Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2641s -
max time network
2645s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04/03/2024, 13:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://mega.sb
Resource
win10v2004-20240226-en
General
-
Target
http://mega.sb
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation OneDriveSetup.exe -
Executes dropped EXE 6 IoCs
pid Process 5072 OneDriveSetup.exe 3316 OneDriveSetup.exe 5332 FileSyncConfig.exe 5444 OneDrive.exe 5344 dismhost.exe 3300 FileCoAuth.exe -
Loads dropped DLL 54 IoCs
pid Process 5332 FileSyncConfig.exe 5332 FileSyncConfig.exe 5332 FileSyncConfig.exe 5332 FileSyncConfig.exe 5332 FileSyncConfig.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5344 dismhost.exe 5344 dismhost.exe 5344 dismhost.exe 5344 dismhost.exe 5344 dismhost.exe 3300 FileCoAuth.exe 3300 FileCoAuth.exe 3300 FileCoAuth.exe 3300 FileCoAuth.exe 3300 FileCoAuth.exe 3300 FileCoAuth.exe 3300 FileCoAuth.exe 1780 UserOOBEBroker.exe -
Modifies system executable filetype association 2 TTPs 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}" OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}" OneDrive.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\ThreadingModel = "Apartment" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\"" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuthLib.dll" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\LocalServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /cci /client=Personal" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\"" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileSyncShell.dll" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileSyncShell.dll" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\LocalServer32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\"" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\"" OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\LocalServer32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\ThreadingModel = "Apartment" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileSyncShell.dll" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\ThreadingModel = "Both" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\amd64\\FileSyncShell64.dll" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32 OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}\LocalServer32 OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\LocalServer32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /autoplay" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\LocalServer32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ThreadingModel = "Apartment" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\amd64\\FileSyncShell64.dll" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\amd64\\FileSyncShell64.dll" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\LocalServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\"" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileSyncShell.dll" OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ThreadingModel = "Apartment" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe /autoplay" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\LocalServer32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\ThreadingModel = "Both" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe" OneDrive.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\"" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\"" OneDriveSetup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 227 raw.githubusercontent.com -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 salinewin.exe -
Checks system information in the registry 2 TTPs 6 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OneDriveSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OneDriveSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OneDrive.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OneDrive.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OneDriveSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OneDriveSetup.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\system32\devmgmt.msc mmc.exe File opened for modification C:\Windows\system32\LogFiles\setupcln\setuperr.log cleanmgr.exe File opened for modification C:\Windows\system32\LogFiles\setupcln\diagerr.xml cleanmgr.exe File opened for modification C:\Windows\system32\LogFiles\setupcln\diagwrn.xml cleanmgr.exe File opened for modification C:\Windows\system32\LogFiles\setupcln\setupact.log cleanmgr.exe -
Drops file in Windows directory 63 IoCs
description ioc Process File created C:\Windows\INF\c_processor.PNF mmc.exe File created C:\Windows\INF\c_proximity.PNF mmc.exe File created C:\Windows\INF\rdcameradriver.PNF mmc.exe File created C:\Windows\INF\c_fsinfrastructure.PNF mmc.exe File created C:\Windows\INF\c_fsvirtualization.PNF mmc.exe File created C:\Windows\INF\c_fsundelete.PNF mmc.exe File opened for modification C:\Windows\Logs\DISM\dism.log cleanmgr.exe File created C:\Windows\INF\c_cashdrawer.PNF mmc.exe File created C:\Windows\INF\c_fsquotamgmt.PNF mmc.exe File created C:\Windows\INF\rawsilo.PNF mmc.exe File created C:\Windows\INF\c_fsphysicalquotamgmt.PNF mmc.exe File created C:\Windows\INF\c_fsopenfilebackup.PNF mmc.exe File created C:\Windows\INF\c_fsantivirus.PNF mmc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml UserOOBEBroker.exe File created C:\Windows\INF\oposdrv.PNF mmc.exe File created C:\Windows\INF\c_fssystem.PNF mmc.exe File created C:\Windows\INF\PerceptionSimulationSixDof.PNF mmc.exe File created C:\Windows\INF\c_fssecurityenhancer.PNF mmc.exe File created C:\Windows\INF\xusb22.PNF mmc.exe File created C:\Windows\INF\c_display.PNF mmc.exe File created C:\Windows\INF\c_volume.PNF mmc.exe File created C:\Windows\INF\c_fsencryption.PNF mmc.exe File created C:\Windows\INF\miradisp.PNF mmc.exe File created C:\Windows\INF\dc1-controller.PNF mmc.exe File created C:\Windows\INF\c_sslaccel.PNF mmc.exe File created C:\Windows\INF\c_scmvolume.PNF mmc.exe File created C:\Windows\INF\c_fscontinuousbackup.PNF mmc.exe File opened for modification C:\Windows\Panther\UnattendGC\setupact.log UserOOBEBroker.exe File created C:\Windows\INF\c_extension.PNF mmc.exe File created C:\Windows\INF\c_ucm.PNF mmc.exe File created C:\Windows\INF\digitalmediadevice.PNF mmc.exe File created C:\Windows\INF\c_smrdisk.PNF mmc.exe File created C:\Windows\INF\c_apo.PNF mmc.exe File created C:\Windows\INF\c_receiptprinter.PNF mmc.exe File created C:\Windows\INF\c_fscopyprotection.PNF mmc.exe File created C:\Windows\INF\c_camera.PNF mmc.exe File created C:\Windows\INF\c_fshsm.PNF mmc.exe File created C:\Windows\INF\c_holographic.PNF mmc.exe File created C:\Windows\INF\c_mcx.PNF mmc.exe File created C:\Windows\INF\c_fsreplication.PNF mmc.exe File created C:\Windows\INF\c_diskdrive.PNF mmc.exe File created C:\Windows\INF\c_smrvolume.PNF mmc.exe File created C:\Windows\INF\c_swcomponent.PNF mmc.exe File created C:\Windows\INF\c_fscfsmetadataserver.PNF mmc.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log UserOOBEBroker.exe File created C:\Windows\INF\remoteposdrv.PNF mmc.exe File created C:\Windows\INF\c_magneticstripereader.PNF mmc.exe File created C:\Windows\INF\c_media.PNF mmc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml UserOOBEBroker.exe File created C:\Windows\INF\c_linedisplay.PNF mmc.exe File created C:\Windows\INF\c_firmware.PNF mmc.exe File opened for modification C:\Windows\Logs\DISM\dism.log dismhost.exe File created C:\Windows\INF\c_scmdisk.PNF mmc.exe File created C:\Windows\INF\c_barcodescanner.PNF mmc.exe File created C:\Windows\INF\c_computeaccelerator.PNF mmc.exe File created C:\Windows\INF\c_fscontentscreener.PNF mmc.exe File created C:\Windows\INF\c_fscompression.PNF mmc.exe File created C:\Windows\INF\ts_generic.PNF mmc.exe File created C:\Windows\INF\c_fsactivitymonitor.PNF mmc.exe File created C:\Windows\INF\wsdprint.PNF mmc.exe File created C:\Windows\INF\c_fssystemrecovery.PNF mmc.exe File created C:\Windows\INF\c_monitor.PNF mmc.exe File created C:\Windows\INF\c_netdriver.PNF mmc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0004 cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0015 cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0004 cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0004 cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0015 cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0015 cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0004 cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0015 cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 cleanmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID cleanmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 OneDrive.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OneDrive.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 11 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch OneDrive.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION OneDrive.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\IESettingSync OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION OneDrive.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" OneDrive.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\FileSyncClient.AutoPlayHandler\CurVer OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Interface\{2692D1F2-2C7C-4AE0-8E73-8F37736C912D} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{c1439245-96b4-47fc-b391-679386c5d40f}\TypeLib\Version = "1.0" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{1B71F23B-E61F-45C9-83BA-235D55F50CF9}\ProxyStubClsid32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{2387C6BD-9A36-41A2-88ED-FF731E529384}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_CLASSES\WOW6432NODE\INTERFACE\{0299ECA9-80B6-43C8-A79A-FB1C5F19E7D8}\PROXYSTUBCLSID32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{0299ECA9-80B6-43C8-A79A-FB1C5F19E7D8}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Interface\{EE15BBBB-9E60-4C52-ABCB-7540FF3DF6B3} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{2387C6BD-9A36-41A2-88ED-FF731E529384}\ = "ISetItemPropertiesCallback" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_CLASSES\TYPELIB\{F904F88C-E60D-4327-9FA2-865AD075B400}\1.0\FLAGS OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Interface\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\TypeLib\{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}\1.0 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{6A821279-AB49-48F8-9A27-F6C59B4FF024}\ = "IOneDriveInfoProvider" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\ProxyStubClsid32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{31508CC7-9BC7-494B-9D0F-7B1C7F144182}\TypeLib\Version = "1.0" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}\TypeLib OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32 OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\ProxyStubClsid32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Interface\{1B71F23B-E61F-45C9-83BA-235D55F50CF9}\TypeLib OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\FileSyncClient.FileSyncClient\CLSID OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Interface\{B54E7079-90C9-4C62-A6B8-B2834C33A04A} OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{6A821279-AB49-48F8-9A27-F6C59B4FF024} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Interface\{31508CC7-9BC7-494B-9D0F-7B1C7F144182}\ProxyStubClsid32 OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\TypeLib\{082D3FEC-D0D0-4DF6-A988-053FECE7B884}\1.0\HELPDIR OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{466F31F7-9892-477E-B189-FA5C59DE3603}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\TypeLib OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{10C9242E-D604-49B5-99E4-BF87945EF86C} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\TypeLib\{082D3FEC-D0D0-4DF6-A988-053FECE7B884}\1.0\FLAGS\ = "0" OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{c1439245-96b4-47fc-b391-679386c5d40f}\ProxyStubClsid32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32\ThreadingModel = "Apartment" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\VersionIndependentProgID\ = "StorageProviderUriSource.StorageProviderUriSource" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{8B9F14F4-9559-4A3F-B7D0-312E992B6D98}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{049FED7E-C3EA-4B66-9D92-10E8085D60FB} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{0299ECA9-80B6-43C8-A79A-FB1C5F19E7D8}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Interface\{e9de26a1-51b2-47b4-b1bf-c87059cc02a7}\TypeLib OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E} OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\LocalServer32 OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Interface\{c1439245-96b4-47fc-b391-679386c5d40f}\TypeLib\Version = "1.0" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Interface\{d8c80ebb-099c-4208-afa3-fbc4d11f8a3c}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\TypeLib OneDrive.exe Key deleted \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Interface\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{b5c25645-7426-433f-8a5f-42b7ff27a7b2}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{c1439245-96b4-47fc-b391-679386c5d40f} OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Interface\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\ProxyStubClsid32\ = "{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}" OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\SyncEngineFileInfoProvider.SyncEngineFileInfoProvider\CurVer\ = "SyncEngineFileInfoProvider.SyncEngineFileInfoProvider.1" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\LocalServer32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Interface\{1B71F23B-E61F-45C9-83BA-235D55F50CF9}\TypeLib OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\Programmable OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\CLSID = "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}" FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\TypeLib\{C9F3F6BB-3172-4CD8-9EB7-37C9BE601C87}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_CLASSES\SYNCENGINECOMSERVER.SYNCENGINECOMSERVER\CURVER OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Interface\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\ProxyStubClsid32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\ = "IDeviceHeroShotCallback" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2}\ProxyStubClsid32 OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\odopen\UseOriginalUrlEncoding = "1" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\TypeLib OneDrive.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\WOW6432Node\Interface\{944903E8-B03F-43A0-8341-872200D2DA9C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDrive.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\TypeLib OneDriveSetup.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 5888 reg.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4308 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 6 IoCs
pid Process 5104 WINWORD.EXE 5104 WINWORD.EXE 1676 WINWORD.EXE 1676 WINWORD.EXE 668 OneDrive.exe 5444 OneDrive.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 1436 msedge.exe 1436 msedge.exe 1888 msedge.exe 1888 msedge.exe 2300 identity_helper.exe 2300 identity_helper.exe 668 OneDrive.exe 668 OneDrive.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5072 OneDriveSetup.exe 5072 OneDriveSetup.exe 5072 OneDriveSetup.exe 5072 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 3316 OneDriveSetup.exe 5444 OneDrive.exe 5444 OneDrive.exe 3592 msedge.exe 3592 msedge.exe 1524 msedge.exe 1524 msedge.exe 3052 msedge.exe 3052 msedge.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 5048 mmc.exe 6020 cleanmgr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 36 IoCs
pid Process 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe -
Suspicious use of AdjustPrivilegeToken 54 IoCs
description pid Process Token: SeShutdownPrivilege 3272 control.exe Token: SeCreatePagefilePrivilege 3272 control.exe Token: 33 5048 mmc.exe Token: SeIncBasePriorityPrivilege 5048 mmc.exe Token: 33 5048 mmc.exe Token: SeIncBasePriorityPrivilege 5048 mmc.exe Token: SeIncreaseQuotaPrivilege 5072 OneDriveSetup.exe Token: SeIncreaseQuotaPrivilege 3316 OneDriveSetup.exe Token: SeBackupPrivilege 6020 cleanmgr.exe Token: SeRestorePrivilege 6020 cleanmgr.exe Token: 33 1996 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1996 AUDIODG.EXE Token: SeCreateGlobalPrivilege 4452 dwm.exe Token: SeChangeNotifyPrivilege 4452 dwm.exe Token: 33 4452 dwm.exe Token: SeIncBasePriorityPrivilege 4452 dwm.exe Token: SeShutdownPrivilege 4452 dwm.exe Token: SeCreatePagefilePrivilege 4452 dwm.exe Token: SeShutdownPrivilege 4452 dwm.exe Token: SeCreatePagefilePrivilege 4452 dwm.exe Token: SeShutdownPrivilege 4452 dwm.exe Token: SeCreatePagefilePrivilege 4452 dwm.exe Token: SeShutdownPrivilege 4452 dwm.exe Token: SeCreatePagefilePrivilege 4452 dwm.exe Token: SeShutdownPrivilege 4452 dwm.exe Token: SeCreatePagefilePrivilege 4452 dwm.exe Token: SeShutdownPrivilege 4452 dwm.exe Token: SeCreatePagefilePrivilege 4452 dwm.exe Token: SeShutdownPrivilege 4452 dwm.exe Token: SeCreatePagefilePrivilege 4452 dwm.exe Token: SeShutdownPrivilege 4452 dwm.exe Token: SeCreatePagefilePrivilege 4452 dwm.exe Token: SeShutdownPrivilege 4452 dwm.exe Token: SeCreatePagefilePrivilege 4452 dwm.exe Token: SeShutdownPrivilege 4452 dwm.exe Token: SeCreatePagefilePrivilege 4452 dwm.exe Token: SeShutdownPrivilege 4452 dwm.exe Token: SeCreatePagefilePrivilege 4452 dwm.exe Token: SeShutdownPrivilege 4452 dwm.exe Token: SeCreatePagefilePrivilege 4452 dwm.exe Token: SeShutdownPrivilege 4452 dwm.exe Token: SeCreatePagefilePrivilege 4452 dwm.exe Token: SeShutdownPrivilege 4452 dwm.exe Token: SeCreatePagefilePrivilege 4452 dwm.exe Token: SeShutdownPrivilege 4452 dwm.exe Token: SeCreatePagefilePrivilege 4452 dwm.exe Token: SeShutdownPrivilege 4452 dwm.exe Token: SeCreatePagefilePrivilege 4452 dwm.exe Token: SeShutdownPrivilege 4452 dwm.exe Token: SeCreatePagefilePrivilege 4452 dwm.exe Token: SeShutdownPrivilege 4452 dwm.exe Token: SeCreatePagefilePrivilege 4452 dwm.exe Token: SeShutdownPrivilege 4452 dwm.exe Token: SeCreatePagefilePrivilege 4452 dwm.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 668 OneDrive.exe 668 OneDrive.exe 668 OneDrive.exe 668 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe -
Suspicious use of SendNotifyMessage 56 IoCs
pid Process 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 668 OneDrive.exe 668 OneDrive.exe 668 OneDrive.exe 668 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe 1888 msedge.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 5048 mmc.exe 5048 mmc.exe 5104 WINWORD.EXE 5104 WINWORD.EXE 5104 WINWORD.EXE 5104 WINWORD.EXE 5104 WINWORD.EXE 5104 WINWORD.EXE 5104 WINWORD.EXE 1676 WINWORD.EXE 1676 WINWORD.EXE 1676 WINWORD.EXE 1676 WINWORD.EXE 1676 WINWORD.EXE 1676 WINWORD.EXE 1676 WINWORD.EXE 668 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 5444 OneDrive.exe 4304 salinewin.exe 5388 salinewin.exe 5916 salinewin.exe 4404 salinewin.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1888 wrote to memory of 752 1888 msedge.exe 88 PID 1888 wrote to memory of 752 1888 msedge.exe 88 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 868 1888 msedge.exe 89 PID 1888 wrote to memory of 1436 1888 msedge.exe 90 PID 1888 wrote to memory of 1436 1888 msedge.exe 90 PID 1888 wrote to memory of 1212 1888 msedge.exe 91 PID 1888 wrote to memory of 1212 1888 msedge.exe 91 PID 1888 wrote to memory of 1212 1888 msedge.exe 91 PID 1888 wrote to memory of 1212 1888 msedge.exe 91 PID 1888 wrote to memory of 1212 1888 msedge.exe 91 PID 1888 wrote to memory of 1212 1888 msedge.exe 91 PID 1888 wrote to memory of 1212 1888 msedge.exe 91 PID 1888 wrote to memory of 1212 1888 msedge.exe 91 PID 1888 wrote to memory of 1212 1888 msedge.exe 91 PID 1888 wrote to memory of 1212 1888 msedge.exe 91 PID 1888 wrote to memory of 1212 1888 msedge.exe 91 PID 1888 wrote to memory of 1212 1888 msedge.exe 91 PID 1888 wrote to memory of 1212 1888 msedge.exe 91 PID 1888 wrote to memory of 1212 1888 msedge.exe 91 PID 1888 wrote to memory of 1212 1888 msedge.exe 91 PID 1888 wrote to memory of 1212 1888 msedge.exe 91 PID 1888 wrote to memory of 1212 1888 msedge.exe 91 PID 1888 wrote to memory of 1212 1888 msedge.exe 91 PID 1888 wrote to memory of 1212 1888 msedge.exe 91 PID 1888 wrote to memory of 1212 1888 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://mega.sb1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb867646f8,0x7ffb86764708,0x7ffb867647182⤵PID:752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:22⤵PID:868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2992 /prefetch:82⤵PID:1212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2968 /prefetch:12⤵PID:3296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:2208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:12⤵PID:4424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:12⤵PID:448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:82⤵PID:1548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:12⤵PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:12⤵PID:3396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:12⤵PID:4176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:12⤵PID:1884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:12⤵PID:2196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3880 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2760 /prefetch:12⤵PID:5756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2636 /prefetch:12⤵PID:5716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:12⤵PID:2188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:12⤵PID:3712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2272 /prefetch:82⤵PID:4968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5780 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:12⤵PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:12⤵PID:5132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:12⤵PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:12⤵PID:5316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:12⤵PID:6088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:12⤵PID:5640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:12⤵PID:1860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:12⤵PID:4336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:12⤵PID:5904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:12⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:12⤵PID:5672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1972 /prefetch:12⤵PID:2412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3028 /prefetch:82⤵PID:5128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:12⤵PID:1976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6776 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:6140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:12⤵PID:6136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:12⤵PID:3956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7128 /prefetch:12⤵PID:4892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:12⤵PID:4804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:12⤵PID:1072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:12⤵PID:5952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:12⤵PID:4336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17388837232140408552,5073580621265262949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6792 /prefetch:12⤵PID:5232
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3648
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4696
-
C:\Windows\system32\control.exe"C:\Windows\system32\control.exe" /name Microsoft.DeviceManager1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3272 -
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5048
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵PID:1316
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Files.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5104
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Recently.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1676
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"1⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:668 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart2⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5072 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Registers COM server for autorun
- Adds Run key to start application
- Checks system information in the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3316 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5332
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe/updateInstalled /background4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Registers COM server for autorun
- Checks system information in the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5444
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:976
-
C:\Windows\System32\cleanmgr.exe"C:\Windows\System32\cleanmgr.exe" /D C1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\241E942D-8394-4317-8E48-292A4EFF57B3\dismhost.exeC:\Users\Admin\AppData\Local\Temp\241E942D-8394-4317-8E48-292A4EFF57B3\dismhost.exe {080E1991-0DDD-416D-9DB5-18A544D0076D}2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:5344
-
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1780
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileCoAuth.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileCoAuth.exe" -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3300
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault97489febh7d72h4236ha5c2h3257c55c187a1⤵PID:464
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x108,0x12c,0x7ffb867646f8,0x7ffb86764708,0x7ffb867647182⤵PID:4148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3017363701235024740,18061867286508125404,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:22⤵PID:5780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,3017363701235024740,18061867286508125404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3592
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_salinewin.zip\readme.txt1⤵
- Opens file in notepad (likely ransom note)
PID:4308
-
C:\Users\Admin\Desktop\salinewin.exe"C:\Users\Admin\Desktop\salinewin.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f2⤵PID:5788
-
C:\Windows\SysWOW64\reg.exeREG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f3⤵
- Modifies registry key
PID:5888
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f0 0x3441⤵
- Suspicious use of AdjustPrivilegeToken
PID:1996
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4452
-
C:\Users\Admin\Desktop\salinewin.exe"C:\Users\Admin\Desktop\salinewin.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:5388
-
C:\Users\Admin\Desktop\salinewin.exe"C:\Users\Admin\Desktop\salinewin.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:5916
-
C:\Users\Admin\Desktop\salinewin.exe"C:\Users\Admin\Desktop\salinewin.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:4404
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Change Default File Association
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
Filesize471B
MD565e34169290dc14e531b56c87638eae3
SHA14fe20f7b22c1cf008966277693617c7fe5279807
SHA256210a76b10bfbb9ace3426c73bb7e4d66ccbfe6454d4e5149083d721427f54482
SHA5127502bf627e9e748a0da14019ef526ac162f8bca9d619076c79ab06a6248e5625a7d3e96e86de950fe171193b2bddbffdcb4ba23cee833af86ad4558330b4f66e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
Filesize412B
MD50cd7351afb6c8db99c05fe5ad00b0fcc
SHA11ca67aad92375c9f9db0e3f232465359d33a19c3
SHA256a5403b8a8a15ce79d00d211396cf91e9d0ffe8d7811de5fa13ab6612ebf193ae
SHA512f57a7299cb9dae25d72c6cb6d98d0780adc24697fe493f64e2a5d087e6abceaaf6ff646f44e0b90ea931d0cb8c18bd96f5aae89305332eb91a841863ec1f2206
-
Filesize
152B
MD5cbec32729772aa6c576e97df4fef48f5
SHA16ec173d5313f27ba1e46ad66c7bbe7c0a9767dba
SHA256d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e
SHA512425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0
-
Filesize
152B
MD534e3f8a801e516ffe03376f78a8f4185
SHA127c4fbc447793098152e84f8dfa5a502e1971558
SHA256699f84eb9111da3d1f36a677b68ba1f8fbaae03771efdc638e0b535e38dbd979
SHA512189d30a8718d675f1a895a74755a1c1b2b052948e3794bc6da48e1e6d5cdf3e1d3cf8a3fe5a09c960a91ffe25d35621b180db00c06426c0c578300bcfe409e11
-
Filesize
152B
MD5279e783b0129b64a8529800a88fbf1ee
SHA1204c62ec8cef8467e5729cad52adae293178744f
SHA2563619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932
SHA51232730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b
-
Filesize
62KB
MD5c3c0eb5e044497577bec91b5970f6d30
SHA1d833f81cf21f68d43ba64a6c28892945adc317a6
SHA256eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb
SHA51283d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38
-
Filesize
69KB
MD5a127a49f49671771565e01d883a5e4fa
SHA109ec098e238b34c09406628c6bee1b81472fc003
SHA2563f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6
SHA51261b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734
-
Filesize
31KB
MD5acd3f8bcdca044e4382c0bb6246b0234
SHA11c83d89a3c40835a82f06e6bea0af86f52901bc5
SHA256cec8af8be960f3b13ad0f554c338ab88688ae5b4ddfcda5471fc8268ce66db25
SHA5123cbf100cc72f4a63c7aebe0ec029fc3635b97addbb0a4e83febbd127e00ff1455fc0b4cb90839f3bec498a7cdb848d8fde4d6991cc6a1f479669e70ad220b5a1
-
Filesize
63KB
MD5710d7637cc7e21b62fd3efe6aba1fd27
SHA18645d6b137064c7b38e10c736724e17787db6cf3
SHA256c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b
SHA51219aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44
-
Filesize
19KB
MD52e86a72f4e82614cd4842950d2e0a716
SHA1d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA256c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
SHA5127a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
-
Filesize
84KB
MD574e33b4b54f4d1f3da06ab47c5936a13
SHA16e5976d593b6ee3dca3c4dbbb90071b76e1cd85c
SHA256535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287
SHA51279218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2
-
Filesize
1.1MB
MD5e1cf0357a84c0444b5fe3675c35051d4
SHA1e8172404b99394ac54def8bc9f2b0665790cf29f
SHA2569a9ad5e3cc5ff2e497c051cf20825843ac6a4ae406f0149ea1f065e2752a0898
SHA51262f3e8cbe49a79ea3e57505a5268129e2447f7563e4b3cb049e780b205253212889fadf81c8ff3bc399f09b7a525a025c7cf07edd1a4046a18394b147b486d8a
-
Filesize
33KB
MD53cd0f2f60ab620c7be0c2c3dbf2cda97
SHA147fad82bfa9a32d578c0c84aed2840c55bd27bfb
SHA25629a3b99e23b07099e1d2a3c0b4cff458a2eba2519f4654c26cf22d03f149e36b
SHA512ef6e3bbd7e03be8e514936bcb0b5a59b4cf4e677ad24d6d2dfca8c1ec95f134ae37f2042d8bf9a0e343b68bff98a0fd748503f35d5e9d42cdaa1dc283dec89fb
-
Filesize
74KB
MD5bc9faa8bb6aae687766b2db2e055a494
SHA134b2395d1b6908afcd60f92cdd8e7153939191e4
SHA2564a725d21a3c98f0b9c5763b0a0796818d341579817af762448e1be522bc574ed
SHA512621386935230595c3a00b9c53ea25daa78c2823d32085e22363dc438150f1cb6b3d50be5c58665886fac2286ae63bf1f62c8803cb38a0cac201c82ee2db975c4
-
Filesize
40KB
MD53051c1e179d84292d3f84a1a0a112c80
SHA1c11a63236373abfe574f2935a0e7024688b71ccb
SHA256992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3
SHA512df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff
-
Filesize
53KB
MD568f0a51fa86985999964ee43de12cdd5
SHA1bbfc7666be00c560b7394fa0b82b864237a99d8c
SHA256f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f
SHA5123049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7
-
Filesize
2KB
MD5ffcef5b4b27a0a2e3d50b1003e3f0663
SHA1b3b6dc40cd0c252a85d3a63ac00f1d2a217134dd
SHA256f78013bb990e03238ba1ee58e795952ed97abf95c47bd20ab143829bc78b3a32
SHA5122dcbc9a76c9ec21a2ddfe7cb595626c54ac7dea3979a9d57b5fa64f235ac87565a9971389e2209cb55df7b09d22f1030812a06089688bf4c9aafabdbba2c72c2
-
Filesize
13KB
MD59c62608fb8cbf4d4e208efb21974a98d
SHA11a884f50a51f8f43a4d7be9c8b3507f596455157
SHA2566778ed27c5de8579692eed87b6fbc942b5ebfbfd93551382f57b63716bdf514f
SHA51254d7ad38b21acc091453aed7e09c08cc7f2a83d5b2ce3779130d35f018ba578dfe25acd6df6dfe2e26c2bf107593bebcbf16e883f7c5b04ad11088b8116da182
-
Filesize
1KB
MD555e3cad5366954eb0d80169188249196
SHA1739106fd6e1bdaf0d879efebf955f7804a1291d7
SHA2560e5886ef639b07facd80841bbda8c3832cac7f3b1ba10b2a5a1eb8a971e3501d
SHA51247dde0dd0427727caa4fe5131618d30b8969f7b4aceb204e26386be1b0a03a249e361620c4d4854d0a74657fc9aaf398335ddac6b6359cf9bf96e02f23e8b871
-
Filesize
3KB
MD5114d82e9d082944e1c479f08f9c81b2a
SHA1911dad5638a8072b42c628aac6d655b75e8c72a9
SHA256548c520c07e67bd4f7c23d327797a18b8a3174437e506791e248e4911cc3a94f
SHA512dceeaf97264fc902ed6be55021636906f1f7ea04ebb3427ca390be858dc0f36714d4493933c473c5b41a8343bb86d1607618e34d991c0fe5119c3d40c163e751
-
Filesize
8KB
MD55b02c0b65387a7ea227f9be8e56e65b2
SHA133a6ec8f9969ac06863b66d99a98fbf2bd23357d
SHA2567666243f3decf37c843f13a1845f657961d0b9e4ac06b16a1bf0c25efdb979c4
SHA512c13f73eebb81c1c58fdbbed29154c9e84d990c93305db01851d9e0dbcd655adaf9ef35ce6e1e41764aaea59a9267bc81cb3e182ceca38f3bb0b0e3b9bc594d64
-
Filesize
950B
MD5c5e8ce25445cc94488f550d6f6c9d2cd
SHA18d4be496bec16da388b480c8f230485a03dc9696
SHA256cd25e0e45566e1070a117529e76758ed708773965bc15dee8e7b09f7025f5a97
SHA512e04a26bf942eb29b3bc39e16025b4bcedb912fd39551d23fffa154018f35b767756c66814c26db4a2b3210ddf27de8f4b701d314187f52cf89336084664968ff
-
Filesize
8KB
MD56cabb99c1532ccae8088b06fbe1bdf89
SHA18e23a8df23362f2bb540926942c3e570e10b3e75
SHA256977ba31d7817eba6f3b4b2a169608de6fbf0bddbea9c515baddb693aadbe818e
SHA51242ff77214adc501cd419bc1e8783b170f8334f1013627fad37417e98ee62cb6458b17dd5970a6c6cd9dd8fb6db03fce0727060f321d72eb33bba6220e8bcee32
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD50bce4b4ebf360a6c7ea3632f56a5718a
SHA115221e469a672d7a08bb039baa8efea370098aa6
SHA2569ac7f1f6ffe9a06ed788846a48940dd6ef6b6711ade1669fe83a896957c9231e
SHA512c66707838b8b457950afea1f445bf28ed9daf900ec61ef98e1ccf2c0d6adb0cdbe6770d24594339f4214afd256c872389754dd26c34eca395dda45ce6483a70d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD51c13a8de44ca03ac2c0fe411a41046f7
SHA1e468c55d2451383347b5a692f836dcf2497eae9d
SHA25617d67914568e5616c6723a9ec7c498b80094456cfaf2c7b653b095ac12de5e34
SHA512e295d2fefbf9dd445f9ac117e37277e615a7ec172203776be752ad195a20967815c41f726612253266fabf024435fd8dc4e140c1a56969ba1f12651e7fe85367
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD581868691718d3e1d349996a3655ec1b0
SHA18f248ed831e513d889123d80784a8eed793756fd
SHA256266658489a346bb8e0c58a9de036bf7c9e446e1d136b0725c72a7f3c03d52a6b
SHA512826b3b7b129065737ac59ef7cea84ca29d6772df2e006fcaf894b98004a4abcedef75e819603a49e22079205cd0b2afa8715ee398b684511989efefa763f92cc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD53899723bbcb5bb29c5ae80c395f8e13f
SHA10c34a8e6ffe2b54803aef9a8fb073f4bfda1c8fa
SHA25604197b6ed195413c57e535f7a0b6b0da4a257529637e8ad5c4b01d9b51a0612a
SHA512febce8b4259d98e6190fa0a78d1d4bb9e94bc16a16e78a70c8d97dc25e76e0a05d9fdc9ac300a7c94bd64fe118bb723fe5b09f42bf6c3cba4f95d6d1b7b68878
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD5b505d4a7a5dd23ad6e164bc87deccf9d
SHA1b01d30650461c1cc241ac3512741b712a6c780e3
SHA256b4baf9d2b656a4bb2dc56020691847beb93061e042255e5d47b4a9fd927cf6f5
SHA512253615c0cb481117204630278d2598497db5adcbe6cadeb4603ce4dafe2304f62f0599e6e8cfa8b0fbac11c64651f648069666f53e7a6877cf1d83890183c974
-
Filesize
1KB
MD5a69fced341b78822630247db5f568e13
SHA1537e4ae7cf4ee4a43d38b111c2b83247ae45e9f1
SHA25659037e1b4ed34b1cd7ba9bd9071e73c331443f5a1d31d6f2881d5a83abaf5c2b
SHA512c20720a02beb9cd982803363852054dd19012139cbc054c56dff71a8c32cd71643bb1efbcac60c72032a4571accb07656939093a3159f1a33f36b9b777cda2f0
-
Filesize
1KB
MD570817c74ea986737797a3093c2a7e60a
SHA1f8f77f32b027c126771635e49443014f7cc079a0
SHA2564f49ee206990a7befe5ed103b70254dd690c628d05488a4ddde550d032de8e72
SHA5129d1659ff2cac11d6b064eb6d3c6bcd60a217814c6acb6f884947c3f619921cfe0dcc300cd314d347d0d6d7a451057df9b6606b1668a3c26d63818887970a69f6
-
Filesize
788B
MD58ce3d551ba3f216e148fd58367fa4a6a
SHA1fbb461d7045e11ab476b1b5460bf79ebc235cf87
SHA25691986ad868c0bbd029787a240fdad00493bb391955b731620ce9ee6526a30456
SHA512107b0a686a75f5c96f68e4050cda53fd28b15ae80a55896439b9dbedd052f1aff960a3961251b2fd969edecf056af311ede939966f32d832a921fd29064aba10
-
Filesize
1KB
MD5a5a26e5044f7af37cceafa31e930c78f
SHA1769687913ce70daee3a6b997e5f939b3b4b50c91
SHA2568c339f3f5151dee5ccca1fe70431c6e0813d5336b28071cc239f029a8090e0a0
SHA51241edfc67fac119f02bfe10a4ae89b9d355ae73a137896209b0e975b64007ac854eb5628bbc919e033f79ce6bad33a637ab81447b8475f2e5fd8eb973fa49aa38
-
Filesize
7KB
MD52625077a6a7cdfb5fa2b898339891138
SHA18dbb0ad758bbe8967126f0ed8fc5f9d6563fbc7c
SHA256f8c62e55afd638b45f8b9965b7635b89c3aaabcbb3ed6ba5d108ad1d4724a299
SHA5124c8256cc0fd18cdf5cfd213af0e358d4f8ee98b01717fbc81186769879140f6fa6d855879c355ff11bf97850f37a7965a253453a99f7ad249e293b8f71966714
-
Filesize
7KB
MD54dd1a73959df5c43209f5fe93f019f03
SHA1ee75069385bbcbdd3775a902b0135c776c66cd54
SHA256dcca5bc3239efd3d912f84638439c0f12bb159b3a7f60942d14c3cbc23ee193c
SHA512a71dd4c4da15bf306fe28d16bc67eb96ef2b2d524080856d97e5a2d9a23161815db95499791c8e6f5e178392b5481ca73ec814312e8c12ce9f9462508e41bc3a
-
Filesize
6KB
MD541405f5da21a0d5ffcc71be3e96e43dc
SHA148d306b7e4963d8c626722a010b4ea404361aa65
SHA256a5836fc3a601438d28e9c6b6f1540f0758ae0fa78c7d9402e1db8a4445a37b5d
SHA512bcb8993ce8091c8acc4cd24e2ccf06aa88b7e60dd99dd88e61ba40081356b4b2923d81e273b51ef2488c1ff131bd5950e286614fb86144d14096079d9cef8dcf
-
Filesize
7KB
MD556501d05dd293765445b7c8aa248312d
SHA170e87dcbe4141a391ba5e4c170c4deb81db1480c
SHA256443ea1a9f1ad90b099a38bdd08e47010b54bed3fc3f3cf2804d4cd51811051c0
SHA51208d32fda29fe5f5e01f84da20d906323ecb6ccfccd61e7a3409ec484bc7cf343883d366642a901db812d7dc3fd04a4068fed46ff51b1d24225e4de44aeae087f
-
Filesize
7KB
MD565a8b1a0cc2b32176eaee9b60343727b
SHA1b17f3263715d30904bbeb5fe52e9122144e94529
SHA2567fd2dcd602bec03ac029d691205dc933da965cdb0c72531cedf859ce80ec7059
SHA512ee9d035cc59afca78a6ca64a23ad057876f437bd77a83a04fdac635d7a06d58421d76e20c29108612593a212ec3fc57d2bbad29749656858059bf1b3e36e1b6b
-
Filesize
7KB
MD5a1a1a95a6a51671217959dc68b44da29
SHA1725e2c7a038f719fae8e290c0ba2efef5780c21d
SHA256d279edba0cbf1d07d37d277c9cfd87ccc0cb70b7a7a8b1238d891c194b92c46c
SHA5126c8f18dc405af06739a98b21544f6aa6d5cbfd271dc79b956dcb1a2853869b39f07408340d37ca0dc04f7ab4da5a50f81f6becfdd73dbfe8e5ba53d029d8fa3b
-
Filesize
6KB
MD58e8191487f5b505af28f954045d6c7fc
SHA1cbb612e61e8821371df17ec2eaa9076299698803
SHA2565dd2d905e5ab9326ed13a70d47559d90da6965cd428bf0e1bd6be56d771df80c
SHA51229443734449991a7515ebcb685d851fdc2709ce2490a08894613d9cf5042576c4d6cfcbbf17414de11d510f09250fe482345d2962fa7e721508751af20f2a715
-
Filesize
7KB
MD58cd2d0034a472bbfdbc55d4c2b0e6aaa
SHA1352d92cf98ab633246656a7b7e5502b382783d5a
SHA2569a71fd7f054a9839aacd4579fd6b3f2bcc6d10e1f45b667a045fc71e5c5cbba5
SHA512e4705863bab4395fb603f23d63448559973f333a6546b469870a34be749a237a0249b49f0c98e8a423a7450470611cb60c79505b93a5d1e63d5dd7892337af6f
-
Filesize
7KB
MD5fde3a901ec2c17e19ba49b3c27aa7887
SHA14b30297e4c2ad27aa0eea03064e2d60756b506bf
SHA256412c601d080fee36c746323cae8bc1e10307385ad9e2456cf7c0e047e4dff250
SHA5124096cb06c3338b251173ef410acc41d992ebaf12f9bcfb9cb52544b9d04c8cdea6e24989ad4382f860ac7ce2125dd67656bda30adc444b8934092a1f5f09a308
-
Filesize
6KB
MD51403d62ce461c7a64ad2c6649ba24445
SHA1fd54cab9d2422588ef256a37ce6d306e397ee771
SHA256d4cddb7257d1903fb102f0a5be55366145e3ff9fb9c0508d908a20df56f67366
SHA512dc9c00c63519ff16b7b23fc9eb40811bdfd6fedfc8e073d0416be0d177889ba1f9adf8c0c5d164fbcb11f6e56243519e23cbbfad6c0b5335d9b3d99e24ccc043
-
Filesize
7KB
MD50761e8c7cce9fe39f42288368e10cfaf
SHA18a4dbfdea65f5a4ed9cc6750edcf3dadd477abbe
SHA2568221a60eed997fdcb31967a4fea4251195888264db1c034e351f9667a9b1d5f0
SHA51200bee5dd3c3632ab53e33debba4bac27b294c74bfe2788b295fbba6a1166b94709bdebc17ed02dd48ffce02b95c4f2037560388705ec446a24740b10be1de611
-
Filesize
7KB
MD5490ea89eb7c5f626794500b69acfb68c
SHA196d82424ac04406bc75bf6470ed7b6d7d2adeaa4
SHA256d70d48cf61ee55ad9ac01e0856255b4b64ce0f353a39c0be0ec4dc303f5486c7
SHA5125811fbeeb8588b60c8b7eb9446f08a7028cc9c48262780be8a189973b1324cec032ea125cf3474ae50477ee04dfdbeb4b0cf7e5104d6160ecad14d4de02dcde9
-
Filesize
6KB
MD57eea653a79f4229aae38af87732a6f03
SHA1095a0acba6e74f0938d4da0f8f3fab46b807473e
SHA256f2323cf09145a59dfda33a0e24785a0389e5dc699453ec8d89f05ce59247c7dc
SHA5124ebde479422d23f57537217f95c0a6061ef0d1ec4a0c40921258fe8a5b5abcdc245eb5cc7a46da78fc7afb52152b298ad5f205f1404211e9797204d95082ae9e
-
Filesize
538B
MD5b2a758dc28f6200544180a07e7b47998
SHA12e89466919a49924b064a2f111fdb6c5e1b2881c
SHA2566db12cd04770a9ff26f6fa9a7d300c05569c29c1f57d1a52f42c95aaad42030f
SHA51217e018dcae21eecbad8ac2a47aba352e6f4e0364d5ae6ce88c6530832e71819b36700a69be071672e385c1ac10e364e79aa803e5beb6ba4e66908e6259e2c83a
-
Filesize
1KB
MD53c5302f7ae46b2875d2a90feb7fcc7e7
SHA1d2e5335e8ef723e6edf5787f148495741b12c317
SHA256cec0f4a4b51a99615d6cf0bba93df66c976572e3b2e5b567df27ad26025e0b27
SHA5124f70a8d72037ee5c4fe876bbbd7a695811f967bb1e7a7ee10816f8860ba3b3184d118dd112b5b29b98a2471b25eab684ea5cc7158f4e2e1338881f6340961270
-
Filesize
1KB
MD5a4085494f2736d3feb46b3c691c72562
SHA1c79748b68119985df1f2b2294266068c66e9d363
SHA256ebdb4f18b1fa07126692390395aee00eec39dee006313b9746fee3bae77725db
SHA512d1740b1ad306a65c5f1eec088abf0401777faf3616152f9f31d0a85d72e422a831d11bdbbf812dbd2c2cd756d9b501d69411ecc647555ea1d1bbed4aa20bb30a
-
Filesize
1KB
MD5adaf72cc16d0e354df0ed50db118e084
SHA14256a86ebefa93f22fba3f21c45ceb0489cfb49f
SHA256de565f64c095a3885e34b21eeee0e753ef4e2541789779d88a1efdd0fa49e7aa
SHA512b81f54df9b04538e9c1e3850dcef2f3272d4ed906587353aca2dde0457d6a0198e1aef9e82ddfee87a5ae1caf878b9d4748bf4d91bf4b755d6c8da55ce67d566
-
Filesize
1KB
MD57f9877c62f1cf1f30e1b3617ffea6520
SHA1dec533707dfae2f5c60381be0bac1e0171e88de8
SHA256bd5e07309683f8f3e6032bd8aae0c64879639a023dc2cea3419d50fd9b7b61e9
SHA51234a4083f3b5d6ede6675b3d34c04379cbf35a87ffc2baad2329352128585bb69036c5999c70d7f027d3782fb0742f2bb119bf08f6758f15564b01c7176b9f591
-
Filesize
1KB
MD52243e6e2e14cd2ef28184b438ad0ed67
SHA17939dc3d1ac28211f3f9a6567876adee2f045726
SHA256f9cbc69fe99fa0d542f19f0ef35874bae788afa7a582e60905ee5c933b0633f7
SHA51268dd256c33dcc91be4c64f8a8bcfffd2b7e2018fd0ed46ff5bcb0dbfa6eb15d4780acd774f42e584633bbb7f41f2c9c9110fbbdf35e86b18cb322e3249b2f267
-
Filesize
1KB
MD5d87a8c4516ab64b0502bf13717c91fc5
SHA1e44ee340b7e39b83b343536851f2e804afebd763
SHA25662c9468a714e90deb13de6ee6853f784fe764cde5879c084ff349b678df3eb3a
SHA512aabcf6606dddd382820ddc2e3545ba5e88b1d749aa271fa1feb101d27bebb79779fbbeb7af17450a84af7aeb00e217dd2508d38c0dfe01cc2003eeb9f820e0b5
-
Filesize
538B
MD5169eba07ae0870a3f367e1d5d2f0bda4
SHA1f636e9fc0d2258724deb8d7e10b72828fcb2589c
SHA2562af3ab2044a9c9f467e5eb1ef338f82689551cbef1fa5bfe2cb7e6f42af722e3
SHA5129b45072d0b3a78f233e3f4aaca29da1c956514b5d4c3245e96380b74113659d4e3596e4c7983e62e1412b7839a843438df632bff91abf9a50171c73ab46de10f
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f3aea249-af7b-42c6-a0cc-984a5d997c94.tmp
Filesize1KB
MD541dc97189ac3adcdcbe19c89096fb089
SHA12ee54279334fc1979b60a3046ebc8fb817fcba14
SHA2565654255412da7a37ecd231fd31ff253785a9b8bc0c898603cad5512c2e48539e
SHA5125502b716641ad94e0694cc3a4aef46fac3da5d7c7e11398cf5792b4a08fd3f1c5c61dcd8ebd633b44f0829efb15ad599ecc1ee5df1f0f85b6aa090bc9455a4df
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f5ba29f9-b723-4c7e-98b1-9733e1655e3c.tmp
Filesize6KB
MD5698cfe6acba35cacd644cf7b770b061e
SHA1ed3f3c191ce12d38bb1d39ebcfa208a3e2cc023f
SHA256f3a0d577111c2b0aea9338ba7aba0ec63f4f111a07a6c34eb75c67f44955bd20
SHA512b8dee5710ca6e007776cb76e5761f0cc3d933fc1d7de715ccd8bb60ad0568e4a23377456a5a3ee3112cad778409550e5c0a18c36e9da60eefcf2480ac90e4ecf
-
Filesize
12KB
MD50ecf6465b7f4fa9d805edd70e6b4bf24
SHA1f347e7303696eff4ffb2a788a6ea10a540066e4a
SHA25696f4361e01199bfa9f2fb2928cb6b7a971d64a66b3a72dcc5f07bb82aedbd802
SHA512179bd562b372aa8e7538c59de8835f1322b74bc83ac968b9a367154f9db64c557b11220969a85d3f64b349d60fc05e19119cf681231a2ac43f1aa4558143dc38
-
Filesize
12KB
MD5e0369880c2ec1aad248b9f24cc6038c0
SHA1701a5751c8f5562b0a077dcc37d7f62bea2d45cf
SHA256723566055e7ca3f60304d3c1483f3397a5152cf0a0bc8fd3e63ccf709e85c0dc
SHA512e8f93512f3c60c227778e1d6faa5c249da9b8669fe4b2c6b72e747ce73653d23869b976673cab6ca29df4f5840677b5c8b8412064b7c11e9fb426f9665ff93a8
-
Filesize
11KB
MD58a938805397b268a9b00a76345f439a5
SHA10ace6274da56c96c0dc7877b05048a6f71358cc6
SHA2567333648c04ea20937f3bceebaf88902d131c012a13b217ec0d4c0c51c271d767
SHA512033e52228c3b86222e01fbba99681d79e2fc2b6e36b45a95140310e1c166ec6bd76128296a0896040246fab345b91b64b81f26c53d957e53815bf0b8cd2b18e1
-
Filesize
21B
MD5f1b59332b953b3c99b3c95a44249c0d2
SHA11b16a2ca32bf8481e18ff8b7365229b598908991
SHA256138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c
SHA5123c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4
-
Filesize
417B
MD5c56ff60fbd601e84edd5a0ff1010d584
SHA1342abb130dabeacde1d8ced806d67a3aef00a749
SHA256200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c
SHA512acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e
-
Filesize
87B
MD5e4e83f8123e9740b8aa3c3dfa77c1c04
SHA15281eae96efde7b0e16a1d977f005f0d3bd7aad0
SHA2566034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31
SHA512bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9
-
Filesize
14B
MD56ca4960355e4951c72aa5f6364e459d5
SHA12fd90b4ec32804dff7a41b6e63c8b0a40b592113
SHA25688301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3
SHA5128544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\F50D5F57-4DC1-4686-86AD-8C293EC9AC6A
Filesize160KB
MD53022274914dbc9501362ad0f8b30e88c
SHA1924369d0b96c0366e3cf805538aa0e42ee5fe317
SHA2562812e48a9a0405bc126faad61aab05098f877dacd3f88805708e0bc7c8c5db1d
SHA51204da8752dfbcca2d747081b8152c383f24c7a3203e83de293e08755465957ae943f2e1d280ee93dd51a69d18b870aa118018fd4aab3b5de3b2d5c7b1ecd5af49
-
Filesize
76B
MD50f8eb2423d2bf6cb5b8bdb44cb170ca3
SHA1242755226012b4449a49b45491c0b1538ebf6410
SHA256385347c0cbacdd3c61d2635fbd390e0095a008fd75eeb23af2f14f975c083944
SHA512a9f23a42340b83a2f59df930d7563e8abd669b9f0955562cd3c2872e2e081f26d6d8b26357972b6d0423af05b2392bddbb46da769788e77fd169b3264ff53886
-
Filesize
24KB
MD5b00f3f56c104c94e03cd2ad8452c14e7
SHA151b78e45015e0d9d62fbdf31b75a22535a107204
SHA256ba2b669020334ff01a85bfc900ea4371ea557bd315f154875d9bdfdc16ae8b50
SHA51293e1609be5bbb414c285f37432ce93294c3d1583ef46c7c6c570c122f0b166c34b0ad87de708005c8af97dee27923ba53395a34c2563cdadf3c0a708848b3525
-
Filesize
1.4MB
MD54376a318fe4e7f85d0a0d0f5dd4c338b
SHA1bb6e04a8d0ddab58103cc8d560f96d3035c8e6cb
SHA2568243271a9c1ce201ad664368ef65cbdd9e0b6cfcca7547d344d502bf4314f012
SHA5122d0168ae170e37b62542e2a74a3a686ef65130466eddc0c66eb8bc8ad18e38b3c3bf5423bbed09fea8a3848450130d9afbe19b52e1c3f96d650a52a4d6f5cf5e
-
Filesize
1.4MB
MD5dc51ef91fe18167e3a6e28918393ecc9
SHA15ebaaedc4d6f70e5cea8ceaef0ffc79b24814b69
SHA256665d1c9631ef994ffda08d3ee54d0d5eae5bbe18735840b9a4cef0fb3beb342b
SHA51210442b19c28e5b2848ebaee615685ebd87ff692d21b42c9d14b5befa99c72b0e8ff10c2e9377506fc3373ba8ba9dfa27b5dd869950f508f99384c93c4e136aac
-
Filesize
553KB
MD557bd9bd545af2b0f2ce14a33ca57ece9
SHA115b4b5afff9abba2de64cbd4f0989f1b2fbc4bf1
SHA256a3a4b648e4dcf3a4e5f7d13cc3d21b0353e496da75f83246cc8a15fada463bdf
SHA512d134f9881312ddbd0d61f39fd62af5443a4947d3de010fef3b0f6ebf17829bd4c2f13f6299d2a7aad35c868bb451ef6991c5093c2809e6be791f05f137324b39
-
Filesize
1.5MB
MD5275e8b6346d33e9c7ff34e7e7a8d4568
SHA1c4ae7a8d24a79a524c9ca03fb29646b925749bc3
SHA25665d9807fb74fc4cf95e0a56fe58425268b403e8259996e3b4193c587727a3272
SHA5122bb98cdba1d231ede518e3be9ad45bbabb25397683f1d0e35299e901b500789cbf446eeb212dbbc1ffb19ef9bb73447890aaba86b8c347f2b2d1f216b6a2a740
-
Filesize
1.4MB
MD565568cead64cd1db871a83ac485f9e40
SHA1858f252fd7a5458805bbf4d9e06c4400a030a1ad
SHA256cb90834cf73b417ba2b7d2d1a61a2e6e7e05abdf11d513d82b8adb704a8e62f1
SHA5122c79c938ad6630531356b7bf5db23493cb91a590c31a54d377f03fa785445e28b802c5b5eadc44a322a956a21b6a5e23c275939fb0c7f7a2c9a471d551a99c4e
-
Filesize
58KB
MD551b6038293549c2858b4395ca5c0376e
SHA193bf452a6a750b52653812201a909c6bc1f19fa3
SHA256a742c9e35d824b592b3d9daf15efb3d4a28b420533ddf35a1669a5b77a00bb75
SHA512b8cfdab124ee424b1b099ff73d0a6c6f4fd0bf56c8715f7f26dbe39628a2453cd63d5e346dbf901fcbfb951dfbd726b288466ff32297498e63dea53289388c0c
-
Filesize
769KB
MD503f13c5ec1922f3a0ec641ad4df4a261
SHA1b23c1c6f23e401dc09bfbf6ce009ce4281216d7e
SHA256fe49f22bb132fedf1412e99169d307fa715dbdd84fe71c3e3ff12300d30d4987
SHA512b47dbd9fad9467f72d4d0d5ca9df508247176f9e11b537c750837e8b3782a2d20f31fad361153d816ddf7f5e8109a614f3c6e4e2307af69cd3e2506cc0515d81
-
Filesize
504KB
MD54ffef06099812f4f86d1280d69151a3f
SHA1e5da93b4e0cf14300701a0efbd7caf80b86621c3
SHA256d5a538a0a036c602492f9b2b6f85de59924da9ec3ed7a7bbf6ecd0979bee54d3
SHA512d667fd0ae46039914f988eb7e407344114944a040468e4ec5a53d562db2c3241737566308d8420bb4f7c89c6ef446a7881b83eaac7daba3271b81754c5c0f34a
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-100.png
Filesize1KB
MD572747c27b2f2a08700ece584c576af89
SHA15301ca4813cd5ff2f8457635bc3c8944c1fb9f33
SHA2566f028542f6faeaaf1f564eab2605bedb20a2ee72cdd9930bde1a3539344d721b
SHA5123e7f84d3483a25a52a036bf7fd87aac74ac5af327bb8e4695e39dada60c4d6607d1c04e7769a808be260db2af6e91b789008d276ccc6b7e13c80eb97e2818aba
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-125.png
Filesize1KB
MD5b83ac69831fd735d5f3811cc214c7c43
SHA15b549067fdd64dcb425b88fabe1b1ca46a9a8124
SHA256cbdcf248f8a0fcd583b475562a7cdcb58f8d01236c7d06e4cdbfe28e08b2a185
SHA5124b2ee6b3987c048ab7cc827879b38fb3c216dab8e794239d189d1ba71122a74fdaa90336e2ea33abd06ba04f37ded967eb98fd742a02463b6eb68ab917155600
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-150.png
Filesize2KB
MD5771bc7583fe704745a763cd3f46d75d2
SHA1e38f9d7466eefc6d3d2aaa327f1bd42c5a5c7752
SHA25636a6aad9a9947ab3f6ac6af900192f5a55870d798bca70c46770ccf2108fd62d
SHA512959ea603abec708895b7f4ef0639c3f2d270cfdd38d77ac9bab8289918cbd4dbac3c36c11bb52c6f01b0adae597b647bb784bba513d77875979270f4962b7884
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-200.png
Filesize2KB
MD509773d7bb374aeec469367708fcfe442
SHA12bfb6905321c0c1fd35e1b1161d2a7663e5203d6
SHA25667d1bb54fcb19c174de1936d08b5dbdb31b98cfdd280bcc5122fb0693675e4f2
SHA512f500ea4a87a24437b60b0dc3ec69fcc5edbc39c2967743ddb41093b824d0845ffddd2df420a12e17e4594df39f63adad5abb69a29f8456fed03045a6b42388bc
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-400.png
Filesize6KB
MD5e01cdbbd97eebc41c63a280f65db28e9
SHA11c2657880dd1ea10caf86bd08312cd832a967be1
SHA2565cb8fd670585de8a7fc0ceede164847522d287ef17cd48806831ea18a0ceac1f
SHA512ffd928e289dc0e36fa406f0416fb07c2eb0f3725a9cdbb27225439d75b8582d68705ec508e3c4af1fc4982d06d70ef868cafbfc73a637724dee7f34828d14850
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-100.png
Filesize2KB
MD519876b66df75a2c358c37be528f76991
SHA1181cab3db89f416f343bae9699bf868920240c8b
SHA256a024fc5dbe0973fd9267229da4ebfd8fc41d73ca27a2055715aafe0efb4f3425
SHA51278610a040bbbb026a165a5a50dfbaf4208ebef7407660eea1a20e95c30d0d42ef1d13f647802a2f0638443ae2253c49945ebe018c3499ddbf00cfdb1db42ced1
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-125.png
Filesize3KB
MD58347d6f79f819fcf91e0c9d3791d6861
SHA15591cf408f0adaa3b86a5a30b0112863ec3d6d28
SHA256e8b30bfcee8041f1a70e61ca46764416fd1df2e6086ba4c280bfa2220c226750
SHA5129f658bc77131f4ac4f730ed56a44a406e09a3ceec215b7a0b2ed42d019d8b13d89ab117affb547a5107b5a84feb330329dc15e14644f2b52122acb063f2ba550
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-150.png
Filesize3KB
MD5de5ba8348a73164c66750f70f4b59663
SHA11d7a04b74bd36ecac2f5dae6921465fc27812fec
SHA256a0bbe33b798c3adac36396e877908874cffaadb240244095c68dff840dcbbf73
SHA51285197e0b13a1ae48f51660525557cceaeed7d893dd081939f62e6e8921bb036c6501d3bb41250649048a286ff6bac6c9c1a426d2f58f3e3b41521db26ef6a17c
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-200.png
Filesize4KB
MD5f1c75409c9a1b823e846cc746903e12c
SHA1f0e1f0cf35369544d88d8a2785570f55f6024779
SHA256fba9104432cbb8ebbd45c18ef1ba46a45dd374773e5aa37d411bb023ded8efd6
SHA512ed72eb547e0c03776f32e07191ce7022d08d4bcc66e7abca4772cdd8c22d8e7a423577805a4925c5e804ed6c15395f3df8aac7af62f1129e4982685d7e46bd85
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-400.png
Filesize8KB
MD5adbbeb01272c8d8b14977481108400d6
SHA11cc6868eec36764b249de193f0ce44787ba9dd45
SHA2569250ef25efc2a9765cf1126524256fdfc963c8687edfdc4a2ecde50d748ada85
SHA512c15951cf2dc076ed508665cd7dac2251c8966c1550b78549b926e98c01899ad825535001bd65eeb2f8680cd6753cd47e95606ecf453919f5827ed12bca062887
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-100.png
Filesize2KB
MD557a6876000151c4303f99e9a05ab4265
SHA11a63d3dd2b8bdc0061660d4add5a5b9af0ff0794
SHA2568acbdd41252595b7410ca2ed438d6d8ede10bd17fe3a18705eedc65f46e4c1c4
SHA512c6a2a9124bc6bcf70d2977aaca7e3060380a4d9428a624cc6e5624c75ebb6d6993c6186651d4e54edf32f3491d413714ef97a4cdc42bae94045cd804f0ad7cba
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-125.png
Filesize4KB
MD5d03b7edafe4cb7889418f28af439c9c1
SHA116822a2ab6a15dda520f28472f6eeddb27f81178
SHA256a5294e3c7cd855815f8d916849d87bd2357f5165eb4372f248fdf8b988601665
SHA51259d99f0b9a7813b28bae3ea1ae5bdbbf0d87d32ff621ff20cbe1b900c52bb480c722dd428578dea5d5351cc36f1fa56b2c1712f2724344f026fe534232812962
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-150.png
Filesize5KB
MD5a23c55ae34e1b8d81aa34514ea792540
SHA13b539dfb299d00b93525144fd2afd7dd9ba4ccbf
SHA2563df4590386671e0d6fee7108e457eb805370a189f5fdfeaf2f2c32d5adc76abd
SHA5121423a2534ae71174f34ee527fe3a0db38480a869cac50b08b60a2140b5587b3944967a95016f0b00e3ca9ced1f1452c613bb76c34d7ebd386290667084bce77d
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-200.png
Filesize6KB
MD513e6baac125114e87f50c21017b9e010
SHA1561c84f767537d71c901a23a061213cf03b27a58
SHA2563384357b6110f418b175e2f0910cffe588c847c8e55f2fe3572d82999a62c18e
SHA512673c3bec7c2cd99c07ebfca0f4ab14cd6341086c8702fe9e8b5028aed0174398d7c8a94583da40c32cd0934d784062ad6db71f49391f64122459f8bb00222e08
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-400.png
Filesize15KB
MD5e593676ee86a6183082112df974a4706
SHA1c4e91440312dea1f89777c2856cb11e45d95fe55
SHA256deb0ec0ee8f1c4f7ea4de2c28ff85087ee5ff8c7e3036c3b0a66d84bae32b6bb
SHA51211d7ed45f461f44fa566449bb50bcfce35f73fc775744c2d45ea80aeb364fe40a68a731a2152f10edc059dea16b8bab9c9a47da0c9ffe3d954f57da0ff714681
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png
Filesize783B
MD5f4e9f958ed6436aef6d16ee6868fa657
SHA1b14bc7aaca388f29570825010ebc17ca577b292f
SHA256292cac291af7b45f12404f968759afc7145b2189e778b14d681449132b14f06b
SHA512cd5d78317e82127e9a62366fd33d5420a6f25d0a6e55552335e64dc39932238abd707fe75d4f62472bc28a388d32b70ff08b6aa366c092a7ace3367896a2bd98
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png
Filesize1018B
MD52c7a9e323a69409f4b13b1c3244074c4
SHA13c77c1b013691fa3bdff5677c3a31b355d3e2205
SHA2568efeacefb92d64dfb1c4df2568165df6436777f176accfd24f4f7970605d16c2
SHA512087c12e225c1d791d7ad0bf7d3544b4bed8c4fb0daaa02aee0e379badae8954fe6120d61fdf1a11007cbcdb238b5a02c54f429b6cc692a145aa8fbd220c0cb2d
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png
Filesize1KB
MD5552b0304f2e25a1283709ad56c4b1a85
SHA192a9d0d795852ec45beae1d08f8327d02de8994e
SHA256262b9a30bb8db4fc59b5bc348aa3813c75e113066a087135d0946ad916f72535
SHA5129559895b66ef533486f43274f7346ad3059c15f735c9ce5351adf1403c95c2b787372153d4827b03b6eb530f75efcf9ae89db1e9c69189e86d6383138ab9c839
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png
Filesize1KB
MD522e17842b11cd1cb17b24aa743a74e67
SHA1f230cb9e5a6cb027e6561fabf11a909aa3ba0207
SHA2569833b80def72b73fca150af17d4b98c8cd484401f0e2d44320ecd75b5bb57c42
SHA5128332fc72cd411f9d9fd65950d58bf6440563dc4bd5ce3622775306575802e20c967f0ee6bab2092769a11e2a4ea228dab91a02534beeb8afde8239dd2b90f23a
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png
Filesize3KB
MD53c29933ab3beda6803c4b704fba48c53
SHA1056fe7770a2ba171a54bd60b3c29c4fbb6d42f0c
SHA2563a7ef7c0bda402fdaff19a479d6c18577c436a5f4e188da4c058a42ef09a7633
SHA51209408a000a6fa8046649c61ccef36afa1046869506f019f739f67f5c1c05d2e313b95a60bd43d9be882688df1610ad7979dd9d1f16a2170959b526ebd89b8ef7
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-100.png
Filesize1KB
MD51f156044d43913efd88cad6aa6474d73
SHA11f6bd3e15a4bdb052746cf9840bdc13e7e8eda26
SHA2564e11167708801727891e8dd9257152b7391fc483d46688d61f44b96360f76816
SHA512df791d7c1e7a580e589613b5a56ba529005162d3564fffd4c8514e6afaa5eccea9cea9e1ac43bd9d74ee3971b2e94d985b103176db592e3c775d5feec7aac6d1
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-125.png
Filesize2KB
MD509f3f8485e79f57f0a34abd5a67898ca
SHA1e68ae5685d5442c1b7acc567dc0b1939cad5f41a
SHA25669e432d1eec44bed4aad35f72a912e1f0036a4b501a50aec401c9fa260a523e3
SHA5120eafeaf735cedc322719049db6325ccbf5e92de229cace927b78a08317e842261b7adbda03ec192f71ee36e35eb9bf9624589de01beaec2c5597a605fc224130
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-150.png
Filesize3KB
MD5ed306d8b1c42995188866a80d6b761de
SHA1eadc119bec9fad65019909e8229584cd6b7e0a2b
SHA2567e3f35d5eb05435be8d104a2eacf5bace8301853104a4ea4768601c607ddf301
SHA512972a42f7677d57fcb8c8cb0720b21a6ffe9303ea58dde276cfe2f26ee68fe4cc8ae6d29f3a21a400253de7c0a212edf29981e9e2bca49750b79dd439461c8335
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-200.png
Filesize4KB
MD5d9d00ecb4bb933cdbb0cd1b5d511dcf5
SHA14e41b1eda56c4ebe5534eb49e826289ebff99dd9
SHA25685823f7a5a4ebf8274f790a88b981e92ede57bde0ba804f00b03416ee4feda89
SHA5128b53dec59bba8b4033e5c6b2ff77f9ba6b929c412000184928978f13b475cd691a854fee7d55026e48eab8ac84cf34fc7cb38e3766bbf743cf07c4d59afb98f4
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-400.png
Filesize11KB
MD5096d0e769212718b8de5237b3427aacc
SHA14b912a0f2192f44824057832d9bb08c1a2c76e72
SHA2569a0b901e97abe02036c782eb6a2471e18160b89fd5141a5a9909f0baab67b1ef
SHA51299eb3d67e1a05ffa440e70b7e053b7d32e84326671b0b9d2fcfcea2633b8566155477b2a226521bf860b471c5926f8e1f8e3a52676cacb41b40e2b97cb3c1173
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDrive.VisualElementsManifest.xml
Filesize344B
MD55ae2d05d894d1a55d9a1e4f593c68969
SHA1a983584f58d68552e639601538af960a34fa1da7
SHA256d21077ad0c29a4c939b8c25f1186e2b542d054bb787b1d3210e9cab48ec3080c
SHA512152949f5b661980f33608a0804dd8c43d70e056ae0336e409006e764664496fef6e60daa09fecb8d74523d3e7928c0dbd5d8272d8be1cf276852d88370954adc
-
Filesize
2.3MB
MD5c2938eb5ff932c2540a1514cc82c197c
SHA12d7da1c3bfa4755ba0efec5317260d239cbb51c3
SHA2565d8273bf98397e4c5053f8f154e5f838c7e8a798b125fcad33cab16e2515b665
SHA5125deb54462615e39cf7871418871856094031a383e9ad82d5a5993f1e67b7ade7c2217055b657c0d127189792c3bcf6c1fcfbd3c5606f6134adfafcccfa176441
-
Filesize
2.9MB
MD59cdabfbf75fd35e615c9f85fedafce8a
SHA157b7fc9bf59cf09a9c19ad0ce0a159746554d682
SHA256969fbb03015dd9f33baf45f2750e36b77003a7e18c3954fab890cddc94046673
SHA512348923f497e615a5cd0ed428eb1e30a792dea310585645b721235d48f3f890398ad51d8955c1e483df0a712ba2c0a18ad99b977be64f5ee6768f955b12a4a236
-
Filesize
1.4MB
MD56e24896404a4f41c33e8223e9a0cd08d
SHA16949b9924d6887622c12892bfcb6ce8112af11b5
SHA256bf2aeb9ef10ddceb67ce5b8c6d8779505276b3eb4d66d1da42389469e4b81a6a
SHA512fbf38c688f0d855eb2d56eadb2792d9d70ede493f44153b59841447d0c76c34281fd44c6bc6184600a8651bb3c389af1703bf870c306fa0f506701f13d3f704a
-
Filesize
1.2MB
MD5e9d75e15914935d2825749177e5ffbc0
SHA1cb17a68b5df5a9cda10795fa76e69447810b529a
SHA256a5b1be810e5a9745ad29cfecf7c53de9beb9f67c70b8284eaa91ab0bc7b66798
SHA5123a19f63d8810c4e7ad33a0328eb8d00d19a98b3a8c8b406a4fc09142ab0130e15192b8663b067e0d874069331dda0516fcc5a7290b704e3dd722e11807790bc3
-
Filesize
4KB
MD57473be9c7899f2a2da99d09c596b2d6d
SHA10f76063651fe45bbc0b5c0532ad87d7dc7dc53ac
SHA256e1252527bc066da6838344d49660e4c6ff2d1ddfda036c5ec19b07fdfb90c8c3
SHA512a4a5c97856e314eedbad38411f250d139a668c2256d917788697c8a009d5408d559772e0836713853704e6a3755601ae7ee433e07a34bd0e7f130a3e28729c45
-
Filesize
1.2MB
MD543a7ef4b0d956077d5db13ea8706c2b7
SHA127a9874d06162c04fb0167231ef04e1d85b48e13
SHA2560570be69ef92ac81427cd6d1d818760d538c3d04af16bbf154185132aeabe5cc
SHA5129efdc9e1c7f2ba20e8c38cb5d2d01ac1ac8ff6d7ac9f2e20e82465a44ff09506bde312251c107750c4209f1d9b5d4d6fa2a8720d1a0ff3f4d39bc05ee13a080a
-
Filesize
451KB
MD550ea1cd5e09e3e2002fadb02d67d8ce6
SHA1c4515f089a4615d920971b28833ec739e3c329f3
SHA256414f6f64d463b3eb1e9eb21d9455837c99c7d9097f6bb61bd12c71e8dce62902
SHA512440ededc1389b253f3a31c4f188fda419daf2f58096cf73cad3e72a746bdcde6bde049ce74c1eb521909d700d50fbfddbf802ead190cd54927ea03b5d0ce81b3
-
Filesize
432KB
MD5037df27be847ef8ab259be13e98cdd59
SHA1d5541dfa2454a5d05c835ec5303c84628f48e7b2
SHA2569fb3abcafd8e8b1deb13ec0f46c87b759a1cb610b2488052ba70e3363f1935ec
SHA5127e1a04368ec469e4059172c5b44fd08d4ea3d01df98bfd6d4cc91ac45f381862ecf89fe9c6bedce985a12158d840cd6cfa06ce9d22466fbf6110140465002205
-
Filesize
425KB
MD5ce8a66d40621f89c5a639691db3b96b4
SHA1b5f26f17ddd08e1ba73c57635c20c56aaa46b435
SHA256545bb4a00b29b4b5d25e16e1d0969e99b4011033ce3d1d7e827abef09dd317e7
SHA51285fc18e75e4c7f26a2c83578356b1947e12ec002510a574da86ad62114f1640128e58a6858603189317c77059c71ac0824f10b6117fa1c83af76ee480d36b671
-
Filesize
1.1MB
MD57a333d415adead06a1e1ce5f9b2d5877
SHA19bd49c3b960b707eb5fc3ed4db1e2041062c59c7
SHA2565ade748445d8da8f22d46ad46f277e1e160f6e946fc51e5ac51b9401ce5daf46
SHA512d388cb0d3acc7f1792eadfba519b37161a466a8c1eb95b342464adc71f311165a7f3e938c7f6a251e10f37c9306881ea036742438191226fb9309167786fa59a
-
Filesize
73KB
MD5cefcd5d1f068c4265c3976a4621543d4
SHA14d874d6d6fa19e0476a229917c01e7c1dd5ceacd
SHA256c79241aec5e35cba91563c3b33ed413ce42309f5145f25dc92caf9c82a753817
SHA512d934c43f1bd47c5900457642b3cbdcd43643115cd3e78b244f3a28fee5eea373e65b6e1cb764e356839090ce4a7a85d74f2b7631c48741d88cf44c9703114ec9
-
Filesize
2.1MB
MD581037f0e7fc009c73e3ebf71a5e4c311
SHA1c3bdd01f31fbf3d7d179834f28ef4a625bd7961e
SHA256ce1f70cacbbad8b840fd161aa7188b1f05d46e751819549be2c619268b183f93
SHA512c24484f118e5bb57412e386f01447af41d09598e8cb491727dd4b35fcc3681f3147503476b82e79ea753a00a3ccf8db50c2a4884659511a5a1a708d1b41ae255
-
Filesize
25.1MB
MD50ab973eb5e3fdf946ecdcac7d2671784
SHA1aa4c151c5fcd1a4954598afc5e9d8f685fdb7c21
SHA2568342d03136913b627589c091e1cab842187ac4538f7539c7bb9d65abab7e56bf
SHA512686ba0957b811d39ee96ee12c0a595e12ddab6844fddcc96624e02b66d33f552fdb02b224f6a7b5c3c2495a4fa40eece69ee29baed9ff07ec2e023c44c812edd
-
Filesize
16.8MB
MD5d095db362e49e2089d71afa4714dfdd1
SHA1d2a6c022cca86f44ad9b792f834a0713e28d6492
SHA25605522b46e557253b16f5a2455a3206229e4f2fb2505e5e398caa721ee655abd9
SHA51293d3808bd3f6a2c2beb87e2fa5a36f61ea8848267aaaaff24adc249ddddf3764d753e882929157be942c6af87b728528bd86de4188327d43ef5a07a9f10b3c6d
-
Filesize
3.8MB
MD5842eb5c5fb867db839886c62480e0241
SHA1e5ac3655d4b1aaa3e23e77319fed98d1c7e5444a
SHA25660e6fb59893d4363c8d7b2a377724ddc8c26e8755504b2b7b845daa07a99aae6
SHA51233d3d7ffd04dc5c931005e1bb7fbe1ffe66d7287d39023ff692468856e0933c453b9f6784825f477183fb25233285a0c8a1f3cae678d5692a5755106e93b00c2
-
Filesize
547KB
MD5651654229ff5d3fdc49569f3491d8039
SHA148e84c52d2b0259a15b6ab080a2b442f4f122c10
SHA256f7840883dd0ad45e5afc74465470805068173eacf34206bf1fd1d844b34da7b1
SHA512c23d60aa1d942d3ecc110ff5c600def833d85605a63bd12b058e54039b3bcb9ca6cec55ce3989654ef3255f75362759bd69a5521d1ebbf098efff17ee1679531
-
Filesize
108B
MD530370386eb56ad535b5c036d9e55240c
SHA14fa57bd89e24c911a420bbdf193d29f8bbb60f2e
SHA256a4c5592fc696a090b4d5e8764932c9d22e29879df4ba1d57a4c0e02486c33c68
SHA512191bbc80509119f195cd977d7064249e6906d2a09141e4cc82c63b2ed9fe179955701c768d57b32644767318704ff4db442760c671300e98c83c73e0367f5fb1
-
Filesize
38B
MD5cc04d6015cd4395c9b980b280254156e
SHA187b176f1330dc08d4ffabe3f7e77da4121c8e749
SHA256884d272d16605590e511ae50c88842a8ce203a864f56061a3c554f8f8265866e
SHA512d3cb7853b69649c673814d5738247b5fbaaae5bb7b84e4c7b3ff5c4f1b1a85fc7261a35f0282d79076a9c862e5e1021d31a318d8b2e5a74b80500cb222642940
-
Filesize
63KB
MD5e516a60bc980095e8d156b1a99ab5eee
SHA1238e243ffc12d4e012fd020c9822703109b987f6
SHA256543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
SHA5129b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58
-
Filesize
77B
MD5c112894efc2e14da0ca49d2356dadfd8
SHA1d3dea8c792b594f17c00b4ca1ec95eeb59199763
SHA256aaa1991c50d771278e800eb4a5fa1bc2a226a3bcd384b623f13a9812106db359
SHA5125484f657d35333e131f97ba90e9b8c2be8582e5cc0798376df1cb9c1cfe215ef6430aa0b294f131a91ddfb1be54419dbf72bebe814a64df2f7099b7974bd5494
-
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Filesize2KB
MD59c5f78d05fb8fbec90f366d4b647a5b8
SHA1275b3a62ff9e4d473665cce3b3981acdb1aef59c
SHA2569bc4be60f4e221c475382ee2b1c8e47c299ddfc1128239ca47c6d413e489b9a2
SHA512fe51994ecc82311cdd622f00a487bdcc64f501ef74a83c2b6132157a3251baa3fb80267ca28881d1453e00ec361ceb60632b9f5570489ba004c16752208269cc
-
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Filesize2KB
MD5bc712f12718036ed6c09f6d7dfa6e6c8
SHA1cda74b4324a56880f81cc283d9fd287cc99879bc
SHA25604aac7fb94b83467cffab7ddb64cc58522090723f4ec86da11da6cb8e9a5ddd0
SHA512fb739678093c3e8f74a53050ee662a8881f4d5b59c221b3add83fa3f6ea7d925e0d05837d927501ebf7b71b804ef8beaace04604970db3cb5a385457f4550bc2
-
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
Filesize4KB
MD53539a870f300f59da99c176c9853ce75
SHA187daeae8bbcbf4a45d8d52205b7362d8bed9b0f9
SHA2560df1554cefda96496144d77edd0bb82f98cfdcf14332d249007485c2a3874a25
SHA51264ea7fe5eccba732424ab358f160f496c14127dd5560e8a039d7c2ae0cf10d2285f9cae90d6bd150b9a74e27bd5db89856db86b4815b108400e1f183bf365531
-
Filesize
726B
MD553244e542ddf6d280a2b03e28f0646b7
SHA1d9925f810a95880c92974549deead18d56f19c37
SHA25636a6bd38a8a6f5a75b73caffae5ae66dfabcaefd83da65b493fa881ea8a64e7d
SHA5124aa71d92ea2c46df86565d97aac75395371d3e17877ab252a297b84dca2ab251d50aaffc62eab9961f0df48de6f12be04a1f4a2cbde75b9ae7bcce6eb5450c62
-
Filesize
470B
MD5c8638405a487e26139aec0919abc40b6
SHA1b22e04708e03ae82dfaddc29aa6fd367f92a35a7
SHA25614e0f9467068c1daa64e2ab70d94861ecd714f234d35422d52b0e8a363bfcda7
SHA512b9dd055a72db01f2d5a39bfc984e185d63a6a1da94ae762b30d50f7a6e69efa2752538ad64036d6ee8324fefc1adce930a24ac0230d19706e7b7f268ffe677f3
-
Filesize
1.2MB
MD5f730c4cffcc85afe73ee3188f06412fa
SHA14d53dafbfc6d66a85993f75a5de5686f85b8d16a
SHA2564d9db6e95048d201fd0d6feb4b99e90cf9cee499bc1d0b9a0db6959506f65729
SHA512e8a0413448566eca7a74ceb201e126fb3b4fde87fac38162df8e75c9b9e79c12d7c866e0ae55ed39c9c0ef069de85e0f87ebb867a04f0326ac77ff57ce7d4db9
-
Filesize
201B
MD535375f95b1430c8b11ebeb931fba0dda
SHA15122d139ac357db969c191b941bd479ceb9dc59f
SHA256fd5691afe44306226fa973037fe144c3214867067cf88cb2285394888d959d5b
SHA512b9043a4d4470ac90f83244a81fad5de8944b83ba1e8ab6bbc7d29fb216c2ded74bf1c7b1ca8c84535b989075660e83f676e273a1b524f9e5dd8e04fee412cc6b
-
Filesize
201B
MD5b2ac875103aac6f8b1faeae04137efac
SHA1dd560f54b7ff42e9e9cd4916aff57d44650c347d
SHA25666bdb5d4a4e3ce2d087db62018f3ce1a56d89b0e837f19c1f6aa4893a5488de9
SHA5129314d9510951deb4a08ef564de1c08bf9fc6128734232e4f80ace7d1d7998a1876d240a88e50f43429a1d05c95b6e4786fa5b6fff970a00ccaaf3b65431ca48f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize10KB
MD56182abf2496a0e07f9b1c9b1a9d448ee
SHA196118ba16b84cfd6d4e2ae87c387e8afe3ea00cd
SHA256679bd4b06017cb05e7e29b9436effdc23247834f57fe3e22556f8c72b04b201e
SHA51231cd5d881c33a8d9184f1edd0f6eef9c53cb91186810ad68797ac4247e3f56c70fb92d33c90ab67e785ea75b3aec2ce070afcaa6386fa4a47d96a33cf0c72515
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize10KB
MD5da8168399ccf16f8bbea6916e5a8b1ff
SHA163d41dbff06effda52e568c80079554781ccc178
SHA256e639a73ba2ede0f7e6d2326d0da697951734dcf0f07539cefb2166d9cc901dde
SHA5127ed98acb448714009c421e56f9561cf15f19154775b9d6d9bc00b309f801ae4d02ea32bb7a7c1f6e8ef6889b674ef0f4aaf3af0d5523f86b3fe2cfdb3f6db750
-
Filesize
203KB
MD519a966f0b86c67659b15364e89f3748b
SHA194075399f5f8c6f73258024bf442c0bf8600d52b
SHA256b3020dd6c9ffceaba72c465c8d596cf04e2d7388b4fd58f10d78be6b91a7e99d
SHA51260a926114d21e43c867187c6890dd1b4809c855a8011fcc921e6c20b6d1fb274c2e417747f1eef0d64919bc4f3a9b6a7725c87240c20b70e87a5ff6eba563427
-
Filesize
231KB
MD57b2e617245383530194c841a514c86f1
SHA165101bdc6e6dfc4153b0e74cbb8f7291eeddaf7f
SHA2563d95751f3f6b27567e9e5f5c9063fe2c37e27103d0f1266e02c1b01d717e1167
SHA512e591a059f9aa7578352f34307175c7ea95881dcc8c7f9c3174ba1f2e14c97c2395153391f7cd1bdd4a69c82f006cc2c06fbda58860c096ca785de166ee718d2c