9f1eb0a100615cdda44a13f434627f8978d133ca4ef4a002809f95dcc8d24ff6

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2023 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

onedriveupdater.exe
Size

4.0MB
MD5

792e95b64b9cf45ac8bc10d4d0f077c2
SHA1

e50af7ee7e0a323d8aa60b6d9b3d39ab33b004f5
SHA256

60e64dd2c6d2ac6fe9b498fadac81bc34a725de5d893e7df8b2728d8dc5b192d
SHA512

5064c1a64fa0bd5a31b205d8b34cb85cc3da7091dd2412421f6394d42b9a596430b67ea4d05129912ad942458198280a3a69409388d2413072c53d928de70e86
SSDEEP

49152:3EenBpKLBz+dV0LWUEur5XVmy1rVaou58gZbkT3FjNVcXrkj6B+/T+k54Q1Wb:6VlH0MAQj8k5d18

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	onedriveupdater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	OneDriveSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe

Executes dropped EXE 19 IoCs

pid	Process
2140	OneDriveSetup.exe
2960	OneDriveSetup.exe
1208	FileSyncConfig.exe
1312	OneDriveStandaloneUpdater.exe
4240	Microsoft.SharePoint.exe
424	MicrosoftEdgeWebview2Setup.exe
4424	MicrosoftEdgeUpdate.exe
4824	MicrosoftEdgeUpdate.exe
1064	MicrosoftEdgeUpdate.exe
1620	MicrosoftEdgeUpdateComRegisterShell64.exe
4648	MicrosoftEdgeUpdateComRegisterShell64.exe
3636	MicrosoftEdgeUpdateComRegisterShell64.exe
3436	MicrosoftEdgeUpdate.exe
4620	MicrosoftEdgeUpdate.exe
4112	MicrosoftEdgeUpdate.exe
1460	MicrosoftEdgeUpdate.exe
3492	MicrosoftEdge_X64_114.0.1823.51.exe
4780	setup.exe
5632	MicrosoftEdgeUpdate.exe

Loads dropped DLL 46 IoCs

pid	Process
1208	FileSyncConfig.exe
1208	FileSyncConfig.exe
1208	FileSyncConfig.exe
1208	FileSyncConfig.exe
1208	FileSyncConfig.exe
1208	FileSyncConfig.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4240	Microsoft.SharePoint.exe
4424	MicrosoftEdgeUpdate.exe
4824	MicrosoftEdgeUpdate.exe
1064	MicrosoftEdgeUpdate.exe
1620	MicrosoftEdgeUpdateComRegisterShell64.exe
1064	MicrosoftEdgeUpdate.exe
4648	MicrosoftEdgeUpdateComRegisterShell64.exe
1064	MicrosoftEdgeUpdate.exe
3636	MicrosoftEdgeUpdateComRegisterShell64.exe
1064	MicrosoftEdgeUpdate.exe
3436	MicrosoftEdgeUpdate.exe
4620	MicrosoftEdgeUpdate.exe
4112	MicrosoftEdgeUpdate.exe
4112	MicrosoftEdgeUpdate.exe
4620	MicrosoftEdgeUpdate.exe
1460	MicrosoftEdgeUpdate.exe
5632	MicrosoftEdgeUpdate.exe

Modifies system executable filetype association 2 TTPs 3 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\INPROCSERVER32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\WOW6432NODE\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\LOCALSERVER32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\23.107.0521.0001\\i386\\FileSyncShell.dll"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\CLSID\{0827D883-485C-4D62-BA2C-A332DBF3D4B0}\LocalServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\23.107.0521.0001\\FileSyncShell64.dll"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\23.107.0521.0001\\FileCoAuth.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\WOW6432NODE\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LOCALSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /cci /client=Personal"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{07CA83F0-DF06-4E67-89DD-E80924A49512}\LocalServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LOCALSERVER32	OneDriveSetup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\23.107.0521.0001\\FileCoAuth.exe\""	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\LocalServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.29\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\WOW6432NODE\CLSID\{2E7C0A19-0438-41E9-81E3-3AD3D64F55BA}\LOCALSERVER32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\WOW6432NODE\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\INPROCSERVER32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\WOW6432NODE\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\INPROCSERVER32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LOCALSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\23.107.0521.0001\\i386\\FileSyncShell.dll"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\LocalServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\WOW6432NODE\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LOCALSERVER32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LOCALSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\WOW6432NODE\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\INPROCSERVER32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\WOW6432NODE\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\INPROCSERVER32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\WOW6432NODE\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\INPROCSERVER32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\23.107.0521.0001\\Microsoft.SharePoint.exe\""	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\INPROCSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85503227-BB57-4913-BD2D-B3D43F5C03B6}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.29\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85503227-BB57-4913-BD2D-B3D43F5C03B6}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.29\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\INPROCSERVER32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{0827D883-485C-4D62-BA2C-A332DBF3D4B0}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\23.107.0521.0001\\FileCoAuth.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32	OneDriveSetup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.29\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\23.107.0521.0001\\FileSyncShell64.dll"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\23.107.0521.0001\\FileSyncShell64.dll"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\23.107.0521.0001\\i386\\FileCoAuthLib.dll"	OneDriveSetup.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\""	OneDriveSetup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 18 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDriveStandaloneUpdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	Microsoft.SharePoint.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	Microsoft.SharePoint.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDriveStandaloneUpdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Locales\ro.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Trust Protection Lists\Sigma\Staging	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\VisualElements\Logo.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\identity_proxy\resources.pri	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6810.tmp\psuser_arm64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6810.tmp\msedgeupdateres_id.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6810.tmp\msedgeupdateres_tr.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Trust Protection Lists\Sigma\Analytics	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Locales\it.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Locales\mr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Locales\sk.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.51\Trust Protection Lists\Mu\Advertising	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6810.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6810.tmp\msedgeupdateres_en.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\msedgewebview2.exe.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\show_third_party_software_licenses.bat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Trust Protection Lists\Mu\CompatExceptions	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\BHO\ie_to_edge_bho.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.51\Locales\mt.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6810.tmp\msedgeupdateres_lo.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Locales\uk.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\vccorlib140.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Locales\pl.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.51\Locales\el.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.51\Locales\sr-Latn-RS.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6810.tmp\psmachine.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Locales\gd.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Locales\da.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source4780_829914528\msedge_7z.data	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.51\Trust Protection Lists\Mu\TransparentAdvertisers	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Locales\cy.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Locales\fr.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Trust Protection Lists\Mu\Social	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\identity_proxy\dev.identity_helper.exe.manifest	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\MEIPreload\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\identity_proxy\win10\identity_helper.Sparse.Canary.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\VisualElements\SmallLogo.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\VisualElements\SmallLogo.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\MEIPreload\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\MEIPreload\preloaded_data.pb	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Locales\fa.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6810.tmp\msedgeupdateres_cs.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6810.tmp\msedgeupdateres_en-GB.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Locales\af.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Locales\pt-BR.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\msedge.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Notifications\SoftLandingAssetLight.gif	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6810.tmp\msedgeupdateres_nb.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Temp\EU6810.tmp\MicrosoftEdgeUpdateSetup.exe	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Locales\pa.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\identity_proxy\win11\identity_helper.Sparse.Internal.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6810.tmp\msedgeupdateres_mi.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\identity_proxy\win10\identity_helper.Sparse.Canary.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\identity_proxy\win10\identity_helper.Sparse.Internal.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.51\Locales\et.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\libEGL.dll	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Locales\hr.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Locales\is.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\prefs_enclave_x64.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.51\Locales\pt-PT.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6810.tmp\msedgeupdateres_fi.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU6810.tmp\msedgeupdateres_pl.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Locales\ar.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Locales\kn.pak	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDriveSetup.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\BANNERNOTIFICATIONHANDLER.BANNERNOTIFICATIONHANDLER\CURVER	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Interface\{2B865677-AC3A-43BD-B9E7-BF6FCD3F0596}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\WOW6432NODE\INTERFACE\{2B865677-AC3A-43BD-B9E7-BF6FCD3F0596}\TYPELIB	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy\CLSID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\ = "IGetSpaceUsedCallback"	OneDriveSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\Interface\{6A821279-AB49-48F8-9A27-F6C59B4FF024}\ = "IOneDriveInfoProvider"	OneDriveSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.29\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\WOW6432NODE\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\LOCALSERVER32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Interface\{0299ECA9-80B6-43C8-A79A-FB1C5F19E7D8}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\TypeLib\{4B1C80DA-FA45-468F-B42B-46496BDBE0C5}\1.0\0	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\Interface\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\TypeLib	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\Interface\{EE15BBBB-9E60-4C52-ABCB-7540FF3DF6B3}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Interface\{B54E7079-90C9-4C62-A6B8-B2834C33A04A}	OneDriveSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\INTERFACE\{5D65DD0D-81BF-4FF4-AEEA-6EFFB445CB3F}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\Interface\{2B865677-AC3A-43BD-B9E7-BF6FCD3F0596}	OneDriveSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\ProgID\ = "MicrosoftEdgeUpdate.CoreClass.1"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\ODOPEN\DEFAULTICON	OneDriveSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\WOW6432NODE\INTERFACE\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\Interface\{B54E7079-90C9-4C62-A6B8-B2834C33A04A}\ = "IGetSpecialFolderInfoCallback"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Directory\Background\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDriveSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\TYPELIB\{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}\1.0\0\WIN32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Interface\{8B9F14F4-9559-4A3F-B7D0-312E992B6D98}\ = "IGetSelectiveSyncInformationCallback"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}	OneDriveSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.29\\MicrosoftEdgeUpdateBroker.exe\""	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85503227-BB57-4913-BD2D-B3D43F5C03B6}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Interface\{9D613F8A-B30E-4938-8490-CB5677701EBF}\ProxyStubClsid32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\mssharepointclient\shell\open\command	OneDriveSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Interface\{2EB31403-EBE0-41EA-AE91-A1953104EA55}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\TypeLib\{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}\1.0	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\Interface\{A87958FF-B414-7748-9183-DBF183A25905}\ = "INucleusNativeMessaging"	OneDriveSetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\WOW6432NODE\INTERFACE\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\TYPELIB	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\BannerNotificationHandler.BannerNotificationHandler.1	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Interface\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\INTERFACE\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\PROXYSTUBCLSID32	OneDriveSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\CurVer\ = "MicrosoftEdgeUpdate.ProcessLauncher.1.0"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\WOW6432NODE\INTERFACE\{AF60000F-661D-472A-9588-F062F6DB7A0E}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\WOW6432NODE\INTERFACE\{1B71F23B-E61F-45C9-83BA-235D55F50CF9}\TYPELIB	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Interface\{A91EFACB-8B83-4B84-B797-1C8CF3AB3DCB}\ProxyStubClsid32\ = "{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\ = "Microsoft Edge Update Legacy On Demand"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_CLASSES\INTERFACE\{B5C25645-7426-433F-8A5F-42B7FF27A7B2}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\WOW6432Node\Interface\{2387C6BD-9A36-41A2-88ED-FF731E529384}	OneDriveSetup.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1188	onedriveupdater.exe
1188	onedriveupdater.exe
1188	onedriveupdater.exe
1188	onedriveupdater.exe
2140	OneDriveSetup.exe
2140	OneDriveSetup.exe
2140	OneDriveSetup.exe
2140	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
2960	OneDriveSetup.exe
4424	MicrosoftEdgeUpdate.exe
4424	MicrosoftEdgeUpdate.exe
4424	MicrosoftEdgeUpdate.exe
4424	MicrosoftEdgeUpdate.exe
4424	MicrosoftEdgeUpdate.exe
4424	MicrosoftEdgeUpdate.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2140	OneDriveSetup.exe
Token: SeIncreaseQuotaPrivilege	2960	OneDriveSetup.exe
Token: SeDebugPrivilege	4424	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	3384	firefox.exe
Token: SeDebugPrivilege	3384	firefox.exe
Token: SeDebugPrivilege	4424	MicrosoftEdgeUpdate.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3384	firefox.exe
3384	firefox.exe
3384	firefox.exe
3384	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3384	firefox.exe
3384	firefox.exe
3384	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3384	firefox.exe
3384	firefox.exe
3384	firefox.exe
3384	firefox.exe
3384	firefox.exe
3384	firefox.exe
3384	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2140	1188	onedriveupdater.exe	83
PID 1188 wrote to memory of 2140	1188	onedriveupdater.exe	83
PID 2960 wrote to memory of 1208	2960	OneDriveSetup.exe	94
PID 2960 wrote to memory of 1208	2960	OneDriveSetup.exe	94
PID 2960 wrote to memory of 1312	2960	OneDriveSetup.exe	96
PID 2960 wrote to memory of 1312	2960	OneDriveSetup.exe	96
PID 1312 wrote to memory of 424	1312	OneDriveStandaloneUpdater.exe	98
PID 1312 wrote to memory of 424	1312	OneDriveStandaloneUpdater.exe	98
PID 1312 wrote to memory of 424	1312	OneDriveStandaloneUpdater.exe	98
PID 424 wrote to memory of 4424	424	MicrosoftEdgeWebview2Setup.exe	100
PID 424 wrote to memory of 4424	424	MicrosoftEdgeWebview2Setup.exe	100
PID 424 wrote to memory of 4424	424	MicrosoftEdgeWebview2Setup.exe	100
PID 4424 wrote to memory of 4824	4424	MicrosoftEdgeUpdate.exe	101
PID 4424 wrote to memory of 4824	4424	MicrosoftEdgeUpdate.exe	101
PID 4424 wrote to memory of 4824	4424	MicrosoftEdgeUpdate.exe	101
PID 4424 wrote to memory of 1064	4424	MicrosoftEdgeUpdate.exe	102
PID 4424 wrote to memory of 1064	4424	MicrosoftEdgeUpdate.exe	102
PID 4424 wrote to memory of 1064	4424	MicrosoftEdgeUpdate.exe	102
PID 1064 wrote to memory of 1620	1064	MicrosoftEdgeUpdate.exe	103
PID 1064 wrote to memory of 1620	1064	MicrosoftEdgeUpdate.exe	103
PID 1064 wrote to memory of 4648	1064	MicrosoftEdgeUpdate.exe	104
PID 1064 wrote to memory of 4648	1064	MicrosoftEdgeUpdate.exe	104
PID 1064 wrote to memory of 3636	1064	MicrosoftEdgeUpdate.exe	105
PID 1064 wrote to memory of 3636	1064	MicrosoftEdgeUpdate.exe	105
PID 4424 wrote to memory of 3436	4424	MicrosoftEdgeUpdate.exe	106
PID 4424 wrote to memory of 3436	4424	MicrosoftEdgeUpdate.exe	106
PID 4424 wrote to memory of 3436	4424	MicrosoftEdgeUpdate.exe	106
PID 4424 wrote to memory of 4620	4424	MicrosoftEdgeUpdate.exe	107
PID 4424 wrote to memory of 4620	4424	MicrosoftEdgeUpdate.exe	107
PID 4424 wrote to memory of 4620	4424	MicrosoftEdgeUpdate.exe	107
PID 4112 wrote to memory of 1460	4112	MicrosoftEdgeUpdate.exe	109
PID 4112 wrote to memory of 1460	4112	MicrosoftEdgeUpdate.exe	109
PID 4112 wrote to memory of 1460	4112	MicrosoftEdgeUpdate.exe	109
PID 4112 wrote to memory of 3492	4112	MicrosoftEdgeUpdate.exe	113
PID 4112 wrote to memory of 3492	4112	MicrosoftEdgeUpdate.exe	113
PID 3492 wrote to memory of 4780	3492	MicrosoftEdge_X64_114.0.1823.51.exe	114
PID 3492 wrote to memory of 4780	3492	MicrosoftEdge_X64_114.0.1823.51.exe	114
PID 4800 wrote to memory of 3384	4800	firefox.exe	116
PID 4800 wrote to memory of 3384	4800	firefox.exe	116
PID 4800 wrote to memory of 3384	4800	firefox.exe	116
PID 4800 wrote to memory of 3384	4800	firefox.exe	116
PID 4800 wrote to memory of 3384	4800	firefox.exe	116
PID 4800 wrote to memory of 3384	4800	firefox.exe	116
PID 4800 wrote to memory of 3384	4800	firefox.exe	116
PID 4800 wrote to memory of 3384	4800	firefox.exe	116
PID 4800 wrote to memory of 3384	4800	firefox.exe	116
PID 4800 wrote to memory of 3384	4800	firefox.exe	116
PID 4800 wrote to memory of 3384	4800	firefox.exe	116
PID 3384 wrote to memory of 1580	3384	firefox.exe	117
PID 3384 wrote to memory of 1580	3384	firefox.exe	117
PID 3384 wrote to memory of 3436	3384	firefox.exe	118
PID 3384 wrote to memory of 3436	3384	firefox.exe	118
PID 3384 wrote to memory of 3436	3384	firefox.exe	118
PID 3384 wrote to memory of 3436	3384	firefox.exe	118
PID 3384 wrote to memory of 3436	3384	firefox.exe	118
PID 3384 wrote to memory of 3436	3384	firefox.exe	118
PID 3384 wrote to memory of 3436	3384	firefox.exe	118
PID 3384 wrote to memory of 3436	3384	firefox.exe	118
PID 3384 wrote to memory of 3436	3384	firefox.exe	118
PID 3384 wrote to memory of 3436	3384	firefox.exe	118
PID 3384 wrote to memory of 3436	3384	firefox.exe	118
PID 3384 wrote to memory of 3436	3384	firefox.exe	118
PID 3384 wrote to memory of 3436	3384	firefox.exe	118
PID 3384 wrote to memory of 3436	3384	firefox.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\onedriveupdater.exe
"C:\Users\Admin\AppData\Local\Temp\onedriveupdater.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update /updateSource:ODSU
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2140
- - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
    C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /updateSource:ODSU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Registers COM server for autorun
    - Adds Run key to start application
    - Checks system information in the registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\FileSyncConfig.exe
      "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\FileSyncConfig.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Registers COM server for autorun
      PID:1208
  - - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
      C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe /installWebView2
      4⤵
      Executes dropped EXE
      Checks system information in the registry
      Suspicious use of WriteProcessMemory
      PID:1312
    - - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\MicrosoftEdgeWebview2Setup.exe
        
        C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\MicrosoftEdgeWebview2Setup.exe /silent /install
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:424
      - C:\Program Files (x86)\Microsoft\Temp\EU6810.tmp\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\Temp\EU6810.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
        6⤵
        Sets file execution options in registry
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4824
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1064
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.175.29\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.175.29\MicrosoftEdgeUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:1620
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.175.29\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.175.29\MicrosoftEdgeUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:4648
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.175.29\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.175.29\MicrosoftEdgeUpdateComRegisterShell64.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:3636
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzUuMjkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODNGRUQxQjMtQzlFRS00MkVGLTgwQUQtQzY0M0FDOUI5MDE3fSIgdXNlcmlkPSJ7QTQ0RDkwRkEtRjlDOC00NkRDLTlFMzAtNDlERjhGRTY5MEE5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins4QkE2NTI4OS1GNzUxLTQzMEQtQkREMS03Q0I5RUM1OTU0RTR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgb3NfcmVnaW9uX25hbWU9IlVTIiBvc19yZWdpb25fbmF0aW9uPSIyNDQiIG9zX3JlZ2lvbl9kbWE9IjAiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtxV0pTeld3UGZkY0xSK1hHSXY2eHJaZmlZT3hoUFUyczFOV21qV2NhRlBnPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTczLjQ1IiBuZXh0dmVyc2lvbj0iMS4zLjE3NS4yOSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDY3MzY0NDI5NSIgaW5zdGFsbF90aW1lX21zPSI5NjkiLz48L2FwcD48L3JlcXVlc3Q-
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        
        PID:3436
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{83FED1B3-C9EE-42EF-80AD-C643AC9B9017}" /silent
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4620
  - - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\Microsoft.SharePoint.exe
      /silentConfig
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      PID:4240

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzUuMjkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODNGRUQxQjMtQzlFRS00MkVGLTgwQUQtQzY0M0FDOUI5MDE3fSIgdXNlcmlkPSJ7QTQ0RDkwRkEtRjlDOC00NkRDLTlFMzAtNDlERjhGRTY5MEE5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InswMkJCQjQ2My1CNEM0LTRFODUtQUQ1MC0xQjU0Q0NBRDgzMDR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgb3NfcmVnaW9uX25hbWU9IlVTIiBvc19yZWdpb25fbmF0aW9uPSIyNDQiIG9zX3JlZ2lvbl9kbWE9IjAiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtxV0pTeld3UGZkY0xSK1hHSXY2eHJaZmlZT3hoUFUyczFOV21qV2NhRlBnPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbmV4dHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDY4MzE3NTAzOSIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:1460
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{11318844-8E44-4961-8B93-7DC5D4BD6030}\MicrosoftEdge_X64_114.0.1823.51.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{11318844-8E44-4961-8B93-7DC5D4BD6030}\MicrosoftEdge_X64_114.0.1823.51.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{11318844-8E44-4961-8B93-7DC5D4BD6030}\EDGEMITMP_DCA05.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{11318844-8E44-4961-8B93-7DC5D4BD6030}\EDGEMITMP_DCA05.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{11318844-8E44-4961-8B93-7DC5D4BD6030}\MicrosoftEdge_X64_114.0.1823.51.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    PID:4780
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzUuMjkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODNGRUQxQjMtQzlFRS00MkVGLTgwQUQtQzY0M0FDOUI5MDE3fSIgdXNlcmlkPSJ7QTQ0RDkwRkEtRjlDOC00NkRDLTlFMzAtNDlERjhGRTY5MEE5fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBOEZDMzRFRC0yODVCLTQ1OTItODJDNS1DOTBGNDU2OTY5Qzd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgb3NfcmVnaW9uX25hbWU9IlVTIiBvc19yZWdpb25fbmF0aW9uPSIyNDQiIG9zX3JlZ2lvbl9kbWE9IjAiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMTQuMC4xODIzLjUxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0Njk4MTc1MTIzIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDY5ODQ4NzM1MyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ4NjE2OTQ4MzIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzRkMDdhNmZlLThiZTYtNDE3Yy1iMjM2LWRkOTEzMGUwNGIxNj9QMT0xNjg3NTUwOTg0JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWNYNHEzUzJmMldvTHFCemZnM1FsMmUxVWZKWHR5RTZCMVJyY0xOYUdpdHJGcWdTbUhHZXFIeW1iM1kzJTJiM3VMUiUyZk5yM1poeHRqbmJ2NzdYRTZyZDhsZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE0NzU5MjExMiIgdG90YWw9IjE0NzU5MjExMiIgZG93bmxvYWRfdGltZV9tcz0iMTEyNzQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODYyMzIwNzEwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDg4MzEwMTYxNyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjYwOSIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTIxNjc0NjMyMyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjgyOCIgZG93bmxvYWRfdGltZV9tcz0iMTYzMzciIGRvd25sb2FkZWQ9IjE0NzU5MjExMiIgdG90YWw9IjE0NzU5MjExMiIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iMzMzNDkiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  PID:5632

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2008

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.0.1296531199\1025180720" -parentBuildID 20221007134813 -prefsHandle 1804 -prefMapHandle 1816 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {03bab6a2-d3c1-4a0e-a699-e26c74ec0c28} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 1908 24bb43a7958 gpu
    3⤵
    PID:1580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.1.4631244\154037245" -parentBuildID 20221007134813 -prefsHandle 2288 -prefMapHandle 2284 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2352c243-d970-4a37-9839-d2e9d4e15769} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 2300 24ba6472858 socket
    3⤵
    PID:3436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.2.354371227\1217582652" -childID 1 -isForBrowser -prefsHandle 2976 -prefMapHandle 3028 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca8bd432-b453-43d0-99e1-1344a17cc289} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 3008 24bb7031a58 tab
    3⤵
    PID:1756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.3.588546144\78379597" -childID 2 -isForBrowser -prefsHandle 2328 -prefMapHandle 2288 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {39ae3814-9c61-4740-94f4-ffff01500f4f} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 3432 24ba645ee58 tab
    3⤵
    PID:3344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.4.476875308\153879594" -childID 3 -isForBrowser -prefsHandle 4092 -prefMapHandle 4088 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {61a460c6-c92b-4350-b0bb-ede7532574ab} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 4108 24bb8270558 tab
    3⤵
    PID:4968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.7.1170448937\900173963" -childID 6 -isForBrowser -prefsHandle 5080 -prefMapHandle 5176 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e73139d-6b51-4175-b57b-10a4c4136e02} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 5304 24bb986c158 tab
    3⤵
    PID:5028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.6.1495453659\1191407497" -childID 5 -isForBrowser -prefsHandle 5112 -prefMapHandle 5116 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e982ba1-c2df-4c3a-a0d3-575c81a98035} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 5100 24bb986e558 tab
    3⤵
    PID:4964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.5.1392810601\1624585792" -childID 4 -isForBrowser -prefsHandle 4940 -prefMapHandle 4656 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {923d51ca-64f3-475d-99f1-2293afb26aca} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 4952 24bb960ee58 tab
    3⤵
    PID:3220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.51\Installer\setup.exe

Filesize
3.9MB

MD5
f310b5e0ea41acf8c54c2decf9e3bd55

SHA1
1e51e54b0949172c8efbe70abfb4808ac1c62571

SHA256
45d5b4b0f3c8902497ab6f72f533d9ad5557875cafb424b814a154f5d9907662

SHA512
2c72cc3a487b3ac1207d2181047a7c3e8fc0f38d3e861da8e47efde777091ea74df2e9a75c3bc6a47bf76975f31a8c7e91320a8d073ed2dc1bdb13145df96394

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\114.0.1823.51\MicrosoftEdge_X64_114.0.1823.51.exe

Filesize
140.8MB

MD5
58505bf8d31f7417a22cbeec9724dfe8

SHA1
f6a6ba745d815ac42096b16160cb954c536fc611

SHA256
cb10779cadbd635fe96693816ada5da02374495b203beaca471cd4eb83f86fb3

SHA512
3105732704f7956f21ec14e869a25f36d7a7bd10f2d6ecf2fc2ee217e848d0fe816bfb95bae2869dc080d34a4778051f0a602a15b49b51fe093c7be63e531101

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
cfad69d55cbb9ceeffaccdd176e19f7a

SHA1
076f72b145f761d23d533ed981ae059fa61339d2

SHA256
a238fc18a787d5f21a4942690029e0240597c7fc0d7dbb401063486387b7bf7c

SHA512
6a125ee8d46c444bfbd92967d46c7c127da7904fa9f9505528cd479ea169ce4c9026400e5b59e136fc0a2c8e2de64a53eb4e7cc8ddbdb5f541df47ed401f04a5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6810.tmp\MicrosoftEdgeUpdate.exe

Filesize
201KB

MD5
cfad69d55cbb9ceeffaccdd176e19f7a

SHA1
076f72b145f761d23d533ed981ae059fa61339d2

SHA256
a238fc18a787d5f21a4942690029e0240597c7fc0d7dbb401063486387b7bf7c

SHA512
6a125ee8d46c444bfbd92967d46c7c127da7904fa9f9505528cd479ea169ce4c9026400e5b59e136fc0a2c8e2de64a53eb4e7cc8ddbdb5f541df47ed401f04a5

Download Submit
C:\Program Files (x86)\Microsoft\Temp\EU6810.tmp\msedgeupdate.dll

Filesize
2.1MB

MD5
fe453156c03a6f223c2b9fd4436eab4f

SHA1
a9812efd18fc8b4b4ef93429c9555d4c0e27e939

SHA256
960034ebf4e93f488adc52f93a0b186b9eb88619418ccf66bafd4872770e5c56

SHA512
2a25c7b194aa3e05860b9346e50a39be914d230c668d8411f6a2a3607a28f0d86ccc9db118c64b70d4d78322b0a39e5d190b6fa22d9d32afb0247e750d572e4c

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
118KB

MD5
360402a47e9d94d3abf0d737aef9cb77

SHA1
c42f6c02cfc81565eb9bec882f46cd65fe52761a

SHA256
89c5febd1d126ffce2e304b3f8de600c85e636b2ff7b0ea3fff02e7ddd75d380

SHA512
0dc642b6118ce7eda9537c70bda4ec2a6f2f7acdddffc523b516482b587c00865b3226ecee9aa05c2e633b5f049fa1d25760ae78d99dc72b66bb1a9d47b17865

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\FileSync.LocalizedResources.dll

Filesize
264KB

MD5
5f73e4d07df623efbc032bdd1555e2f4

SHA1
0703c4482bba75fe20ce093b0cda5cfb4dc5552c

SHA256
138dec103c42d1b173cd067a93e6b51b1e54a10ab68d953b003e04bb8c496855

SHA512
c1b4ee3a76535f6f9c21c9ce69cf717e4662077492d44634c2690f12d9bc98a4a75e5730fc33e097b0486a05656cf4781c8b02054c1e93d92e19164962b7133d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\FileSync.LocalizedResources.dll

Filesize
264KB

MD5
5f73e4d07df623efbc032bdd1555e2f4

SHA1
0703c4482bba75fe20ce093b0cda5cfb4dc5552c

SHA256
138dec103c42d1b173cd067a93e6b51b1e54a10ab68d953b003e04bb8c496855

SHA512
c1b4ee3a76535f6f9c21c9ce69cf717e4662077492d44634c2690f12d9bc98a4a75e5730fc33e097b0486a05656cf4781c8b02054c1e93d92e19164962b7133d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\FileSync.LocalizedResources.dll

Filesize
264KB

MD5
5f73e4d07df623efbc032bdd1555e2f4

SHA1
0703c4482bba75fe20ce093b0cda5cfb4dc5552c

SHA256
138dec103c42d1b173cd067a93e6b51b1e54a10ab68d953b003e04bb8c496855

SHA512
c1b4ee3a76535f6f9c21c9ce69cf717e4662077492d44634c2690f12d9bc98a4a75e5730fc33e097b0486a05656cf4781c8b02054c1e93d92e19164962b7133d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\FileSync.Resources.dll

Filesize
4.0MB

MD5
6377b76a1add7d6f8d0a44423c5113d9

SHA1
4aed48fcf5ea5a40ac6076104e53a034000b4df3

SHA256
df6379940acff77bf63560fc07a14661ce96c4c6dc67fd11852afade7000e05a

SHA512
a9e40f813d3e5aa865a8afac54bbec4101de3e1d5dc5d39a4438c7def2ec81648337d4ad75cc622d3dac12f98a835de2b4e1f6aca1803edb5d876be05162defa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\FileSync.Resources.dll

Filesize
4.0MB

MD5
6377b76a1add7d6f8d0a44423c5113d9

SHA1
4aed48fcf5ea5a40ac6076104e53a034000b4df3

SHA256
df6379940acff77bf63560fc07a14661ce96c4c6dc67fd11852afade7000e05a

SHA512
a9e40f813d3e5aa865a8afac54bbec4101de3e1d5dc5d39a4438c7def2ec81648337d4ad75cc622d3dac12f98a835de2b4e1f6aca1803edb5d876be05162defa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\FileSync.Resources.dll

Filesize
4.0MB

MD5
6377b76a1add7d6f8d0a44423c5113d9

SHA1
4aed48fcf5ea5a40ac6076104e53a034000b4df3

SHA256
df6379940acff77bf63560fc07a14661ce96c4c6dc67fd11852afade7000e05a

SHA512
a9e40f813d3e5aa865a8afac54bbec4101de3e1d5dc5d39a4438c7def2ec81648337d4ad75cc622d3dac12f98a835de2b4e1f6aca1803edb5d876be05162defa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\FileSyncConfig.exe

Filesize
722KB

MD5
9bd9dfd7443741c509416b0e1d275669

SHA1
2e8d5e78a131eec581603179e171ee4d58d7ce6b

SHA256
034a50140df4bd330e33101b895111f7650c03a8682b9a17afb613d2c56abb50

SHA512
5b542199f68891f00156489087cd55ebba84026108d04a8b2d6545d3a203a4b58083ab0115bda9a7702ec6171ca1f481d00a06f6375e749eff7b6f16af7bab6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\FileSyncConfig.exe

Filesize
722KB

MD5
9bd9dfd7443741c509416b0e1d275669

SHA1
2e8d5e78a131eec581603179e171ee4d58d7ce6b

SHA256
034a50140df4bd330e33101b895111f7650c03a8682b9a17afb613d2c56abb50

SHA512
5b542199f68891f00156489087cd55ebba84026108d04a8b2d6545d3a203a4b58083ab0115bda9a7702ec6171ca1f481d00a06f6375e749eff7b6f16af7bab6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\FileSyncFS.DLL

Filesize
579KB

MD5
af55f9a29956dadb409304024af2d20e

SHA1
09313e2c28d4014fbc149a8cc8b6050e01cde069

SHA256
eac857a45508174160c302f947797fde35e3cc3ff48d30538303372007653f8f

SHA512
6fd1cbb8678c8c52f294af2305613c1be36fe37b0ec7302a02d0dce534f1d1eacc7c16542c33fd507ddd9d6b8850ef1ec6e76ae25d6a7f90e574dbfece81c58c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\FileSyncFS.dll

Filesize
579KB

MD5
af55f9a29956dadb409304024af2d20e

SHA1
09313e2c28d4014fbc149a8cc8b6050e01cde069

SHA256
eac857a45508174160c302f947797fde35e3cc3ff48d30538303372007653f8f

SHA512
6fd1cbb8678c8c52f294af2305613c1be36fe37b0ec7302a02d0dce534f1d1eacc7c16542c33fd507ddd9d6b8850ef1ec6e76ae25d6a7f90e574dbfece81c58c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\FileSyncHost.DLL

Filesize
412KB

MD5
d426c62d15ffd501eef12b8daf8f86fe

SHA1
f4fd475b6726ccd4f7b706f5035b9ede60af32d3

SHA256
91a48c401dc29d45d8842ad9264eddd1c345145d63adeda54b8f3bc9e5fd4453

SHA512
97971d8f97b9da1e9c0705e0e79ae90897f5c96a9d22f5e7ad7c5c3e06ff8209bdcba02fbef7b6c8fa35f16cc455a2b4b391123a4d9fc892986a6c0c5897a191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\FileSyncHost.dll

Filesize
412KB

MD5
d426c62d15ffd501eef12b8daf8f86fe

SHA1
f4fd475b6726ccd4f7b706f5035b9ede60af32d3

SHA256
91a48c401dc29d45d8842ad9264eddd1c345145d63adeda54b8f3bc9e5fd4453

SHA512
97971d8f97b9da1e9c0705e0e79ae90897f5c96a9d22f5e7ad7c5c3e06ff8209bdcba02fbef7b6c8fa35f16cc455a2b4b391123a4d9fc892986a6c0c5897a191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\FileSyncSessions.dll

Filesize
5.4MB

MD5
4fc76a9c6d2d2dc30d6ddc412bedd6cc

SHA1
87af2192dd9f7f2176a8a594229931907af15fe3

SHA256
ebe15e9b8abe99f60b2e9e77d1b61ac4e1c63dbaf1ee11ec7d66e09d9c44f7d8

SHA512
3f389bd51c9cba51d5ea213afb1a6384e88b79da10216903492a814b4fbd2d3002e6862c41cea5d3b47ec8ce186110348a735da7d6a74bc4ea00f838e24a9d7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\FileSyncSessions.dll

Filesize
5.4MB

MD5
4fc76a9c6d2d2dc30d6ddc412bedd6cc

SHA1
87af2192dd9f7f2176a8a594229931907af15fe3

SHA256
ebe15e9b8abe99f60b2e9e77d1b61ac4e1c63dbaf1ee11ec7d66e09d9c44f7d8

SHA512
3f389bd51c9cba51d5ea213afb1a6384e88b79da10216903492a814b4fbd2d3002e6862c41cea5d3b47ec8ce186110348a735da7d6a74bc4ea00f838e24a9d7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\FileSyncSqlite3.dll

Filesize
633KB

MD5
e95573328b9f19c930dd37498e0dd433

SHA1
a872f129854b5c525f3069a923e05d037ff10ab2

SHA256
e5e3ea63cb5bf944207e558337b66a51946cbb15dd28b4f8e356e3d7d3d0f3de

SHA512
38af2183fcfd7a1ffcf4835a83c1df712df049f6d3584d6ba66bde1ffe03764634ccd55104bae54cb96cacdf673319aa2a086844bf8622229f606847bee70787

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\FileSyncSqlite3.dll

Filesize
633KB

MD5
e95573328b9f19c930dd37498e0dd433

SHA1
a872f129854b5c525f3069a923e05d037ff10ab2

SHA256
e5e3ea63cb5bf944207e558337b66a51946cbb15dd28b4f8e356e3d7d3d0f3de

SHA512
38af2183fcfd7a1ffcf4835a83c1df712df049f6d3584d6ba66bde1ffe03764634ccd55104bae54cb96cacdf673319aa2a086844bf8622229f606847bee70787

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\FileSyncTelemetryExtensions.dll

Filesize
461KB

MD5
7cc9a73247db4eba53b89148f274ea8c

SHA1
2c4277a8ee131712020d6bd33a020db71afea98b

SHA256
f4181d15f4ad91f8e23228b53027299c40ca6695b366898df8b7dab701b71bc3

SHA512
e44080b1bd6e4b68c468e71252c9af80ad6b0a13c944b36e8851fe3ea9fabdabfcc76b014120bc683d98463299483a1fb943f4d1c5d05b8be71054f755ae8dd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\FileSyncTelemetryExtensions.dll

Filesize
461KB

MD5
7cc9a73247db4eba53b89148f274ea8c

SHA1
2c4277a8ee131712020d6bd33a020db71afea98b

SHA256
f4181d15f4ad91f8e23228b53027299c40ca6695b366898df8b7dab701b71bc3

SHA512
e44080b1bd6e4b68c468e71252c9af80ad6b0a13c944b36e8851fe3ea9fabdabfcc76b014120bc683d98463299483a1fb943f4d1c5d05b8be71054f755ae8dd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogUploader.dll

Filesize
980KB

MD5
3cdc8f8873b4d5d0001bdf6ea9e711c8

SHA1
7323f3b45f0448b2e10861514504c54132cc9472

SHA256
feaccd715fbc147f14eeae765ed302bea4fc7333b3bcf8c18c3df98876ed42af

SHA512
54a816e3156634d3eacb57743ceea9edd452b432b179d4a8bd32ca66238439971efe0781935105a2d97feff3d3779532b35fa9f277a597ebb6cfe47d485a2bdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogUploader.dll

Filesize
980KB

MD5
3cdc8f8873b4d5d0001bdf6ea9e711c8

SHA1
7323f3b45f0448b2e10861514504c54132cc9472

SHA256
feaccd715fbc147f14eeae765ed302bea4fc7333b3bcf8c18c3df98876ed42af

SHA512
54a816e3156634d3eacb57743ceea9edd452b432b179d4a8bd32ca66238439971efe0781935105a2d97feff3d3779532b35fa9f277a597ebb6cfe47d485a2bdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LoggingPlatform.DLL

Filesize
635KB

MD5
48497289260baa0f9592f04391b496e7

SHA1
071b0fd69e1d4cf906ac67118597c81635161145

SHA256
7ffb40890d04071e442b1ebc11d667963471f41f1833febdfd568b0d95601df4

SHA512
51b6fc7fcb99543f8bd1e40c91626fa77988c606e8d54b27c645d858495ddb9638b52869fbd5d61341e8c380c86d8181bc73ccc20f42a82abcb9bd6aca98a693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LoggingPlatform.dll

Filesize
635KB

MD5
48497289260baa0f9592f04391b496e7

SHA1
071b0fd69e1d4cf906ac67118597c81635161145

SHA256
7ffb40890d04071e442b1ebc11d667963471f41f1833febdfd568b0d95601df4

SHA512
51b6fc7fcb99543f8bd1e40c91626fa77988c606e8d54b27c645d858495ddb9638b52869fbd5d61341e8c380c86d8181bc73ccc20f42a82abcb9bd6aca98a693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LoggingPlatform.dll

Filesize
635KB

MD5
48497289260baa0f9592f04391b496e7

SHA1
071b0fd69e1d4cf906ac67118597c81635161145

SHA256
7ffb40890d04071e442b1ebc11d667963471f41f1833febdfd568b0d95601df4

SHA512
51b6fc7fcb99543f8bd1e40c91626fa77988c606e8d54b27c645d858495ddb9638b52869fbd5d61341e8c380c86d8181bc73ccc20f42a82abcb9bd6aca98a693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveMedTile.contrast-black_scale-100.png

Filesize
1KB

MD5
72747c27b2f2a08700ece584c576af89

SHA1
5301ca4813cd5ff2f8457635bc3c8944c1fb9f33

SHA256
6f028542f6faeaaf1f564eab2605bedb20a2ee72cdd9930bde1a3539344d721b

SHA512
3e7f84d3483a25a52a036bf7fd87aac74ac5af327bb8e4695e39dada60c4d6607d1c04e7769a808be260db2af6e91b789008d276ccc6b7e13c80eb97e2818aba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveMedTile.contrast-black_scale-125.png

Filesize
1KB

MD5
b83ac69831fd735d5f3811cc214c7c43

SHA1
5b549067fdd64dcb425b88fabe1b1ca46a9a8124

SHA256
cbdcf248f8a0fcd583b475562a7cdcb58f8d01236c7d06e4cdbfe28e08b2a185

SHA512
4b2ee6b3987c048ab7cc827879b38fb3c216dab8e794239d189d1ba71122a74fdaa90336e2ea33abd06ba04f37ded967eb98fd742a02463b6eb68ab917155600

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveMedTile.contrast-black_scale-150.png

Filesize
2KB

MD5
771bc7583fe704745a763cd3f46d75d2

SHA1
e38f9d7466eefc6d3d2aaa327f1bd42c5a5c7752

SHA256
36a6aad9a9947ab3f6ac6af900192f5a55870d798bca70c46770ccf2108fd62d

SHA512
959ea603abec708895b7f4ef0639c3f2d270cfdd38d77ac9bab8289918cbd4dbac3c36c11bb52c6f01b0adae597b647bb784bba513d77875979270f4962b7884

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveMedTile.contrast-black_scale-200.png

Filesize
2KB

MD5
09773d7bb374aeec469367708fcfe442

SHA1
2bfb6905321c0c1fd35e1b1161d2a7663e5203d6

SHA256
67d1bb54fcb19c174de1936d08b5dbdb31b98cfdd280bcc5122fb0693675e4f2

SHA512
f500ea4a87a24437b60b0dc3ec69fcc5edbc39c2967743ddb41093b824d0845ffddd2df420a12e17e4594df39f63adad5abb69a29f8456fed03045a6b42388bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveMedTile.contrast-black_scale-400.png

Filesize
6KB

MD5
e01cdbbd97eebc41c63a280f65db28e9

SHA1
1c2657880dd1ea10caf86bd08312cd832a967be1

SHA256
5cb8fd670585de8a7fc0ceede164847522d287ef17cd48806831ea18a0ceac1f

SHA512
ffd928e289dc0e36fa406f0416fb07c2eb0f3725a9cdbb27225439d75b8582d68705ec508e3c4af1fc4982d06d70ef868cafbfc73a637724dee7f34828d14850

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveMedTile.contrast-white_scale-100.png

Filesize
2KB

MD5
19876b66df75a2c358c37be528f76991

SHA1
181cab3db89f416f343bae9699bf868920240c8b

SHA256
a024fc5dbe0973fd9267229da4ebfd8fc41d73ca27a2055715aafe0efb4f3425

SHA512
78610a040bbbb026a165a5a50dfbaf4208ebef7407660eea1a20e95c30d0d42ef1d13f647802a2f0638443ae2253c49945ebe018c3499ddbf00cfdb1db42ced1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveMedTile.contrast-white_scale-125.png

Filesize
3KB

MD5
8347d6f79f819fcf91e0c9d3791d6861

SHA1
5591cf408f0adaa3b86a5a30b0112863ec3d6d28

SHA256
e8b30bfcee8041f1a70e61ca46764416fd1df2e6086ba4c280bfa2220c226750

SHA512
9f658bc77131f4ac4f730ed56a44a406e09a3ceec215b7a0b2ed42d019d8b13d89ab117affb547a5107b5a84feb330329dc15e14644f2b52122acb063f2ba550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveMedTile.contrast-white_scale-150.png

Filesize
3KB

MD5
de5ba8348a73164c66750f70f4b59663

SHA1
1d7a04b74bd36ecac2f5dae6921465fc27812fec

SHA256
a0bbe33b798c3adac36396e877908874cffaadb240244095c68dff840dcbbf73

SHA512
85197e0b13a1ae48f51660525557cceaeed7d893dd081939f62e6e8921bb036c6501d3bb41250649048a286ff6bac6c9c1a426d2f58f3e3b41521db26ef6a17c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveMedTile.contrast-white_scale-200.png

Filesize
4KB

MD5
f1c75409c9a1b823e846cc746903e12c

SHA1
f0e1f0cf35369544d88d8a2785570f55f6024779

SHA256
fba9104432cbb8ebbd45c18ef1ba46a45dd374773e5aa37d411bb023ded8efd6

SHA512
ed72eb547e0c03776f32e07191ce7022d08d4bcc66e7abca4772cdd8c22d8e7a423577805a4925c5e804ed6c15395f3df8aac7af62f1129e4982685d7e46bd85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveMedTile.contrast-white_scale-400.png

Filesize
8KB

MD5
adbbeb01272c8d8b14977481108400d6

SHA1
1cc6868eec36764b249de193f0ce44787ba9dd45

SHA256
9250ef25efc2a9765cf1126524256fdfc963c8687edfdc4a2ecde50d748ada85

SHA512
c15951cf2dc076ed508665cd7dac2251c8966c1550b78549b926e98c01899ad825535001bd65eeb2f8680cd6753cd47e95606ecf453919f5827ed12bca062887

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveMedTile.scale-100.png

Filesize
2KB

MD5
57a6876000151c4303f99e9a05ab4265

SHA1
1a63d3dd2b8bdc0061660d4add5a5b9af0ff0794

SHA256
8acbdd41252595b7410ca2ed438d6d8ede10bd17fe3a18705eedc65f46e4c1c4

SHA512
c6a2a9124bc6bcf70d2977aaca7e3060380a4d9428a624cc6e5624c75ebb6d6993c6186651d4e54edf32f3491d413714ef97a4cdc42bae94045cd804f0ad7cba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveMedTile.scale-125.png

Filesize
4KB

MD5
d03b7edafe4cb7889418f28af439c9c1

SHA1
16822a2ab6a15dda520f28472f6eeddb27f81178

SHA256
a5294e3c7cd855815f8d916849d87bd2357f5165eb4372f248fdf8b988601665

SHA512
59d99f0b9a7813b28bae3ea1ae5bdbbf0d87d32ff621ff20cbe1b900c52bb480c722dd428578dea5d5351cc36f1fa56b2c1712f2724344f026fe534232812962

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveMedTile.scale-150.png

Filesize
5KB

MD5
a23c55ae34e1b8d81aa34514ea792540

SHA1
3b539dfb299d00b93525144fd2afd7dd9ba4ccbf

SHA256
3df4590386671e0d6fee7108e457eb805370a189f5fdfeaf2f2c32d5adc76abd

SHA512
1423a2534ae71174f34ee527fe3a0db38480a869cac50b08b60a2140b5587b3944967a95016f0b00e3ca9ced1f1452c613bb76c34d7ebd386290667084bce77d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveMedTile.scale-200.png

Filesize
6KB

MD5
13e6baac125114e87f50c21017b9e010

SHA1
561c84f767537d71c901a23a061213cf03b27a58

SHA256
3384357b6110f418b175e2f0910cffe588c847c8e55f2fe3572d82999a62c18e

SHA512
673c3bec7c2cd99c07ebfca0f4ab14cd6341086c8702fe9e8b5028aed0174398d7c8a94583da40c32cd0934d784062ad6db71f49391f64122459f8bb00222e08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveMedTile.scale-400.png

Filesize
15KB

MD5
e593676ee86a6183082112df974a4706

SHA1
c4e91440312dea1f89777c2856cb11e45d95fe55

SHA256
deb0ec0ee8f1c4f7ea4de2c28ff85087ee5ff8c7e3036c3b0a66d84bae32b6bb

SHA512
11d7ed45f461f44fa566449bb50bcfce35f73fc775744c2d45ea80aeb364fe40a68a731a2152f10edc059dea16b8bab9c9a47da0c9ffe3d954f57da0ff714681

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png

Filesize
783B

MD5
f4e9f958ed6436aef6d16ee6868fa657

SHA1
b14bc7aaca388f29570825010ebc17ca577b292f

SHA256
292cac291af7b45f12404f968759afc7145b2189e778b14d681449132b14f06b

SHA512
cd5d78317e82127e9a62366fd33d5420a6f25d0a6e55552335e64dc39932238abd707fe75d4f62472bc28a388d32b70ff08b6aa366c092a7ace3367896a2bd98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png

Filesize
1018B

MD5
2c7a9e323a69409f4b13b1c3244074c4

SHA1
3c77c1b013691fa3bdff5677c3a31b355d3e2205

SHA256
8efeacefb92d64dfb1c4df2568165df6436777f176accfd24f4f7970605d16c2

SHA512
087c12e225c1d791d7ad0bf7d3544b4bed8c4fb0daaa02aee0e379badae8954fe6120d61fdf1a11007cbcdb238b5a02c54f429b6cc692a145aa8fbd220c0cb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png

Filesize
1KB

MD5
552b0304f2e25a1283709ad56c4b1a85

SHA1
92a9d0d795852ec45beae1d08f8327d02de8994e

SHA256
262b9a30bb8db4fc59b5bc348aa3813c75e113066a087135d0946ad916f72535

SHA512
9559895b66ef533486f43274f7346ad3059c15f735c9ce5351adf1403c95c2b787372153d4827b03b6eb530f75efcf9ae89db1e9c69189e86d6383138ab9c839

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png

Filesize
1KB

MD5
22e17842b11cd1cb17b24aa743a74e67

SHA1
f230cb9e5a6cb027e6561fabf11a909aa3ba0207

SHA256
9833b80def72b73fca150af17d4b98c8cd484401f0e2d44320ecd75b5bb57c42

SHA512
8332fc72cd411f9d9fd65950d58bf6440563dc4bd5ce3622775306575802e20c967f0ee6bab2092769a11e2a4ea228dab91a02534beeb8afde8239dd2b90f23a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png

Filesize
3KB

MD5
3c29933ab3beda6803c4b704fba48c53

SHA1
056fe7770a2ba171a54bd60b3c29c4fbb6d42f0c

SHA256
3a7ef7c0bda402fdaff19a479d6c18577c436a5f4e188da4c058a42ef09a7633

SHA512
09408a000a6fa8046649c61ccef36afa1046869506f019f739f67f5c1c05d2e313b95a60bd43d9be882688df1610ad7979dd9d1f16a2170959b526ebd89b8ef7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveSmallTile.scale-100.png

Filesize
1KB

MD5
1f156044d43913efd88cad6aa6474d73

SHA1
1f6bd3e15a4bdb052746cf9840bdc13e7e8eda26

SHA256
4e11167708801727891e8dd9257152b7391fc483d46688d61f44b96360f76816

SHA512
df791d7c1e7a580e589613b5a56ba529005162d3564fffd4c8514e6afaa5eccea9cea9e1ac43bd9d74ee3971b2e94d985b103176db592e3c775d5feec7aac6d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveSmallTile.scale-125.png

Filesize
2KB

MD5
09f3f8485e79f57f0a34abd5a67898ca

SHA1
e68ae5685d5442c1b7acc567dc0b1939cad5f41a

SHA256
69e432d1eec44bed4aad35f72a912e1f0036a4b501a50aec401c9fa260a523e3

SHA512
0eafeaf735cedc322719049db6325ccbf5e92de229cace927b78a08317e842261b7adbda03ec192f71ee36e35eb9bf9624589de01beaec2c5597a605fc224130

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveSmallTile.scale-150.png

Filesize
3KB

MD5
ed306d8b1c42995188866a80d6b761de

SHA1
eadc119bec9fad65019909e8229584cd6b7e0a2b

SHA256
7e3f35d5eb05435be8d104a2eacf5bace8301853104a4ea4768601c607ddf301

SHA512
972a42f7677d57fcb8c8cb0720b21a6ffe9303ea58dde276cfe2f26ee68fe4cc8ae6d29f3a21a400253de7c0a212edf29981e9e2bca49750b79dd439461c8335

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveSmallTile.scale-200.png

Filesize
4KB

MD5
d9d00ecb4bb933cdbb0cd1b5d511dcf5

SHA1
4e41b1eda56c4ebe5534eb49e826289ebff99dd9

SHA256
85823f7a5a4ebf8274f790a88b981e92ede57bde0ba804f00b03416ee4feda89

SHA512
8b53dec59bba8b4033e5c6b2ff77f9ba6b929c412000184928978f13b475cd691a854fee7d55026e48eab8ac84cf34fc7cb38e3766bbf743cf07c4d59afb98f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\OneDriveSmallTile.scale-400.png

Filesize
11KB

MD5
096d0e769212718b8de5237b3427aacc

SHA1
4b912a0f2192f44824057832d9bb08c1a2c76e72

SHA256
9a0b901e97abe02036c782eb6a2471e18160b89fd5141a5a9909f0baab67b1ef

SHA512
99eb3d67e1a05ffa440e70b7e053b7d32e84326671b0b9d2fcfcea2633b8566155477b2a226521bf860b471c5926f8e1f8e3a52676cacb41b40e2b97cb3c1173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\LogoImages\Resources.pri

Filesize
17.8MB

MD5
c692bad42473abb43c0c2fa596f98fa0

SHA1
758bc205d3f73c0ff30d39529b22f6cfda640301

SHA256
2b8970bbb8d89b030b71f4b9638aeb56c4543957e5bee7539e31180826e22a7f

SHA512
b2e62dd24c5b194bde5ffa5d4e4d58d80648936eadc393074a61427e128edaeb81f4aeab366957d8dcbacd596b0fbbf4fe8bec3a8c73382a77bd482ce62e09ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\MSVCP140.dll

Filesize
557KB

MD5
5e4239192ff5079bacf92c89f65f3c21

SHA1
46d8072f0c35f50ce92b248907778d71a4f34b5e

SHA256
c116bc8349ae9f6d479b89dd3a827606d12fff34b0d0a249f6594d194d79d195

SHA512
242da2426e58b429474c0762f87ffdb5d30c398eb46a5b8bba41b3664de2cd6f5e5cb340cc93e882d7564c979ac910a4d450894e2bdc51457b53df0029d6d89d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\MSVCP140_ATOMIC_WAIT.dll

Filesize
55KB

MD5
ecf37f3231d5552b6968f3b25cf2ff07

SHA1
cf5a6236046e56215de1e262c5ab7ff1bb51eed5

SHA256
1583bbc399c921343ae9f9ca3be74a52b9478d971dcd1624d73a0d652bbd547d

SHA512
56593279751c52de360f963a5a25460260a630ba314cbd7b97f0f4d94c8be5f43ee9645fe40f677bd45a13d0137fdbfc43c43d9950ecb7990e81df4aa1a8a07f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\Microsoft.SharePoint.Calc.dll

Filesize
912KB

MD5
82b72e92dedc44ff66e237bde938ee10

SHA1
4d11da3c819d580654933b74b4ad79691119d57e

SHA256
90a2c65c209dde828d9ff2e680c93871609600025057f92e69afb9e1b3e560ed

SHA512
5c3d670c5ad5beaeecf26a490a70ad2b2956dc1ae099f12fa1f23d16c5ec324d43fedd45da6a8f67f4f3eb5c6c7b5087b934d0fb98561b00ea6e44c77f1bcf8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\Microsoft.SharePoint.Calc.dll

Filesize
912KB

MD5
82b72e92dedc44ff66e237bde938ee10

SHA1
4d11da3c819d580654933b74b4ad79691119d57e

SHA256
90a2c65c209dde828d9ff2e680c93871609600025057f92e69afb9e1b3e560ed

SHA512
5c3d670c5ad5beaeecf26a490a70ad2b2956dc1ae099f12fa1f23d16c5ec324d43fedd45da6a8f67f4f3eb5c6c7b5087b934d0fb98561b00ea6e44c77f1bcf8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\Microsoft.SharePoint.WebSocketClient.dll

Filesize
1.1MB

MD5
0f86f411bb9168effacde3e448159052

SHA1
1251702e7c56ffc27dd315685820e40ab60843bd

SHA256
9786fa83b406cc3c2a521bd38c9251078fc4fce1c550ff6cc4fb7199982a179f

SHA512
1c5cd601ffda10f8007d9adf51eeb65308b7dd2f7d689026a646fa3722a747ca864429ca699258e726c5c8d7125a6e1449b73d0bc6b7192de5c56f38be5d704c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\Microsoft.SharePoint.WebSocketClient.dll

Filesize
1.1MB

MD5
0f86f411bb9168effacde3e448159052

SHA1
1251702e7c56ffc27dd315685820e40ab60843bd

SHA256
9786fa83b406cc3c2a521bd38c9251078fc4fce1c550ff6cc4fb7199982a179f

SHA512
1c5cd601ffda10f8007d9adf51eeb65308b7dd2f7d689026a646fa3722a747ca864429ca699258e726c5c8d7125a6e1449b73d0bc6b7192de5c56f38be5d704c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\Microsoft.SharePoint.dll

Filesize
14.1MB

MD5
5b379deaad1d9d962bebabc2042c9aac

SHA1
d7f2bfa0c0b32abebae1d244ab68ae64d94f28c5

SHA256
81da3f0b1ed1b9354ea6935a9efb18515ed5c301cb08015c26f42d746345d5ca

SHA512
1d20c2de5d81dfd8b01ad6954e8a1522cc0a49ff593ed4944b97c0c2f5b80f9359eb4a1e5bb64eb4ea29d934cdbbb1502192869518b2a0e55397b2261caa9bd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\Microsoft.SharePoint.dll

Filesize
14.1MB

MD5
5b379deaad1d9d962bebabc2042c9aac

SHA1
d7f2bfa0c0b32abebae1d244ab68ae64d94f28c5

SHA256
81da3f0b1ed1b9354ea6935a9efb18515ed5c301cb08015c26f42d746345d5ca

SHA512
1d20c2de5d81dfd8b01ad6954e8a1522cc0a49ff593ed4944b97c0c2f5b80f9359eb4a1e5bb64eb4ea29d934cdbbb1502192869518b2a0e55397b2261caa9bd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\Microsoft.SharePoint.exe

Filesize
543KB

MD5
7326e55a5ba82975839398aee65689ef

SHA1
2ce82eb1f5c4be7b9b6d3d8ccd574ec6bc0d1707

SHA256
d7a67983b097a6e17ac8d7bc232e16bbe9d1f9fb738fdc6b907d3e4b6754c36e

SHA512
3e9ce366e6abe33be98b91ef3853105ac9a727192e05dd6ca837b476d60af7c0e66ce2f1ba506ab148d1bfb2e5a878381e5f8bbcce659866adb3a0f5973c2e3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\OneDrive.VisualElementsManifest.xml

Filesize
344B

MD5
5ae2d05d894d1a55d9a1e4f593c68969

SHA1
a983584f58d68552e639601538af960a34fa1da7

SHA256
d21077ad0c29a4c939b8c25f1186e2b542d054bb787b1d3210e9cab48ec3080c

SHA512
152949f5b661980f33608a0804dd8c43d70e056ae0336e409006e764664496fef6e60daa09fecb8d74523d3e7928c0dbd5d8272d8be1cf276852d88370954adc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\OneDrive.exe

Filesize
2.5MB

MD5
1f5f335445b03dbf3d5deb1610ae78a9

SHA1
09d0b3d9941b4baef93abb0995eb1412cd56e22e

SHA256
c5a15cd50cc55f5bf62b77c91b0fb8f188140b3cd53525522e08fc20f4470e9b

SHA512
5b1b17dee9ad6d617cf660639e5db9d7de063af51b677d711361b205dc32161b70a74a22c20dd8a34af2309e71f59ff4edfa695d80520d6bfc594fb0de3b6891

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\OneDriveStandaloneUpdater.exe

Filesize
4.0MB

MD5
7e01917fd596842fc8eaa63c66050363

SHA1
adf8a7bed48509bf6b170cfc4bac7e1f1f74c32f

SHA256
5cada5c75dd81608cad8c819c353e980cbd95fd6e2bc3cce1d379eec02543146

SHA512
a00b50d8a08dbb986d622f6a991d063d05ab07341713b7ec80f75874693141d4316ac9428be2e9120b13e4f4c562d520e5f01eb0f026c7910b4b214fd9560baa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\OneDriveTelemetryStable.dll

Filesize
2.2MB

MD5
481e20e939fce5fc9cab409fb5ab69b3

SHA1
0919007af4dab021c1c46be0b6e58a589e6be684

SHA256
d06e67c0ae05cb3c9b3cd765e7f837f546c88f7e95d0140c0db2276ee0f85da4

SHA512
c60bde836084f22445c1555982c77a5853568a12fdd34f8a4fc750f7578e93f142efc980ca11b6aca0e74427a9646d27f1f6b6a4a217110524cc5c7bd127cd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\OneDriveTelemetryStable.dll

Filesize
2.2MB

MD5
481e20e939fce5fc9cab409fb5ab69b3

SHA1
0919007af4dab021c1c46be0b6e58a589e6be684

SHA256
d06e67c0ae05cb3c9b3cd765e7f837f546c88f7e95d0140c0db2276ee0f85da4

SHA512
c60bde836084f22445c1555982c77a5853568a12fdd34f8a4fc750f7578e93f142efc980ca11b6aca0e74427a9646d27f1f6b6a4a217110524cc5c7bd127cd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\Telemetry.dll

Filesize
585KB

MD5
aeea0576290833bde7c4593e8ad5f943

SHA1
73c3fa5e8af9be0e8ac1a429babb941b35d58435

SHA256
e2a4487ed8a9b624d9113bd2544c80354ac698d2effffc4a2856b49f1604c93f

SHA512
27e44f02e87773b56b21ac8a24c57550917f0fec9517513cf41ae9b7abc81744d94c76bf7dd85deda879ba22dbc3c90ee852843c5887abb5b7d820a93395d605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\Telemetry.dll

Filesize
585KB

MD5
aeea0576290833bde7c4593e8ad5f943

SHA1
73c3fa5e8af9be0e8ac1a429babb941b35d58435

SHA256
e2a4487ed8a9b624d9113bd2544c80354ac698d2effffc4a2856b49f1604c93f

SHA512
27e44f02e87773b56b21ac8a24c57550917f0fec9517513cf41ae9b7abc81744d94c76bf7dd85deda879ba22dbc3c90ee852843c5887abb5b7d820a93395d605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\Telemetry.dll

Filesize
585KB

MD5
aeea0576290833bde7c4593e8ad5f943

SHA1
73c3fa5e8af9be0e8ac1a429babb941b35d58435

SHA256
e2a4487ed8a9b624d9113bd2544c80354ac698d2effffc4a2856b49f1604c93f

SHA512
27e44f02e87773b56b21ac8a24c57550917f0fec9517513cf41ae9b7abc81744d94c76bf7dd85deda879ba22dbc3c90ee852843c5887abb5b7d820a93395d605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\UpdateRingSettings.dll

Filesize
561KB

MD5
5f6beeed41bb1a68885cec47aecf1942

SHA1
32defc0c8efdb43f5d8ee6b7e851cb79d00ef5df

SHA256
e7802d8ee7f09c3d2c159bfc387842f0f5ef38753f75efc5da21e4a3e298decf

SHA512
07b4f5b67dd31841cb63f2deb61fdf413c7bd797b7c8fbf0a3c690f2e5ca35dc4ffed3a89f474a3c60d95bad2ed6069bc2c1ac5f8bc428f48fb2d630db6899de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\UpdateRingSettings.dll

Filesize
561KB

MD5
5f6beeed41bb1a68885cec47aecf1942

SHA1
32defc0c8efdb43f5d8ee6b7e851cb79d00ef5df

SHA256
e7802d8ee7f09c3d2c159bfc387842f0f5ef38753f75efc5da21e4a3e298decf

SHA512
07b4f5b67dd31841cb63f2deb61fdf413c7bd797b7c8fbf0a3c690f2e5ca35dc4ffed3a89f474a3c60d95bad2ed6069bc2c1ac5f8bc428f48fb2d630db6899de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\UpdateRingSettings.dll

Filesize
561KB

MD5
5f6beeed41bb1a68885cec47aecf1942

SHA1
32defc0c8efdb43f5d8ee6b7e851cb79d00ef5df

SHA256
e7802d8ee7f09c3d2c159bfc387842f0f5ef38753f75efc5da21e4a3e298decf

SHA512
07b4f5b67dd31841cb63f2deb61fdf413c7bd797b7c8fbf0a3c690f2e5ca35dc4ffed3a89f474a3c60d95bad2ed6069bc2c1ac5f8bc428f48fb2d630db6899de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\VCRUNTIME140.dll

Filesize
95KB

MD5
251bab3694c10f7705e7db0c6db87d2f

SHA1
d6c978b56232a189a4de1c88e05bbdc21ea4a6e8

SHA256
20c3e4f0de55ac7ed97ff99f06bfe1db6d1cbf4402ff3af85fa333586e84989d

SHA512
2ccfc6d405f00355523dbc28801eed1cf765bbe8f1687eb7c4705dfa1f849718f19acb413ad1630bca3edcca5d835746170fe3b23e14edd1802ace1e4b864696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\VCRUNTIME140_1.dll

Filesize
36KB

MD5
fb8f2dfc53a3dd3d841217ebdf54abf1

SHA1
2dcb8919b1df84b9b8b1de9887fbf5d767b7bcff

SHA256
79e7aa5832a28181876c00fce449697d8df4ae2bf56308571fff001b16ee6bbf

SHA512
7b8fca50ad58b9919053fb5479c0487a6cbbcd88caeccb911fc01e64814d6b73c15d0cd466c6604108ea583191360f729a59c934c1b6a22d8158e89dd2ccf37a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\adal.dll

Filesize
1.4MB

MD5
15d935ca80cb49a3f061e9a8b4aa60ef

SHA1
c8978066dedc3a3e4d22edf42ba429121ed82e90

SHA256
5f8c3401b9a2af450fabbe531aa363f4ed0b45117379f30dd19c58258dd1ade8

SHA512
c54d213adc7ed0f6b71df90d7a72cf12e41ad30088415d600662563bbcfa99e586bac09aa1372191510fdd3b1fdd0903cb14491103ff65a5dee5494a747756b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\adal.dll

Filesize
1.4MB

MD5
15d935ca80cb49a3f061e9a8b4aa60ef

SHA1
c8978066dedc3a3e4d22edf42ba429121ed82e90

SHA256
5f8c3401b9a2af450fabbe531aa363f4ed0b45117379f30dd19c58258dd1ade8

SHA512
c54d213adc7ed0f6b71df90d7a72cf12e41ad30088415d600662563bbcfa99e586bac09aa1372191510fdd3b1fdd0903cb14491103ff65a5dee5494a747756b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\libcrypto-1_1-x64.dll

Filesize
3.3MB

MD5
10c43c447f7b54e422762dbe7359de79

SHA1
676cae65210aac82b5031f701b8234be517b86d6

SHA256
439145080ac14d46220ef8786592c9732220bd2d63ff59879538bb65afe810ff

SHA512
42c590b2d6883867a69d596366be128a6fcb9c281c43a22a6fd0a654767f338b41509c263e79223e6666843572618a1d54caf857a99f7c21d8bae7e7be09080c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\libcrypto-1_1-x64.dll

Filesize
3.3MB

MD5
10c43c447f7b54e422762dbe7359de79

SHA1
676cae65210aac82b5031f701b8234be517b86d6

SHA256
439145080ac14d46220ef8786592c9732220bd2d63ff59879538bb65afe810ff

SHA512
42c590b2d6883867a69d596366be128a6fcb9c281c43a22a6fd0a654767f338b41509c263e79223e6666843572618a1d54caf857a99f7c21d8bae7e7be09080c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\libssl-1_1-x64.dll

Filesize
682KB

MD5
f876ebac71bafb3ab52cea57874203e0

SHA1
6e2d2d59085b341ff68f304fe463db278568ae6e

SHA256
9fa131ac284f4a612d68681e1fde18fb85a91b133e3bbff83126949fe09fe8b8

SHA512
61f6e7eaa2bab4ffbf718a268d751355037e0f037dc6a6a2a235b3ef399b77b8bac6635a08250bce9be3c8c1c264e991d95b54eddf5323fca0e18dfb64d71aa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\libssl-1_1-x64.dll

Filesize
682KB

MD5
f876ebac71bafb3ab52cea57874203e0

SHA1
6e2d2d59085b341ff68f304fe463db278568ae6e

SHA256
9fa131ac284f4a612d68681e1fde18fb85a91b133e3bbff83126949fe09fe8b8

SHA512
61f6e7eaa2bab4ffbf718a268d751355037e0f037dc6a6a2a235b3ef399b77b8bac6635a08250bce9be3c8c1c264e991d95b54eddf5323fca0e18dfb64d71aa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\msvcp140.dll

Filesize
557KB

MD5
5e4239192ff5079bacf92c89f65f3c21

SHA1
46d8072f0c35f50ce92b248907778d71a4f34b5e

SHA256
c116bc8349ae9f6d479b89dd3a827606d12fff34b0d0a249f6594d194d79d195

SHA512
242da2426e58b429474c0762f87ffdb5d30c398eb46a5b8bba41b3664de2cd6f5e5cb340cc93e882d7564c979ac910a4d450894e2bdc51457b53df0029d6d89d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\msvcp140.dll

Filesize
557KB

MD5
5e4239192ff5079bacf92c89f65f3c21

SHA1
46d8072f0c35f50ce92b248907778d71a4f34b5e

SHA256
c116bc8349ae9f6d479b89dd3a827606d12fff34b0d0a249f6594d194d79d195

SHA512
242da2426e58b429474c0762f87ffdb5d30c398eb46a5b8bba41b3664de2cd6f5e5cb340cc93e882d7564c979ac910a4d450894e2bdc51457b53df0029d6d89d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\msvcp140_atomic_wait.dll

Filesize
55KB

MD5
ecf37f3231d5552b6968f3b25cf2ff07

SHA1
cf5a6236046e56215de1e262c5ab7ff1bb51eed5

SHA256
1583bbc399c921343ae9f9ca3be74a52b9478d971dcd1624d73a0d652bbd547d

SHA512
56593279751c52de360f963a5a25460260a630ba314cbd7b97f0f4d94c8be5f43ee9645fe40f677bd45a13d0137fdbfc43c43d9950ecb7990e81df4aa1a8a07f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\vcruntime140.dll

Filesize
95KB

MD5
251bab3694c10f7705e7db0c6db87d2f

SHA1
d6c978b56232a189a4de1c88e05bbdc21ea4a6e8

SHA256
20c3e4f0de55ac7ed97ff99f06bfe1db6d1cbf4402ff3af85fa333586e84989d

SHA512
2ccfc6d405f00355523dbc28801eed1cf765bbe8f1687eb7c4705dfa1f849718f19acb413ad1630bca3edcca5d835746170fe3b23e14edd1802ace1e4b864696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\vcruntime140.dll

Filesize
95KB

MD5
251bab3694c10f7705e7db0c6db87d2f

SHA1
d6c978b56232a189a4de1c88e05bbdc21ea4a6e8

SHA256
20c3e4f0de55ac7ed97ff99f06bfe1db6d1cbf4402ff3af85fa333586e84989d

SHA512
2ccfc6d405f00355523dbc28801eed1cf765bbe8f1687eb7c4705dfa1f849718f19acb413ad1630bca3edcca5d835746170fe3b23e14edd1802ace1e4b864696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\vcruntime140_1.dll

Filesize
36KB

MD5
fb8f2dfc53a3dd3d841217ebdf54abf1

SHA1
2dcb8919b1df84b9b8b1de9887fbf5d767b7bcff

SHA256
79e7aa5832a28181876c00fce449697d8df4ae2bf56308571fff001b16ee6bbf

SHA512
7b8fca50ad58b9919053fb5479c0487a6cbbcd88caeccb911fc01e64814d6b73c15d0cd466c6604108ea583191360f729a59c934c1b6a22d8158e89dd2ccf37a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\23.107.0521.0001\vcruntime140_1.dll

Filesize
36KB

MD5
fb8f2dfc53a3dd3d841217ebdf54abf1

SHA1
2dcb8919b1df84b9b8b1de9887fbf5d767b7bcff

SHA256
79e7aa5832a28181876c00fce449697d8df4ae2bf56308571fff001b16ee6bbf

SHA512
7b8fca50ad58b9919053fb5479c0487a6cbbcd88caeccb911fc01e64814d6b73c15d0cd466c6604108ea583191360f729a59c934c1b6a22d8158e89dd2ccf37a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Business1\settings\Microsoft.ListSync.Settings.db

Filesize
16KB

MD5
8ca2cafabfdb5935fa9bc93d4febb672

SHA1
a1b5388f0673360f65a106fbdf617b475b9520f5

SHA256
90dbaac238a66912fc52f30717a4948fd10ad991370d587f2b834004b0299072

SHA512
64aa7350e693693fd8f9b82c964a22cd4848eadb63f8dcbcf210a9c42dc4cfd42e0c16d8e907c44aed9023d050a6c9a58938af1215df378659298c7786d1faa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\NucleusUpdateRingConfig.json

Filesize
74KB

MD5
fd3bfdbb42299877e334e2551f7ed7b8

SHA1
8a6757d6c3367141724759aaed13b2a01dcdc8ae

SHA256
d6e3cff30abd33747f3fb42ab4aae4a297a3d49caeddb980913aa3aa8d04594a

SHA512
8b763b48ce8308437047e33bb5cb74e05207c193c6d35bc77f02e4084ef66bf1ad9f2d524a2d65e6938b4a99f69ae07847e4294bf4ffa34e14c033c9d5687211

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe

Filesize
4.0MB

MD5
7e01917fd596842fc8eaa63c66050363

SHA1
adf8a7bed48509bf6b170cfc4bac7e1f1f74c32f

SHA256
5cada5c75dd81608cad8c819c353e980cbd95fd6e2bc3cce1d379eec02543146

SHA512
a00b50d8a08dbb986d622f6a991d063d05ab07341713b7ec80f75874693141d4316ac9428be2e9120b13e4f4c562d520e5f01eb0f026c7910b4b214fd9560baa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe

Filesize
4.0MB

MD5
7e01917fd596842fc8eaa63c66050363

SHA1
adf8a7bed48509bf6b170cfc4bac7e1f1f74c32f

SHA256
5cada5c75dd81608cad8c819c353e980cbd95fd6e2bc3cce1d379eec02543146

SHA512
a00b50d8a08dbb986d622f6a991d063d05ab07341713b7ec80f75874693141d4316ac9428be2e9120b13e4f4c562d520e5f01eb0f026c7910b4b214fd9560baa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
8f40e559a798f91fd8accf0e35b801c1

SHA1
72b3aee65acdeaece3be5b0087627d36e35597c8

SHA256
372fd3deb515af9534164d1aa91c5143c8feeb5f06ced7be00a708fc7b2bfaa3

SHA512
29fa4745e357c9627d8404a6fa3c78191fa10e8da80f74a2f84cd05140305598ac0bc228709e0acceb222d47ca2db3d632709bdfe47d62be3cabe6d87e0c1799

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\MicrosoftEdgeWebview2Setup.exe

Filesize
1.5MB

MD5
8f40e559a798f91fd8accf0e35b801c1

SHA1
72b3aee65acdeaece3be5b0087627d36e35597c8

SHA256
372fd3deb515af9534164d1aa91c5143c8feeb5f06ced7be00a708fc7b2bfaa3

SHA512
29fa4745e357c9627d8404a6fa3c78191fa10e8da80f74a2f84cd05140305598ac0bc228709e0acceb222d47ca2db3d632709bdfe47d62be3cabe6d87e0c1799

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe

Filesize
58.3MB

MD5
e8e4139d999a7ddb1d5ebcc031c9c812

SHA1
d3ac821ee3238d54e020f926182a666f919d0441

SHA256
b2d59ac23187e6bb48410052e8a1ef5970fab6a27a7cd60e80a2ccdf3c5d4798

SHA512
7b6268c53fd8430afbccecc91cc87c68d15203baa6162137a0f168c6822c952c708ba5c69ca7769f9e43ee673bd4fcbbc94eb5a18842e1d7fed9a1f9ca962cc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe

Filesize
58.3MB

MD5
e8e4139d999a7ddb1d5ebcc031c9c812

SHA1
d3ac821ee3238d54e020f926182a666f919d0441

SHA256
b2d59ac23187e6bb48410052e8a1ef5970fab6a27a7cd60e80a2ccdf3c5d4798

SHA512
7b6268c53fd8430afbccecc91cc87c68d15203baa6162137a0f168c6822c952c708ba5c69ca7769f9e43ee673bd4fcbbc94eb5a18842e1d7fed9a1f9ca962cc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe

Filesize
58.3MB

MD5
e8e4139d999a7ddb1d5ebcc031c9c812

SHA1
d3ac821ee3238d54e020f926182a666f919d0441

SHA256
b2d59ac23187e6bb48410052e8a1ef5970fab6a27a7cd60e80a2ccdf3c5d4798

SHA512
7b6268c53fd8430afbccecc91cc87c68d15203baa6162137a0f168c6822c952c708ba5c69ca7769f9e43ee673bd4fcbbc94eb5a18842e1d7fed9a1f9ca962cc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe

Filesize
58.3MB

MD5
e8e4139d999a7ddb1d5ebcc031c9c812

SHA1
d3ac821ee3238d54e020f926182a666f919d0441

SHA256
b2d59ac23187e6bb48410052e8a1ef5970fab6a27a7cd60e80a2ccdf3c5d4798

SHA512
7b6268c53fd8430afbccecc91cc87c68d15203baa6162137a0f168c6822c952c708ba5c69ca7769f9e43ee673bd4fcbbc94eb5a18842e1d7fed9a1f9ca962cc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\PreSignInSettingsConfig.json

Filesize
74KB

MD5
fd3bfdbb42299877e334e2551f7ed7b8

SHA1
8a6757d6c3367141724759aaed13b2a01dcdc8ae

SHA256
d6e3cff30abd33747f3fb42ab4aae4a297a3d49caeddb980913aa3aa8d04594a

SHA512
8b763b48ce8308437047e33bb5cb74e05207c193c6d35bc77f02e4084ef66bf1ad9f2d524a2d65e6938b4a99f69ae07847e4294bf4ffa34e14c033c9d5687211

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bozzcyfh.default-release\activity-stream.discovery_stream.json.tmp

Filesize
146KB

MD5
4d65e87729f6afd1f7fd8d4104b6761d

SHA1
bd65c9234a8809d49bc6df18165ed203ca0d1b2c

SHA256
849d986fa3d9254163c9729b1aafb7cb69ba72b32efc124277ca94f147565a1b

SHA512
8435e30469772c21321ccb912bf6e85f6f0e0768a54ad4effffc8382e0a15f82bb62e8b8614ba00e96edb708d512446bf46f4b1c86e4939e2814797c30b8a238

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bozzcyfh.default-release\cache2\entries\58D46C4012E4AD3623A4EA72BB3C1CDD25B3FF87

Filesize
14KB

MD5
63ed03aea0ec096d6d9007fbb7e2eafb

SHA1
8a95d2809d93e1098c53fbbcaf0632fdc8a93e29

SHA256
b481380a3bf04751c6560d8937a346c07fe401d97618dcfe4171fff65f0be3f7

SHA512
7a564ddd8b2e314c0a9cc089863631329d2c8b610324bb4a78d3dac6cc4d82c13e06cb9b6140999dc43c3e51249fd18d4ea219cbe9a1bfe8c4184ea513215f8a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bozzcyfh.default-release\safebrowsing-updating\ads-track-digest256-1.vlpset

Filesize
54KB

MD5
4f9ef3d3a71d4cb49e623e3f4b7b1162

SHA1
c2d65973b44b051d043475e9387fa7100514acbd

SHA256
48ae004f3c542ac764dd5a1e894918ec4b250b5c1f7209256c191cae13106b1f

SHA512
f7017204ad37ceedbff4e8b58ab4edac75748d2f36693e59ea9d9157f637d29b53c6405d994ac9fc62712f2574013e95c4817ff49229c78dcc23cac805b13ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp782.tmp

Filesize
53.1MB

MD5
27bc2110acc80333efa8b652151d56a6

SHA1
f7db132c55db4bcbf11b71be48c4b66413d042a0

SHA256
a4c793654eb6a2d4c92096496b437e2baf637efb119cb2ec00bbdc54d56e3c5b

SHA512
228d6e2f7b18121014f94f6367b2406be2dfcac08e07330f3fd9f60d620d540c54397ccaba7c839760aca4e490f9a820247afeb6db31d5eaf7574e901716ba03

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js

Filesize
6KB

MD5
13567381251dbd8a476b21abf81b5071

SHA1
c1151c46c6857cf8e5f6282e088e7a573917b4e3

SHA256
0ee0d8e3ba71e7e3ff90b4ad00c5c6171d372be3be6113d20279c0a85dbe7ded

SHA512
b418bb69355be575200672a34439d21af226cb58bcaef66c59d2ab00f1f5af450dea657d55e8166bd2db83e72ad7b155d17cc1ed69252decfeafded9b12e581d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js

Filesize
7KB

MD5
6b3a35a1a121c1a631b58b7480db4c51

SHA1
4327c786d8cf606a9227605f6002c18e8f18b2c2

SHA256
9c8e1cea8b0d218379f5e5fbbc8040082ff6d1c08b0778a0f134c0014ca0e1e9

SHA512
7fcf260f00045f45fcac659a88529c4d0357c66d4450410831271c83c5a20defe8f8b6035fc5b33c4b62f48c5344c95ff72bc8aae9f0d17f68755bd39282423e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js

Filesize
6KB

MD5
e9978597b5c9f8c943ed243257a9578f

SHA1
8901f3f0d3428d7ed3aaa86a87f10ab9d0214520

SHA256
78a34d189be7886da73822bc8a059403db3dd84956d704ad1d479fa3b5f5abde

SHA512
22039d6081cefc142d68096db2e8406fa9302b37884e58bebae7b2b8089c2087172d640ac84fd8abe79a8e3460319470f9fee8925db24bce24efa191a387729a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\prefs-1.js

Filesize
6KB

MD5
308239c2c1d46a47fd34bc9bc4c28f56

SHA1
d6b9e343de8eb1a7e8784d026ee477575dd3330c

SHA256
ec31544f7c5818f614847f01e4fe3e9bf0dd9b02886baf5a28ee5e16c18b063a

SHA512
24fd55926c7de6f8b04edd9b701d4463e42d65a0954d16fc19389540fdd151a57f9d7cacc156faa355b527a4554b87401155ce559218b7c6fa024e3f856ea42f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bozzcyfh.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
7f2aba0861efac59d743174337191b5a

SHA1
e3fcc9a42339dcdfc7fc99aff1532e10bacd90ab

SHA256
e2b8880bbcc96236a01188a73846433a10525b8aebdfed4fe8ad0d224d8145b7

SHA512
ef482f98b57b53b917e791ca6a7cbfb50d2b205b2ec24f2b7d809a5bdd3cd8d66c8f6688154bb94f057c92f66389bc70fa6619801c5332419b450ff0b80140d7

Download Submit