325d89e5d728b873316bb0ce7084cb778ae043b78a8b8c03fe4f32813079ea42be627881f48b53bb45177d53c2aadb784e3cf3e2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_A544.ps1

Filesize
22KB

MD5
e1031ce77dde7a368159a9dd0ed7e6d4

SHA1
916b6d3ce889af580ede3042312b2b3b90b22ba7

SHA256
35fb99c59c455149681bf4f4ee45db416d45488a7451ac353b0758ab5793d0dc

SHA512
b1b873c1b38fd60c80a352174ee62de966d816c7b9fecb74994dbfdf7a2b0963ff823330385114208a70e41ce3296c766777fa8832b5163a5ae689e4823787e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{5C5AAFA8-7052-4FBC-A10A-703971BD4426}\NT\0\2.msi

Filesize
2.7MB

MD5
8056b3bafd82ce7e6156f1b3f314db52

SHA1
f9d8c441676c2360ea849f4312cd3d7da0686011

SHA256
0f5c4c0240eea04d4b1f688eee6256eb9b089c1fc03938c6d06345b7532b0669

SHA512
dde4b0ea96ed2034d4620e4325d89e5d728b873316bb0ce7084cb778ae043b78a8b8c03fe4f32813079ea42be627881f48b53bb45177d53c2aadb784e3cf3e2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xqlg00we.v1p.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Azure\Microsoft Azure\prerequisites\1\563860.wsf

Filesize
96KB

MD5
0492757c18615434d0b0917b5f16a6ae

SHA1
262c27cd5d90e883b90e946d4eb705fee2f97a27

SHA256
776155b193d0469f75042fbf67611c79fa2fe742f5e5a2d4e4304ddc2c002f66

SHA512
172e476d851d9fa9677a5f106e8078af32f8cc8badf416f060c4446fa20c717ee8624503440c361f5550172fefa8adc080f229441652c190d76a1f3866a01e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Azure\Microsoft Azure\prerequisites\aipackagechainer.exe

Filesize
871KB

MD5
9c56fa0aafd93cab6bd9c1d81353cc92

SHA1
0beef69d227a90a980e7583b0e0d17520826add6

SHA256
0861d3f77cecd494022492c36106ac9383bac27e29942191acf80f900ea9b2b5

SHA512
4be2734474b29c8f8a51073eaf3d2eef9bcb1f29bfa52289455f5e88d5643c421607adc4fe68b714e5af2dda6d23f2413520b8166388a75e82a0e45230ed4dd6

Download Submit
C:\Users\Admin\AppData\Roaming\Azure\Microsoft Azure\prerequisites\aipackagechainer.exe

Filesize
871KB

MD5
9c56fa0aafd93cab6bd9c1d81353cc92

SHA1
0beef69d227a90a980e7583b0e0d17520826add6

SHA256
0861d3f77cecd494022492c36106ac9383bac27e29942191acf80f900ea9b2b5

SHA512
4be2734474b29c8f8a51073eaf3d2eef9bcb1f29bfa52289455f5e88d5643c421607adc4fe68b714e5af2dda6d23f2413520b8166388a75e82a0e45230ed4dd6

Download Submit
C:\Users\Admin\AppData\Roaming\Azure\Microsoft Azure\prerequisites\aipackagechainer.ini

Filesize
1KB

MD5
a4ecab5546820cac580455f33c2f6bbc

SHA1
741abfa642ce40bc14e7ede5768871c8e8749f38

SHA256
7cf706b728d123d230db64bb307897a9fade30d86cfc44530fd23744fc0ad867

SHA512
3b165a326df95ccee0c843af98d66c37bd18299cae4c7028ec3863011617563e6f192ba5888e69a0c6fd47c83693a6178ff2c84dd9c1e9c94f2969ae197b88d3

Download Submit
C:\Users\Admin\AppData\Roaming\Azure\Microsoft Azure\prerequisites\file_deleter.ps1

Filesize
22KB

MD5
e1031ce77dde7a368159a9dd0ed7e6d4

SHA1
916b6d3ce889af580ede3042312b2b3b90b22ba7

SHA256
35fb99c59c455149681bf4f4ee45db416d45488a7451ac353b0758ab5793d0dc

SHA512
b1b873c1b38fd60c80a352174ee62de966d816c7b9fecb74994dbfdf7a2b0963ff823330385114208a70e41ce3296c766777fa8832b5163a5ae689e4823787e9

Download Submit
C:\Windows\Installer\MSI49B6.tmp

Filesize
584KB

MD5
8e565fd81ca10a65cc02e7901a78c95b

SHA1
1bca3979c233321ae527d4508cfe9b3ba825dbd3

SHA256
7b64112c2c534203bb59ce1a9b7d5390448c045dda424fb3cfd5878edb262016

SHA512
144bde89eba469b32b59f30e7f4d451329c541ed7b556bc60d118c9e2e5cdf148c2275cca51c4b9355686aefa16a4b86a26d4c8fe0dd2cf318b979863109592e

Download Submit
C:\Windows\Installer\MSI49B6.tmp

Filesize
584KB

MD5
8e565fd81ca10a65cc02e7901a78c95b

SHA1
1bca3979c233321ae527d4508cfe9b3ba825dbd3

SHA256
7b64112c2c534203bb59ce1a9b7d5390448c045dda424fb3cfd5878edb262016

SHA512
144bde89eba469b32b59f30e7f4d451329c541ed7b556bc60d118c9e2e5cdf148c2275cca51c4b9355686aefa16a4b86a26d4c8fe0dd2cf318b979863109592e

Download Submit
C:\Windows\Installer\MSI4DBE.tmp

Filesize
584KB

MD5
8e565fd81ca10a65cc02e7901a78c95b

SHA1
1bca3979c233321ae527d4508cfe9b3ba825dbd3

SHA256
7b64112c2c534203bb59ce1a9b7d5390448c045dda424fb3cfd5878edb262016

SHA512
144bde89eba469b32b59f30e7f4d451329c541ed7b556bc60d118c9e2e5cdf148c2275cca51c4b9355686aefa16a4b86a26d4c8fe0dd2cf318b979863109592e

Download Submit
C:\Windows\Installer\MSI4DBE.tmp

Filesize
584KB

MD5
8e565fd81ca10a65cc02e7901a78c95b

SHA1
1bca3979c233321ae527d4508cfe9b3ba825dbd3

SHA256
7b64112c2c534203bb59ce1a9b7d5390448c045dda424fb3cfd5878edb262016

SHA512
144bde89eba469b32b59f30e7f4d451329c541ed7b556bc60d118c9e2e5cdf148c2275cca51c4b9355686aefa16a4b86a26d4c8fe0dd2cf318b979863109592e

Download Submit
C:\Windows\Installer\MSI4ED9.tmp

Filesize
584KB

MD5
8e565fd81ca10a65cc02e7901a78c95b

SHA1
1bca3979c233321ae527d4508cfe9b3ba825dbd3

SHA256
7b64112c2c534203bb59ce1a9b7d5390448c045dda424fb3cfd5878edb262016

SHA512
144bde89eba469b32b59f30e7f4d451329c541ed7b556bc60d118c9e2e5cdf148c2275cca51c4b9355686aefa16a4b86a26d4c8fe0dd2cf318b979863109592e

Download Submit
C:\Windows\Installer\MSI4ED9.tmp

Filesize
584KB

MD5
8e565fd81ca10a65cc02e7901a78c95b

SHA1
1bca3979c233321ae527d4508cfe9b3ba825dbd3

SHA256
7b64112c2c534203bb59ce1a9b7d5390448c045dda424fb3cfd5878edb262016

SHA512
144bde89eba469b32b59f30e7f4d451329c541ed7b556bc60d118c9e2e5cdf148c2275cca51c4b9355686aefa16a4b86a26d4c8fe0dd2cf318b979863109592e

Download Submit
C:\Windows\Installer\MSI4ED9.tmp

Filesize
584KB

MD5
8e565fd81ca10a65cc02e7901a78c95b

SHA1
1bca3979c233321ae527d4508cfe9b3ba825dbd3

SHA256
7b64112c2c534203bb59ce1a9b7d5390448c045dda424fb3cfd5878edb262016

SHA512
144bde89eba469b32b59f30e7f4d451329c541ed7b556bc60d118c9e2e5cdf148c2275cca51c4b9355686aefa16a4b86a26d4c8fe0dd2cf318b979863109592e

Download Submit
C:\Windows\Installer\MSI5031.tmp

Filesize
584KB

MD5
8e565fd81ca10a65cc02e7901a78c95b

SHA1
1bca3979c233321ae527d4508cfe9b3ba825dbd3

SHA256
7b64112c2c534203bb59ce1a9b7d5390448c045dda424fb3cfd5878edb262016

SHA512
144bde89eba469b32b59f30e7f4d451329c541ed7b556bc60d118c9e2e5cdf148c2275cca51c4b9355686aefa16a4b86a26d4c8fe0dd2cf318b979863109592e

Download Submit
C:\Windows\Installer\MSI5031.tmp

Filesize
584KB

MD5
8e565fd81ca10a65cc02e7901a78c95b

SHA1
1bca3979c233321ae527d4508cfe9b3ba825dbd3

SHA256
7b64112c2c534203bb59ce1a9b7d5390448c045dda424fb3cfd5878edb262016

SHA512
144bde89eba469b32b59f30e7f4d451329c541ed7b556bc60d118c9e2e5cdf148c2275cca51c4b9355686aefa16a4b86a26d4c8fe0dd2cf318b979863109592e

Download Submit
C:\Windows\Installer\MSI51E8.tmp

Filesize
584KB

MD5
8e565fd81ca10a65cc02e7901a78c95b

SHA1
1bca3979c233321ae527d4508cfe9b3ba825dbd3

SHA256
7b64112c2c534203bb59ce1a9b7d5390448c045dda424fb3cfd5878edb262016

SHA512
144bde89eba469b32b59f30e7f4d451329c541ed7b556bc60d118c9e2e5cdf148c2275cca51c4b9355686aefa16a4b86a26d4c8fe0dd2cf318b979863109592e

Download Submit
C:\Windows\Installer\MSI51E8.tmp

Filesize
584KB

MD5
8e565fd81ca10a65cc02e7901a78c95b

SHA1
1bca3979c233321ae527d4508cfe9b3ba825dbd3

SHA256
7b64112c2c534203bb59ce1a9b7d5390448c045dda424fb3cfd5878edb262016

SHA512
144bde89eba469b32b59f30e7f4d451329c541ed7b556bc60d118c9e2e5cdf148c2275cca51c4b9355686aefa16a4b86a26d4c8fe0dd2cf318b979863109592e

Download Submit
C:\Windows\Installer\MSI52B4.tmp

Filesize
709KB

MD5
130a4e28b3349aff8a444f6fcebbac91

SHA1
fee5efe0a1b9aea337e607f417bb091c3017537b

SHA256
750bf3e65d692ff255620c5b8d7c951d93d3deb65586ebb5a3e3b7ba2de10e39

SHA512
1564306e22db0000a78076e6811f0e4f9ca31c7fea95e1070a6ce422c408863810a2f55376b8db1aec2512e23d926d5d61ac280d4babc31c52dd645440ef510a

Download Submit
C:\Windows\Installer\MSI52B4.tmp

Filesize
709KB

MD5
130a4e28b3349aff8a444f6fcebbac91

SHA1
fee5efe0a1b9aea337e607f417bb091c3017537b

SHA256
750bf3e65d692ff255620c5b8d7c951d93d3deb65586ebb5a3e3b7ba2de10e39

SHA512
1564306e22db0000a78076e6811f0e4f9ca31c7fea95e1070a6ce422c408863810a2f55376b8db1aec2512e23d926d5d61ac280d4babc31c52dd645440ef510a

Download Submit
C:\Windows\Installer\MSI55B4.tmp

Filesize
709KB

MD5
130a4e28b3349aff8a444f6fcebbac91

SHA1
fee5efe0a1b9aea337e607f417bb091c3017537b

SHA256
750bf3e65d692ff255620c5b8d7c951d93d3deb65586ebb5a3e3b7ba2de10e39

SHA512
1564306e22db0000a78076e6811f0e4f9ca31c7fea95e1070a6ce422c408863810a2f55376b8db1aec2512e23d926d5d61ac280d4babc31c52dd645440ef510a

Download Submit
C:\Windows\Installer\MSI55B4.tmp

Filesize
709KB

MD5
130a4e28b3349aff8a444f6fcebbac91

SHA1
fee5efe0a1b9aea337e607f417bb091c3017537b

SHA256
750bf3e65d692ff255620c5b8d7c951d93d3deb65586ebb5a3e3b7ba2de10e39

SHA512
1564306e22db0000a78076e6811f0e4f9ca31c7fea95e1070a6ce422c408863810a2f55376b8db1aec2512e23d926d5d61ac280d4babc31c52dd645440ef510a

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
5de42f5d6012b675c5999d5d27e2633c

SHA1
851dbb2c0dd637609fdb1f7417691b4a072727e4

SHA256
e4b6ae2ac8f2869b9eb534f5b3a1fcb802f4e7d086a68727eda048e6b551343f

SHA512
97fa9c653e830f5d5d6ad2e6798cdefddfa5bbc823745c99875ed52443ea8f844d6b362a38a4d445b62104251395ef382c64115ff0baa32b521d8764a62d8079

Download Submit
\??\Volume{07416f20-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2702e784-b507-45d9-b3e4-e9053dd4a4ca}_OnDiskSnapshotProp

Filesize
5KB

MD5
38ecfc7ad4c65115c1b3f7e6df250adc

SHA1
587ab863c9a6c3d29ac03c492640ce27ca6898f9

SHA256
93c96c1cb7d44d0e9f7174c417e559a3d1cac3d0b3a1cbac7699a5b45ac06975

SHA512
923e043b7dd47ada0dbbab5b9046a3f5f6bd69805368922b2181d1463623d840afed15876abaa9d417b5d68b6243a3495b18c31ce31d6528afcdd6c1803ea7e8

Download Submit
memory/100-133-0x00007FFE8C950000-0x00007FFE8C960000-memory.dmp

Filesize
64KB

Download
memory/100-138-0x00007FFE8A8F0000-0x00007FFE8A900000-memory.dmp

Filesize
64KB

Download
memory/100-140-0x00007FFE8A8F0000-0x00007FFE8A900000-memory.dmp

Filesize
64KB

Download
memory/100-137-0x00007FFE8C950000-0x00007FFE8C960000-memory.dmp

Filesize
64KB

Download
memory/100-135-0x00007FFE8C950000-0x00007FFE8C960000-memory.dmp

Filesize
64KB

Download
memory/100-136-0x00007FFE8C950000-0x00007FFE8C960000-memory.dmp

Filesize
64KB

Download
memory/100-134-0x00007FFE8C950000-0x00007FFE8C960000-memory.dmp

Filesize
64KB

Download
memory/1488-373-0x0000000007000000-0x00000000075A4000-memory.dmp

Filesize
5.6MB

Download
memory/1488-372-0x00000000068D0000-0x00000000068F2000-memory.dmp

Filesize
136KB

Download
memory/1488-371-0x0000000006860000-0x000000000687A000-memory.dmp

Filesize
104KB

Download
memory/1488-367-0x00000000027E0000-0x00000000027F0000-memory.dmp

Filesize
64KB

Download
memory/1488-356-0x00000000027E0000-0x00000000027F0000-memory.dmp

Filesize
64KB

Download
memory/3380-355-0x0000000002810000-0x0000000002820000-memory.dmp

Filesize
64KB

Download
memory/3380-354-0x0000000002810000-0x0000000002820000-memory.dmp

Filesize
64KB

Download
memory/3380-370-0x00000000066E0000-0x0000000006776000-memory.dmp

Filesize
600KB

Download
memory/3380-353-0x0000000002810000-0x0000000002820000-memory.dmp

Filesize
64KB

Download
memory/4972-366-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/4972-319-0x0000000005FA0000-0x0000000006006000-memory.dmp

Filesize
408KB

Download
memory/4972-316-0x0000000005F30000-0x0000000005F96000-memory.dmp

Filesize
408KB

Download
memory/4972-327-0x0000000006500000-0x000000000651E000-memory.dmp

Filesize
120KB

Download
memory/4972-314-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/4972-368-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/4972-369-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/4972-343-0x0000000006B30000-0x0000000006B5C000-memory.dmp

Filesize
176KB

Download
memory/4972-315-0x0000000005620000-0x0000000005642000-memory.dmp

Filesize
136KB

Download
memory/4972-313-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/4972-312-0x0000000005760000-0x0000000005D88000-memory.dmp

Filesize
6.2MB

Download
memory/4972-311-0x0000000005030000-0x0000000005066000-memory.dmp

Filesize
216KB

Download