Malware Analysis Report

2025-06-15 20:19

Sample ID 241216-r6ptaasrbw
Target source_prepared.exe
SHA256 edc2d51c0c4fc3066017def71df3182e86e4a9479c79fc13d46a359393223e1b
Tags
pyinstaller pysilon evasion execution persistence upx discovery privilege_escalation
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

edc2d51c0c4fc3066017def71df3182e86e4a9479c79fc13d46a359393223e1b

Threat Level: Known bad

The file source_prepared.exe was found to be: Known bad.

Malicious Activity Summary

pyinstaller pysilon evasion execution persistence upx discovery privilege_escalation

Detect Pysilon

Pysilon family

Enumerates VirtualBox DLL files

Command and Scripting Interpreter: PowerShell

Sets file to hidden

Event Triggered Execution: Component Object Model Hijacking

Loads dropped DLL

Executes dropped EXE

Modifies system executable filetype association

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Drops desktop.ini file(s)

Adds Run key to start application

Checks system information in the registry

UPX packed file

Drops file in Windows directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Detects Pyinstaller

Views/modifies file attributes

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Checks processor information in registry

Kills process with taskkill

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious use of SendNotifyMessage

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-16 14:48

Signatures

Detect Pysilon

Description Indicator Process Target
N/A N/A N/A N/A

Pysilon family

pysilon

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-12-16 14:48

Reported

2024-12-16 15:19

Platform

win10v2004-20241007-en

Max time kernel

1151s

Max time network

1147s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 66.112.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-12-16 14:48

Reported

2024-12-16 15:19

Platform

win11-20241007-en

Max time kernel

449s

Max time network

1167s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-12-16 14:48

Reported

2024-12-16 15:19

Platform

win10v2004-20241007-en

Max time kernel

1329s

Max time network

1156s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\misc.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\misc.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 101.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 21.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 171.117.168.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-12-16 14:48

Reported

2024-12-16 15:19

Platform

win11-20241007-en

Max time kernel

434s

Max time network

1157s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\misc.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\misc.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-12-16 14:48

Reported

2024-12-16 15:19

Platform

win11-20241007-en

Max time kernel

443s

Max time network

1165s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\passwords_grabber.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\passwords_grabber.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-12-16 14:48

Reported

2024-12-16 15:19

Platform

win10v2004-20241007-en

Max time kernel

1335s

Max time network

1157s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 21.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 11.179.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-12-16 14:48

Reported

2024-12-16 15:19

Platform

win10v2004-20241007-en

Max time kernel

1328s

Max time network

1152s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\passwords_grabber.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\passwords_grabber.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 17.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-12-16 14:48

Reported

2024-12-16 15:19

Platform

win10v2004-20241007-en

Max time kernel

1332s

Max time network

1158s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 9.179.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-12-16 14:48

Reported

2024-12-16 15:21

Platform

win11-20241007-en

Max time kernel

432s

Max time network

1153s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-16 14:48

Reported

2024-12-16 15:19

Platform

win10v2004-20241007-en

Max time kernel

1795s

Max time network

1800s

Command Line

"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"

Signatures

Enumerates VirtualBox DLL files

Description Indicator Process Target
File opened (read-only) C:\windows\system32\vboxmrxnp.dll C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
File opened (read-only) C:\windows\system32\vboxhook.dll C:\Users\Admin\pysilon\pysilon.exe N/A
File opened (read-only) C:\windows\system32\vboxmrxnp.dll C:\Users\Admin\pysilon\pysilon.exe N/A
File opened (read-only) C:\windows\system32\vboxhook.dll C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\pysilon\pysilon.exe N/A
N/A N/A C:\Users\Admin\pysilon\pysilon.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pysilon = "C:\\Users\\Admin\\pysilon\\pysilon.exe" C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\pysilon\pysilon.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\pysilon\pysilon.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\pysilon\pysilon.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1144 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
PID 1144 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
PID 4256 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4256 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4256 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe C:\Windows\system32\cmd.exe
PID 4256 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe C:\Windows\system32\cmd.exe
PID 4356 wrote to memory of 3232 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 4356 wrote to memory of 3232 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 4356 wrote to memory of 3612 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\pysilon\pysilon.exe
PID 4356 wrote to memory of 3612 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\pysilon\pysilon.exe
PID 4356 wrote to memory of 3592 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4356 wrote to memory of 3592 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3612 wrote to memory of 1620 N/A C:\Users\Admin\pysilon\pysilon.exe C:\Users\Admin\pysilon\pysilon.exe
PID 3612 wrote to memory of 1620 N/A C:\Users\Admin\pysilon\pysilon.exe C:\Users\Admin\pysilon\pysilon.exe
PID 1620 wrote to memory of 4628 N/A C:\Users\Admin\pysilon\pysilon.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 4628 N/A C:\Users\Admin\pysilon\pysilon.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2656 N/A C:\Users\Admin\pysilon\pysilon.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 2656 N/A C:\Users\Admin\pysilon\pysilon.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe

"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe

"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x508 0x4f0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\pysilon\""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\pysilon\activate.bat

C:\Windows\system32\attrib.exe

attrib +s +h .

C:\Users\Admin\pysilon\pysilon.exe

"pysilon.exe"

C:\Windows\system32\taskkill.exe

taskkill /f /im "source_prepared.exe"

C:\Users\Admin\pysilon\pysilon.exe

"pysilon.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\pysilon\""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (Get-CimInstance Win32_ComputerSystemProduct).UUID

Network

Country Destination Domain Proto
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.136.232:443 discord.com tcp
N/A 127.0.0.1:61925 tcp
US 8.8.8.8:53 gateway.discord.gg udp
US 162.159.133.234:443 gateway.discord.gg tcp
US 8.8.8.8:53 232.136.159.162.in-addr.arpa udp
US 8.8.8.8:53 234.133.159.162.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 11.179.89.13.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
US 162.159.138.232:443 discord.com tcp
US 162.159.138.232:443 discord.com tcp
US 162.159.138.232:443 discord.com tcp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.136.232:443 discord.com tcp
US 162.159.136.232:443 discord.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI11442\ucrtbase.dll

MD5 5dd82151d2d8e2c0f1fba4ffb493baed
SHA1 12e24daa8902eb0c46cd8497666633f7ce9a8b58
SHA256 ee847c9d37eb901945ddccc2de73f657e3e92b148ae863b63e7f97d05ed558cb
SHA512 d00ba48b4614d2822e26c3bbdfaa171792dfab52bb50f16e66bdbb53efcef3d9b0e2d35816a40c787a63f5fdd8cc494ec5172c001f25e0ae42645cef330ddf5b

C:\Users\Admin\AppData\Local\Temp\_MEI11442\python312.dll

MD5 f23aa992b8e0a301ec8f473d6b784f4b
SHA1 ee73a5da238341cb21a781a3ddcb187d1f971680
SHA256 0ddfba7779ebc44f2fa819a78b54bc730a5543274986e973beee024fab0ecfc6
SHA512 028abb66298fee6173d34f80940f5bdd3988a8373234f32a780ae93e155d90af191d85164077d9b76dc3651bda4d9902ccbfd03d37be3e9662006b65c3defb35

memory/4256-1317-0x00007FF81DB30000-0x00007FF81E200000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI11442\VCRUNTIME140.dll

MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

C:\Users\Admin\AppData\Local\Temp\_MEI11442\python3.dll

MD5 77896345d4e1c406eeff011f7a920873
SHA1 ee8cdd531418cfd05c1a6792382d895ac347216f
SHA256 1e9224ba7190b6301ef47befa8e383d0c55700255d04a36f7dac88ea9573f2fb
SHA512 3e98b1b605d70244b42a13a219f9e124944da199a88ad4302308c801685b0c45a037a76ded319d08dbf55639591404665befe2091f0f4206a9472fee58d55c22

C:\Users\Admin\AppData\Local\Temp\_MEI11442\libffi-8.dll

MD5 013a0b2653aa0eb6075419217a1ed6bd
SHA1 1b58ff8e160b29a43397499801cf8ab0344371e7
SHA256 e9d8eb01bb9b02ce3859ba4527938a71b4668f98897d46f29e94b27014036523
SHA512 0bd13fa1d55133ee2a96387e0756f48133987bacd99d1f58bab3be7bffdf868092060c17ab792dcfbb4680f984f40d3f7cc24abdd657b756496aa8884b8f6099

C:\Users\Admin\AppData\Local\Temp\_MEI11442\_ctypes.pyd

MD5 6e02d07340dfaea121a64bef762e0d67
SHA1 48b107a7391772ed849fd1f13a7d2eca9fc09593
SHA256 7035c88e2a0099785ef34f89275de92b34ef3299f01c816d844832c55701c3e3
SHA512 8790af18a4ac4a23f67c8c8e5db1217a399fe75519878e89da4faf87b08c8448aab42aa9ddf40087bc3e959a5490d861531637f3978b2ddcda4d727e60887b6e

C:\Users\Admin\AppData\Local\Temp\_MEI11442\base_library.zip

MD5 898e35281a756640780dbc31a0b78452
SHA1 845b59cfd9fb152725f250a872e9d1d7a66af258
SHA256 0daa440c78582a693dabbc2325a06d817131bb170bad436b126bad896f1377cd
SHA512 421cc4a15e94293e53f1039b8bb5be7edcbc8e3e0e4abc7f34faf991993f51cb5f51493b58bb341cb9579347ec134b02104454075a8e7e33e45b8e3a66a44d79

memory/4256-1327-0x00007FF82D7B0000-0x00007FF82D7BF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI11442\libjpeg-9.dll

MD5 c22b781bb21bffbea478b76ad6ed1a28
SHA1 66cc6495ba5e531b0fe22731875250c720262db1
SHA256 1eed2385030348c84bbdb75d41d64891be910c27fab8d20fc9e85485fcb569dd
SHA512 9b42cad4a715680a27cd79f466fd2913649b80657ff042528cba2946631387ed9fb027014d215e1baf05839509ca5915d533b91aa958ae0525dea6e2a869b9e4

memory/4256-1380-0x00007FF829660000-0x00007FF829675000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI11442\libcrypto-3.dll

MD5 f8076a47c6f0dac4754d2a0186f63884
SHA1 d228339ff131fba16f023ec8fa40c658991eb01f
SHA256 3423134795ab8fce58190ae156d4b5d70053bebe6c9a228bea3281855e5357fa
SHA512 a6d4144cbba4a26edf563806696d312d8a3486122b165aae2c1692defc2828f3ff6bd6a7f24df730ff11c12bc60ac4408f9475c19b543ed1116b0a5d3466300b

C:\Users\Admin\AppData\Local\Temp\_MEI11442\_lzma.pyd

MD5 b5527d2f85ff0ef7c781447601c55e8e
SHA1 3c1f96424de9c6075d3dde9c2700027fe6dadb66
SHA256 67f56b6b023600b2ef2dac5b37c75d8df7197f3db714621055a2e37422316e27
SHA512 2ecaa3feda6669e541a9704c380bfa99580e2790795cacd626b3c99e906e698b42c62e7ee69bc48d1f4d3131a91901615b601523d0d95b2d9ba7ec6659a10a62

C:\Users\Admin\AppData\Local\Temp\_MEI11442\freetype.dll

MD5 04a9825dc286549ee3fa29e2b06ca944
SHA1 5bed779bf591752bb7aa9428189ec7f3c1137461
SHA256 50249f68b4faf85e7cd8d1220b7626a86bc507af9ae400d08c8e365f9ab97cde
SHA512 0e937e4de6cbc9d40035b94c289c2798c77c44fc1dc7097201f9fab97c7ff9e56113c06c51693f09908283eda92945b36de67351f893d4e3162e67c078cff4ec

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-crt-utility-l1-1-0.dll

MD5 73e6469b985df8837aeaaa7123708887
SHA1 01673b8891422406bb982d07128dbb3b112b5276
SHA256 95873f3e33077346ca2a3bc7bf7daa7bd2e3048a5484dca4f4528f2b7b538bf9
SHA512 9caef7ac1ca4b43c16df34f1e1d798250b678150042857f9c7fcedb6b2a776056e6881b92c9698cfebe38be09f0af889fce393a354148e754b45afbac146e449

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-crt-time-l1-1-0.dll

MD5 a2de503c4cc56e7de302876fefaae2e7
SHA1 041d5af579283b6ecc8ebfebba21bc8a3af550f1
SHA256 864f666db947dba0cce45f9e47a985a2096cb81da843eb2e63a7fb2c8ea80e46
SHA512 e5593d4857e6b07e7f46b5ec5f6ce50d61d2f82f9d1f1f3343eef1b57e9551b05eb8c5544e1073ac14f97f302839ba08ac86b547cee2b6e7f1079cc738f5c17d

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-crt-string-l1-1-0.dll

MD5 f93b73105c623f5b60819b31924ae650
SHA1 feed1a77273538526af520c355ba165f8f9efd1f
SHA256 f104b2be7f464444232179f3db768221ee0258f9bf3f5c500553b678f2e465ce
SHA512 47e16f338f2b4d2208302eb6b46890afb92c8f8e9a4de8093f60f77b46608cd1b369fbc426ca361909044d310430390e69490c3a5930193035a906f26051467d

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-crt-stdio-l1-1-0.dll

MD5 2a2cff22add761ba49544b5169452940
SHA1 e2583066dc07dcf111930970a57ed330fda9930e
SHA256 04698815e80b8c6c799c6001b0f8220e9a8f2ff88496f808f5d6a49a1f0dab06
SHA512 88adfbba1d385c82fa29f191ee3ea854c5c4aba50b558da7c054019b371a22a7e9e90f37d62d484e3dbe75faa29c977059e1d7c4447ff69749d1b7e0bf523a51

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-crt-runtime-l1-1-0.dll

MD5 0710252cc8f1ed7288521d87c7c6aeb2
SHA1 e5f1e9f8d53d299f65f44e860f3e7deb841a28d9
SHA256 8ee3f2277018ab3e2c52969ee793a4b9ef054c269250e4bde2639f27cfda42c8
SHA512 b99293cf71f90266ce2173df0a09a46ecbfd78526b1d131eba35bf42213ad3801edcd958b2ac9919075674e017502f1be46bbdfa001d879b5562b6de8657a440

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-crt-process-l1-1-0.dll

MD5 cf363f6b59b37f7211d64e098c648a3d
SHA1 5a433297b508d6b274c43e58ea071b26a25a0402
SHA256 80ac7de93f382e9a52137a2fee0d1359a63d19595ac3c9caf72300fd478fdcf9
SHA512 642b589198c8b6d43351464c7f50dec7965c3e6f4bbc4a04feac83c3f9b6fd3860ae8d417abc83491e08d522f4ed2155c283c356acf3e1d12332921dbdec2da2

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-crt-private-l1-1-0.dll

MD5 469dae932dbb2348e4cb0be98c15bb66
SHA1 629dd000ee762686734029471c819ec3726d2b7d
SHA256 dac4a9a9150157dc0b7d1b8f91404cb137c1cc08ffcb6246d601f7a4c8d6f798
SHA512 0fba809005cb7f5e779f4330597c5f5bd36f3b7e0a9ecca609421f05f07a21bb05068a59c0f23a569ee1eadba1930c8474ca3e4f15fdcfde1fbab963544fc432

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-crt-math-l1-1-0.dll

MD5 6edfbe13cae07d22814d0394de60115d
SHA1 0aed26b5d88392ef9a4eebaa4b78bc63291c0075
SHA256 adcf89c534aace75761f79de850f0966f79bd119bd8e87635611943e6d2a317e
SHA512 396c19be2604a7751b664939e3762d32e99dfa55e410a380c9afa302786f55fc9342f9e0a7b97930ba96e843d2ade68d761f41198e1c4d0e0ae43d7e06365365

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-crt-locale-l1-1-0.dll

MD5 7b2b1566e32ecb3751083aa82f56d3f6
SHA1 8511372cc3a3800c43f642b729fd800579285f24
SHA256 ef84b20de4057bd4b64cbcecbea3b9b5c6cc671caa2c7d39d8a02437f1a37b81
SHA512 abf17270321db379732b58ffbea5feb34f62b06bdf023b7f96fb7dfd93d4d1aa9e5f8d8ec2ecb91edb65236446a552ea60fb8e96f677595c3993cdb5bb83e0c1

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-crt-heap-l1-1-0.dll

MD5 dde305b5ba450c86dc0bc240815358ed
SHA1 d3fb825bdeafe9e37e85116932b9254341acdf51
SHA256 28c2796dd9af7261873f180262ceaffb39fb529539925454b9c6cd01137e14f9
SHA512 70648d364fb28347a5f94cbefd5c5a8adb6b0d565a7c6d3624f8c3a0c76c6a51b099fac6dacb39937c23ea4208d2c095a3c63b45918c3617bc2fc71886fee0cf

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 9f61a852aa4c60ddaacc4d58ba922a35
SHA1 7240245e2aec02f0e3d069716e95358ae52efeb5
SHA256 e95c2ff8c37d29eb7c125a205191ed728a879e7a1527804877cc2080f411a20c
SHA512 746ff87d88fc32655121450159090b4b85c953ea89ae23fb9ff8f338c6b1ac78a87e7121a4c2c13732fbb942362d141f5a98c5ba5d62ad792a9531c95ac88fad

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-crt-environment-l1-1-0.dll

MD5 4caebb22adf188fccb49eb1da05935ea
SHA1 b9dd16e75cd5cfd06cc2db105dec90f01454b4dd
SHA256 998506d8270b5109bf9b0290302183bf1f4551b95722a9f9c15f02d1f90bd532
SHA512 1e37491f541f035a295e0350377b90512407d68ac0e46664d8f8b158ced538431df219db968042378e2a23fb5e798bb6e290a1cb1ecf27633150c197d0bb663c

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-crt-convert-l1-1-0.dll

MD5 e18a689ac01df28a36fc2508d8cc6e03
SHA1 4654999e493502baa8a77b99548a6d841d4b7c67
SHA256 ddb8e51047b92c2b3caab9956962f0af57a5d2840536c33620f07970eaddd8d1
SHA512 c6fb1d517e4383036428889bcb41b6db8f74bf0fdb9ac6cfff37b8834c1026f9a2f48d709aad4b9ac4baf3b1f3092ce5f68bbb2d07f250c599969db7f31d7dc9

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-crt-conio-l1-1-0.dll

MD5 ef555b0c47da9db3359842b4041fa669
SHA1 f3120292d39c248963ecddcdc08247faa4a5f1f7
SHA256 4b3d67596ec2f93fe9639f3f846073cb541b615070cd5094876c5f47b8b47579
SHA512 6846fc469d5c2e7719bc53068252a3139267d5ee390b6ff999c1919e81eb8543ebd2dc7873554b6d537430cdb6875aaec5d7bfb425be9d1e7668505f04268b3a

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-util-l1-1-0.dll

MD5 942fb04662bcc37fdcd80e35a53660ae
SHA1 e0dd736441dcb038ca89179878bdc25238bf314b
SHA256 716c6b088974726268612511e5190459d329a1eee7cbb7dbaa1307775ce66db8
SHA512 67fa78ffd4b68167698a09822e65c2dc6b5ec8859a6157aa3f36c95e167dbecba9266630ecfacc72748367d38484432cd5e305953fd7da4bb549a1c8d935e08d

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-timezone-l1-1-0.dll

MD5 0f6e970dea277438d33eed6a6a61709f
SHA1 34619c9343296107c404dbb11de00affe97185f9
SHA256 c88c3678a4e1bee3f12b2ce947f3bc37ed3d3231a5801ea822cc2c28fa87b078
SHA512 5122e116cb430382419fb205154b96d6e02812230b29d25c6e55f01ff889bcaa1fca9d4eebb04733ec19fb0f8f2785898b5cfe5e2204acd8e7e9884df1b9de1b

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-sysinfo-l1-2-0.dll

MD5 7284671ec86b78c730efb85947c11122
SHA1 3fbf601e0443521081356c20a6d6f3f4e6338a28
SHA256 d77af2a15be5a51cd242c142d755fcafad76af9b57e472179f8c23f0790f106d
SHA512 a29177ded3a23d7bc04f1aa903ff0a63cc9a661335b02e5b913c780bbd4a072ec5b7ca5891fd3a53e9b1b6d3b5ede4b68224da5657c35485137d22ccf8ca7d8a

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-sysinfo-l1-1-0.dll

MD5 f7901231dfeeffeb8ada850c2fe62b42
SHA1 f77d25807d6de27895494aa341075d3d9e999f45
SHA256 a7db43f8af86df869faab7d50626a097a20961579613ddd79ee5580748a4793d
SHA512 5c310067ff89f6cd624c67748c4ba80a522582ae5aae03dfaced74d152962c2d69aa669fb5e3a37091d90492852a2110539a99fb5202b0b14b86a232a8350842

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-synch-l1-2-0.dll

MD5 3edf358d26f05f473dc894d6868446a5
SHA1 1d78885a66e177a94c1af8daa35bcac4e8724f24
SHA256 6e5a3ddfdc21561c0f4e8ef77a4df9f19b1bf9212c91de92946f230e8a6ec91b
SHA512 e20d1e030688cf449ac0a3c7d4f43d5e54c3e65d44371db03c62ae8c8c33e74ca9b77d6ef95f2234b9b33cd7e9d58d7035d32c945bc43c22421641f66d55ea0f

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-synch-l1-1-0.dll

MD5 acb35f65f19e48bc685c06efaa692e26
SHA1 5a48a3d685c829fbb22281e245abbf2742398c82
SHA256 590d924e988503e023848ebdc3f3f01bfcc4e3f7717816c5a68b8f8414ab41f9
SHA512 3bb3ef453916825f675c245424bf18a847a0990398d1fbd349fe3e265aa1aa7c1bf90eedc447bf7de2eda95ed6fb2f8e4e79e3f0222536097afc0e629c5bb42a

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-string-l1-1-0.dll

MD5 698704e1735825ed67348bcd561bc5df
SHA1 7b6c821a3ddf9488e1a4126a54c5fda2155ded5c
SHA256 dce5934af79f7f22d5bd58a9fa6fcf4734ef13ca3b58a26579a6d7471e6b27e5
SHA512 27a392b95ddb368dddce19287b8da5be7f860afeb15a5735d324265b77cdcf78dc6dc33555572f13c0a4e540b8bf900bd3552a183643772708b928b4204f3e35

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-rtlsupport-l1-1-0.dll

MD5 2e107df701850a43e2baba0427859a9e
SHA1 4dac4434b88420a9a67efe4e9b19d877526d7310
SHA256 7e7950b535768988313ae1689be3844f471293e293cec4be845e17c1e8940623
SHA512 369a6133373a1e0a11f807946e32b56b310755d55560004803677dd9b107f401ea9bd9de1f4a93e50e9152f5191b6a5ff36bc78901f070752e28b1b769057c0f

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-profile-l1-1-0.dll

MD5 da5fd555e8136836d33993da6fa23c03
SHA1 02ee3584d0b3dabb0ec36a12e28ea0081a0da3b6
SHA256 6f3b67e02abb67d7fbec15a1415e1858b4900654baa52120e8d887b552b57f2c
SHA512 7425be678d7f829fa110973cee0ad4e6c6d2e3f48a121d5aee5eb619d7e540262320d4b13cfd238c5aa045c9bdcbefe715c4f0fe66e1cb45cde5ecc7c3f8483e

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-processthreads-l1-1-1.dll

MD5 605d8a1ae34b7ee0b92fb5fbdfaacd8b
SHA1 6f62d615fa91c9707ab03995a690c41cb1a7f34d
SHA256 2aaa351f7d1e423ecfd6db6550b1f7d6ef8c76afe238e8491aa7e4827615edd2
SHA512 ee7ddd2bae12e32ad78625f1a2e7efbd83962cbf1251ee429b3ee3e85170f29fec474489cee57089fe23b60fd5097b44980abaaf4ec542df757e6cad8a55c708

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-processthreads-l1-1-0.dll

MD5 2aa1981502b92392e07dc1fbf16b6480
SHA1 9511302223d575a7a108217246ee82dd77b87d30
SHA256 89e233a1b4277f34899e5c4416a9202e3a4fc154c1fb3f56832bb5d90b5e8117
SHA512 005901bf7f9284acb8da987d0b6a5b066966ebcfac1546badd6f4a613287473c0b3d1ef33eacfb270d258c041bbf8303b6068a6adcee2dc6fe6a9e6907c01411

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-processenvironment-l1-1-0.dll

MD5 fa75c06452ddf3d61913a678be6ec7e2
SHA1 4dc8d6f91cba5396f7a4a7820e5574562cce1b6d
SHA256 b958a3e2f5b42ab500995c9d258278a9ad1f8c3a4986f5a1bf04c5decdc8b29e
SHA512 180bde9a8ec16f1c0fd56b131511b79d297cbfa3ee4c9207f7e675eb8e2a295a2a3df1211e25e12854fd099e27570a12ba90d3ffb00da455b7b1ab2f11b8ee11

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-namedpipe-l1-1-0.dll

MD5 e76e0353ee10885c4153f8d5735e62cf
SHA1 cf14fbeda65e5f0b75ad770c53d9af13dc8a4c48
SHA256 f54c36f6cdf0a40ae1ab1772eb27c2e3900e9e21d4f8f2a564a1b3b0326f7dcb
SHA512 ee94cf461aa975f03c046b41ba7d89715f373c78f198a5fe4f918c811781832fadcaac374205da105b9dd76bfd63a15a3073a87b55df5833654537c4bfb971b2

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-memory-l1-1-0.dll

MD5 9b0dc77df914ae8c848226bd22df2185
SHA1 925af803f125713297bffbd3f005759ac9591b83
SHA256 074bcaf27670e09e3fda81251886e3340c72cc8d2a4deb6e78f9d2f6b8c93a3f
SHA512 978a78fd9fe5b7771db353b0c10bb0d9f05d78964e0b6a7a3e93702c41b324396508d4223b2683ebeb0b6f5a7f080a6f33a4a0d0031b468505fcf28b622510b2

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-localization-l1-2-0.dll

MD5 24739ebbf1e51b4106518b09f0d26b38
SHA1 b90e291f502afa76922e01c1eddf0f95626957f6
SHA256 7ac6b6ad7094b606bfb194230ca16b6436bcecd4669a1cfcfd880e25ef3bd106
SHA512 6da9d0aaec46e9f9dd5b0cf865075e88390500bdb7aa04f17c961ff8db8a3f1238812b31aed451583c2e1431f3e447418e745cdbc82beccfb8a004522c1b1d3d

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-libraryloader-l1-1-0.dll

MD5 0f5bed8c9c9a292aff1c4cc8065c1925
SHA1 b70fca28a5933514fd8a96c4f9c5185a377b1882
SHA256 bc3634c53e7746777421ade3c332da1218561b4f77da4fe3ce5e8c3ceb9c4b0d
SHA512 4a9f350665b1b46e47ea912e04c32db47552442d739f43b93614c9403951d55b9432a6cc9143674d3ff4e003d428098f0dc06496a9b327be573718edbd9253e3

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-kernel32-legacy-l1-1-1.dll

MD5 1190c9c96d3d54b0062b2aa07c345e07
SHA1 9da3cb7923d46eab3704e0521700bd645a27d860
SHA256 cd694dd9de1e8f62ddf41952550310c10264f677c153371b3cc3ff8f68280019
SHA512 e2284e713ea1f78bd4ebb08c6eb279ee3b85b404b96bc75fcb2a23d862815e37773edb31d7eb625f688f9d412d16d3388029e3dc53262b29dd5a6fa8c0bd83d9

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-interlocked-l1-1-0.dll

MD5 ddaef501b07a1130bd236ae285ac9055
SHA1 48febee39cd3c741af1e572a1e2a66cffc646149
SHA256 0c957fd8229184147101bd44501495a94a869122fe665fd56e6f2208ffa66a71
SHA512 9cbb1ade3b6e46400cdad04cbd6c345a08d0924c5bc1feb277c5232216b85bea2a7d38f8b8a5f65b4b6757e72f1032e87557c82f1cfaca75dca084e15398d66e

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-heap-l1-1-0.dll

MD5 45cf0dc216451c35c9c1570eee9aab29
SHA1 787aeab05fd1c0ca2dc44ed502a172997c1010a8
SHA256 fdd78958d9dd6287372197954648d433128d581c26b970cb489c59b399441691
SHA512 558559848166a2fbc4ac11a7ded85eb8fba1b8bc3435557bd7de170cd98fc6d3afe2312ae74147d467aace66178cc166a20321a51ebb5de6799023fffc6198d9

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-handle-l1-1-0.dll

MD5 bdaa0f3421a238477c2cf269d7dd138a
SHA1 72d57f9901d6d404dd1d44548a395c0d61ff863e
SHA256 f98f0004552417be91b3e15340abe1d1b02d78b45217fb93abe4f9ef6b54d108
SHA512 c2cf66fbdd1533141b537db11a2dfe5b21aa3b82a910d6e444c86ead87293bc77e760f62f70f123e6936cf2bd678786fd24f16fc781c1470b499cb672c4d07c3

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-file-l2-1-0.dll

MD5 dbc82f123f6888c0efd2aa7bee02707b
SHA1 76c95b72a671830e8590e104448f92180c10006a
SHA256 a5993dc5b4fbc0b2463537666bd0f19b3e9824fc4933490278091877bfd707f0
SHA512 547bb55c8337816494597ec796f75838594d3abd6ac24fe5692b28ef9a5af338dfeba17875854b89a21381bfaf41613e072fb632272547762283cae6474fd8c7

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-file-l1-2-0.dll

MD5 85496fce62c235a881dbe880c2b675a0
SHA1 8358f22d29ce31b9f9a8ec5ad440eb1a55f01433
SHA256 8ae99e14f909b91faa3163fc0f9c2a904de1ee5ebba342d708f747276c9d7ca8
SHA512 d0df9266b21e41a64a096ed0b567a0916d352c7fc9aa7c7ffe819c21a4e3552e79badb88c4829d2580643f86a58e191ad853de1d0e282f16f84a44a741782cc9

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-file-l1-1-0.dll

MD5 b6381298d05d704ff02fd878ea692f89
SHA1 2ae2466fcf92c19419ac59e841225ef4877374ec
SHA256 26b3ec7f0ef1d09cfaca62c823566b41be9e83606b996ce92339744d96d34a6b
SHA512 6f3ecdd01c9fd3fb722f48d992bce3234d1f17d247c736252e539171cfe2ecf9e6b282beb359f0a68ddf2142371062ad176fb74692a3820d07b81a60215afc8a

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-fibers-l1-1-1.dll

MD5 46173f3aaeb1830adb3f6cb19bc9fe13
SHA1 5bacc120a80d0ef4722d1489c0563b95f99d1a99
SHA256 affc96d5aa19b374be7a56a859980b56858e22f2a221da8513eec42ffd21a718
SHA512 15f24097564fc57c0f05b1f08043b2789b18a638452018078d262038c407a8ce16658a208c58356ba81146c7a312c054d5b7e9c8d69d19b2cb833500e90c1648

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-fibers-l1-1-0.dll

MD5 fded3e98ae081924dde40f9851967c9c
SHA1 76f3540b40df321216a77268e1d44fa27724e28a
SHA256 8d2e1a7dca9b8c4f6ea8c09bb7db9c729f1c3d16cbbb073f66101fb6f0c30f94
SHA512 64cd2af48b550b43ac424aff7e979f54038b9fcb8e78db777efdd7136efd29a26a3190fcac8d2b0e4a72cab57d6b3b5268240920a8c60b3fc95477e69ffd44f2

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-errorhandling-l1-1-0.dll

MD5 8821e530975129539a0df5ad9485fe6d
SHA1 aea17422ce8fe1ecb0d0542a0df8e3641a1a107e
SHA256 3686c5f867b56611e3766a1c03b6a0480aa99d6ae515238f004f6a2084758776
SHA512 ddcce5f3f6ce35e128c5b3933ecfccece4975e534e1bea2af04efa63dac9d3e9520eb9b3512955bd7d74c3f749169fb4a7e3ea942e895dd70bdb1a343786ca01

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-debug-l1-1-0.dll

MD5 4e82c65e6fac410d119050117d51d88c
SHA1 24e972034996da634fe9a704948f560e03933032
SHA256 4dd548f706fc8b6f72dafd6901454c45b7720d7bad5726bef3c7957f8c0ede8c
SHA512 e024f356ad94dc0b3a1654fe2cfb19a53a4b0fde0cd116d7dd4fba6f4cec60bab8df9447c13c501e75bd202585c296505b865677c77287cf350d4661eb648643

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-datetime-l1-1-0.dll

MD5 7db195e84b72f05c526a87409f33ee12
SHA1 7027364a274c0f8aba2a2e272fee0c5e1e7c5ded
SHA256 ae2fa471ffb72f41c710a44a05dc6f2715ac83833e653fb611b7681599c95bd5
SHA512 405a0091fed7e9d91d495ead66c00694dcd25a770736fffc05d406e40a810181648b8f420e75641ec173fbe3ef421fbabc36b2392a1b9dbe3ea1a446af95848f

C:\Users\Admin\AppData\Local\Temp\_MEI11442\api-ms-win-core-console-l1-1-0.dll

MD5 c45ac67ce87993a1eb2150a4e215ccd1
SHA1 cf337047a279001680585e40629fa997ee14eeba
SHA256 002ef1614c26c22c55e9b33b4577fb6a3ed900bc27d5a0025d6d047c64bcf973
SHA512 540c73913ac933061bfb825607f3759a90e7c0be3f04fef801630375f80acf37c92693b0e6ba6e413022cc67e6a17747e43ca0ebb79f4ca89d6fae2b7720cb3d

memory/4256-1333-0x00007FF8296B0000-0x00007FF8296C9000-memory.dmp

memory/4256-1332-0x00007FF829680000-0x00007FF8296AD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI11442\_bz2.pyd

MD5 74bc4cb52e6b10983fdc2d40d611d8a4
SHA1 fc181a1167d77759781dc086e374f90c78930b7b
SHA256 57e4e02f82eeed869625e9e5e4f2d51f4f4819b24e04c8cee840d82133f2161a
SHA512 378c3fb1f8556cf2a3a0a5df5811903c1626a36fb5f6b52f719e3aa2e066fe1b7db83883f13bd57d5ff81a409919b9fafea0c1acb0980841bd62997a6b25b259

memory/4256-1326-0x00007FF829D80000-0x00007FF829DA5000-memory.dmp

memory/4256-1381-0x00007FF81D600000-0x00007FF81DB22000-memory.dmp

memory/4256-1383-0x00007FF82D070000-0x00007FF82D07D000-memory.dmp

memory/4256-1382-0x00007FF829640000-0x00007FF829659000-memory.dmp

memory/4256-1384-0x00007FF829240000-0x00007FF829273000-memory.dmp

memory/4256-1386-0x00007FF81DB30000-0x00007FF81E200000-memory.dmp

memory/4256-1387-0x00007FF82C080000-0x00007FF82C08D000-memory.dmp

memory/4256-1385-0x00007FF81D530000-0x00007FF81D5FD000-memory.dmp

memory/4256-1391-0x00007FF829680000-0x00007FF8296AD000-memory.dmp

memory/4256-1390-0x00007FF81D410000-0x00007FF81D52B000-memory.dmp

memory/4256-1389-0x00007FF829210000-0x00007FF829237000-memory.dmp

memory/4256-1388-0x00007FF829BB0000-0x00007FF829BBB000-memory.dmp

memory/4256-1393-0x00007FF82DD60000-0x00007FF82DD6B000-memory.dmp

memory/4256-1412-0x00007FF81FE90000-0x00007FF81FE9D000-memory.dmp

memory/4256-1413-0x00007FF81FDD0000-0x00007FF81FDE2000-memory.dmp

memory/4256-1414-0x00007FF81FDB0000-0x00007FF81FDC4000-memory.dmp

memory/4256-1411-0x00007FF81FEA0000-0x00007FF81FEAB000-memory.dmp

memory/4256-1410-0x00007FF81FDF0000-0x00007FF81FE06000-memory.dmp

memory/4256-1409-0x00007FF81FE10000-0x00007FF81FE1C000-memory.dmp

memory/4256-1408-0x00007FF81FE70000-0x00007FF81FE82000-memory.dmp

memory/4256-1407-0x00007FF81D600000-0x00007FF81DB22000-memory.dmp

memory/4256-1406-0x00007FF8250B0000-0x00007FF8250BC000-memory.dmp

memory/4256-1405-0x00007FF8250C0000-0x00007FF8250CB000-memory.dmp

memory/4256-1417-0x00007FF81D530000-0x00007FF81D5FD000-memory.dmp

memory/4256-1416-0x00007FF82DD80000-0x00007FF82DD9B000-memory.dmp

memory/4256-1415-0x00007FF81E830000-0x00007FF81E852000-memory.dmp

memory/4256-1404-0x00007FF829660000-0x00007FF829675000-memory.dmp

memory/4256-1403-0x00007FF825740000-0x00007FF82574B000-memory.dmp

memory/4256-1402-0x00007FF825750000-0x00007FF82575C000-memory.dmp

memory/4256-1401-0x00007FF827940000-0x00007FF82794E000-memory.dmp

memory/4256-1400-0x00007FF828D10000-0x00007FF828D1D000-memory.dmp

memory/4256-1399-0x00007FF828D20000-0x00007FF828D2C000-memory.dmp

memory/4256-1398-0x00007FF828D30000-0x00007FF828D3B000-memory.dmp

memory/4256-1397-0x00007FF8291E0000-0x00007FF8291EC000-memory.dmp

memory/4256-1396-0x00007FF8291F0000-0x00007FF8291FB000-memory.dmp

memory/4256-1395-0x00007FF829200000-0x00007FF82920C000-memory.dmp

memory/4256-1394-0x00007FF829350000-0x00007FF82935B000-memory.dmp

memory/4256-1392-0x00007FF82DD70000-0x00007FF82DD7D000-memory.dmp

memory/4256-1419-0x00007FF81E7E0000-0x00007FF81E82D000-memory.dmp

memory/4256-1418-0x00007FF81EB70000-0x00007FF81EB89000-memory.dmp

memory/4256-1420-0x00007FF81EB50000-0x00007FF81EB61000-memory.dmp

memory/4256-1421-0x00007FF81D1D0000-0x00007FF81D202000-memory.dmp

memory/4256-1423-0x00007FF81EB30000-0x00007FF81EB4E000-memory.dmp

memory/4256-1422-0x00007FF82DD70000-0x00007FF82DD7D000-memory.dmp

memory/4256-1424-0x00007FF81D170000-0x00007FF81D1CD000-memory.dmp

memory/4256-1425-0x00007FF81D130000-0x00007FF81D168000-memory.dmp

memory/4256-1426-0x00007FF81D100000-0x00007FF81D12A000-memory.dmp

memory/4256-1429-0x00007FF81D0D0000-0x00007FF81D0FF000-memory.dmp

memory/4256-1428-0x00007FF82DD80000-0x00007FF82DD9B000-memory.dmp

memory/4256-1427-0x00007FF81E830000-0x00007FF81E852000-memory.dmp

memory/4256-1430-0x00007FF81D0A0000-0x00007FF81D0C4000-memory.dmp

memory/4256-1431-0x00007FF81CF20000-0x00007FF81D097000-memory.dmp

memory/4256-1433-0x00007FF81CF00000-0x00007FF81CF18000-memory.dmp

memory/4256-1432-0x00007FF81E7E0000-0x00007FF81E82D000-memory.dmp

memory/4256-1441-0x00007FF81CEA0000-0x00007FF81CEAC000-memory.dmp

memory/4256-1444-0x00007FF81CE70000-0x00007FF81CE7C000-memory.dmp

memory/4256-1443-0x00007FF81CE80000-0x00007FF81CE8E000-memory.dmp

memory/4256-1442-0x00007FF81CE90000-0x00007FF81CE9D000-memory.dmp

memory/4256-1440-0x00007FF81CEB0000-0x00007FF81CEBB000-memory.dmp

memory/4256-1439-0x00007FF81CEC0000-0x00007FF81CECC000-memory.dmp

memory/4256-1438-0x00007FF81CED0000-0x00007FF81CEDB000-memory.dmp

memory/4256-1437-0x00007FF81CEE0000-0x00007FF81CEEC000-memory.dmp

memory/4256-1436-0x00007FF81CEF0000-0x00007FF81CEFB000-memory.dmp

memory/4256-1435-0x00007FF81E7C0000-0x00007FF81E7CB000-memory.dmp

memory/4256-1434-0x00007FF81EB50000-0x00007FF81EB61000-memory.dmp

memory/4256-1455-0x00007FF81D100000-0x00007FF81D12A000-memory.dmp

memory/4256-1457-0x00007FF81CDB0000-0x00007FF81CDE4000-memory.dmp

memory/4256-1456-0x00007FF81D0D0000-0x00007FF81D0FF000-memory.dmp

memory/4256-1458-0x00007FF81D0A0000-0x00007FF81D0C4000-memory.dmp

memory/4256-1460-0x00007FF81CB60000-0x00007FF81CDAA000-memory.dmp

memory/4256-1459-0x00007FF81CF20000-0x00007FF81D097000-memory.dmp

memory/4256-1454-0x00007FF81CDF0000-0x00007FF81CDFC000-memory.dmp

memory/4256-1453-0x00007FF81CE20000-0x00007FF81CE2D000-memory.dmp

memory/4256-1452-0x00007FF81D130000-0x00007FF81D168000-memory.dmp

memory/4256-1451-0x00007FF81CE30000-0x00007FF81CE3B000-memory.dmp

memory/4256-1450-0x00007FF81CE00000-0x00007FF81CE12000-memory.dmp

memory/4256-1449-0x00007FF81CE40000-0x00007FF81CE4C000-memory.dmp

memory/4256-1448-0x00007FF81D170000-0x00007FF81D1CD000-memory.dmp

memory/4256-1447-0x00007FF81CE50000-0x00007FF81CE5B000-memory.dmp

memory/4256-1461-0x00007FF81C360000-0x00007FF81CB5B000-memory.dmp

memory/4256-1446-0x00007FF81D1D0000-0x00007FF81D202000-memory.dmp

memory/4256-1445-0x00007FF81CE60000-0x00007FF81CE6B000-memory.dmp

memory/4256-1463-0x00007FF81AE90000-0x00007FF81AEE5000-memory.dmp

memory/4256-1462-0x00007FF81CF00000-0x00007FF81CF18000-memory.dmp

memory/4256-1464-0x00007FF81CE60000-0x00007FF81CE6B000-memory.dmp

memory/4256-1465-0x00007FF81F5A0000-0x00007FF81F880000-memory.dmp

memory/4256-1466-0x00007FF813A60000-0x00007FF815B53000-memory.dmp

memory/4256-1469-0x00007FF81ECF0000-0x00007FF81ED11000-memory.dmp

memory/4256-1468-0x00007FF81CE00000-0x00007FF81CE12000-memory.dmp

memory/4256-1467-0x00007FF81F500000-0x00007FF81F517000-memory.dmp

memory/4256-1470-0x00007FF81ECC0000-0x00007FF81ECE2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jdufhxfz.efu.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4256-1509-0x00007FF829660000-0x00007FF829675000-memory.dmp

memory/4256-1522-0x00007FF829200000-0x00007FF82920C000-memory.dmp

memory/4256-1504-0x00007FF81DB30000-0x00007FF81E200000-memory.dmp

memory/4256-1545-0x00007FF81D1D0000-0x00007FF81D202000-memory.dmp

memory/4256-1544-0x00007FF81EB50000-0x00007FF81EB61000-memory.dmp

memory/4256-1543-0x00007FF81E7E0000-0x00007FF81E82D000-memory.dmp

memory/4256-1542-0x00007FF81EB70000-0x00007FF81EB89000-memory.dmp

memory/4256-1541-0x00007FF82DD80000-0x00007FF82DD9B000-memory.dmp

memory/4256-1540-0x00007FF81E830000-0x00007FF81E852000-memory.dmp

memory/4256-1539-0x00007FF81FDB0000-0x00007FF81FDC4000-memory.dmp

memory/4256-1538-0x00007FF81FDD0000-0x00007FF81FDE2000-memory.dmp

memory/4256-1537-0x00007FF81FDF0000-0x00007FF81FE06000-memory.dmp

memory/4256-1536-0x00007FF81FE10000-0x00007FF81FE1C000-memory.dmp

memory/4256-1535-0x00007FF81FE70000-0x00007FF81FE82000-memory.dmp

memory/4256-1534-0x00007FF81FE90000-0x00007FF81FE9D000-memory.dmp

memory/4256-1533-0x00007FF81FEA0000-0x00007FF81FEAB000-memory.dmp

memory/4256-1532-0x00007FF8250B0000-0x00007FF8250BC000-memory.dmp

memory/4256-1531-0x00007FF8250C0000-0x00007FF8250CB000-memory.dmp

memory/4256-1530-0x00007FF825740000-0x00007FF82574B000-memory.dmp

memory/4256-1529-0x00007FF825750000-0x00007FF82575C000-memory.dmp

memory/4256-1528-0x00007FF827940000-0x00007FF82794E000-memory.dmp

memory/4256-1527-0x00007FF828D10000-0x00007FF828D1D000-memory.dmp

memory/4256-1526-0x00007FF828D20000-0x00007FF828D2C000-memory.dmp

memory/4256-1525-0x00007FF828D30000-0x00007FF828D3B000-memory.dmp

memory/4256-1524-0x00007FF8291E0000-0x00007FF8291EC000-memory.dmp

memory/4256-1523-0x00007FF8291F0000-0x00007FF8291FB000-memory.dmp

memory/4256-1521-0x00007FF829350000-0x00007FF82935B000-memory.dmp

memory/4256-1520-0x00007FF82DD60000-0x00007FF82DD6B000-memory.dmp

memory/4256-1519-0x00007FF82DD70000-0x00007FF82DD7D000-memory.dmp

memory/4256-1518-0x00007FF81D410000-0x00007FF81D52B000-memory.dmp

memory/4256-1517-0x00007FF829210000-0x00007FF829237000-memory.dmp

memory/4256-1516-0x00007FF829BB0000-0x00007FF829BBB000-memory.dmp

memory/4256-1515-0x00007FF82C080000-0x00007FF82C08D000-memory.dmp

memory/4256-1514-0x00007FF81D530000-0x00007FF81D5FD000-memory.dmp

memory/4256-1513-0x00007FF829240000-0x00007FF829273000-memory.dmp

memory/4256-1512-0x00007FF82D070000-0x00007FF82D07D000-memory.dmp

memory/4256-1511-0x00007FF829640000-0x00007FF829659000-memory.dmp

memory/4256-1510-0x00007FF81D600000-0x00007FF81DB22000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI36122\attrs-24.2.0.dist-info\INSTALLER

MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

memory/1620-2946-0x00007FF82C080000-0x00007FF82C08D000-memory.dmp

memory/1620-2952-0x00007FF827940000-0x00007FF82794B000-memory.dmp

memory/1620-2951-0x00007FF828D10000-0x00007FF828D1C000-memory.dmp

memory/1620-2950-0x00007FF829350000-0x00007FF82935B000-memory.dmp

memory/1620-2949-0x00007FF829640000-0x00007FF82964C000-memory.dmp

memory/1620-2948-0x00007FF829BB0000-0x00007FF829BBB000-memory.dmp

memory/1620-2947-0x00007FF829D80000-0x00007FF829D8B000-memory.dmp

memory/1620-2945-0x00007FF81EC00000-0x00007FF81ED1B000-memory.dmp

memory/1620-2944-0x00007FF81FDB0000-0x00007FF81FDD7000-memory.dmp

memory/1620-2943-0x00007FF82D070000-0x00007FF82D07B000-memory.dmp

memory/1620-2941-0x00007FF81F5A0000-0x00007FF81F66D000-memory.dmp

memory/1620-2940-0x00007FF81FDE0000-0x00007FF81FE13000-memory.dmp

memory/1620-2937-0x00007FF81D600000-0x00007FF81DB22000-memory.dmp

memory/1620-2936-0x00007FF825740000-0x00007FF825755000-memory.dmp

memory/1620-2931-0x00007FF81DB30000-0x00007FF81E200000-memory.dmp

memory/1620-2942-0x00007FF82D7B0000-0x00007FF82D7BD000-memory.dmp

memory/1620-2939-0x00007FF82DD60000-0x00007FF82DD6D000-memory.dmp

memory/1620-2938-0x00007FF8250B0000-0x00007FF8250C9000-memory.dmp

memory/1620-2935-0x00007FF81FE80000-0x00007FF81FEAD000-memory.dmp

memory/1620-2934-0x00007FF828D20000-0x00007FF828D39000-memory.dmp

memory/1620-2933-0x00007FF82E5C0000-0x00007FF82E5CF000-memory.dmp

memory/1620-2932-0x00007FF829650000-0x00007FF829675000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-16 14:48

Reported

2024-12-16 14:53

Platform

win11-20241007-en

Max time kernel

236s

Max time network

240s

Command Line

"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"

Signatures

Enumerates VirtualBox DLL files

Description Indicator Process Target
File opened (read-only) C:\windows\system32\vboxmrxnp.dll C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
File opened (read-only) C:\windows\system32\vboxhook.dll C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
File opened (read-only) C:\windows\system32\vboxmrxnp.dll C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
File opened (read-only) C:\windows\system32\vboxhook.dll C:\Users\Admin\pysilon\pysilon.exe N/A
File opened (read-only) C:\windows\system32\vboxmrxnp.dll C:\Users\Admin\pysilon\pysilon.exe N/A
File opened (read-only) C:\windows\system32\vboxhook.dll C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\"" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\"" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pysilon = "C:\\Users\\Admin\\pysilon\\pysilon.exe" C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A

Checks installed software on the system

discovery

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml C:\Windows\System32\oobe\UserOOBEBroker.exe N/A
File opened for modification C:\Windows\Panther\UnattendGC\setupact.log C:\Windows\System32\oobe\UserOOBEBroker.exe N/A
File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log C:\Windows\System32\oobe\UserOOBEBroker.exe N/A
File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml C:\Windows\System32\oobe\UserOOBEBroker.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileCoAuth.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileCoAuth.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Interface\{B54E7079-90C9-4C62-A6B8-B2834C33A04A}\ = "IGetSpecialFolderInfoCallback" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Interface\{2692D1F2-2C7C-4AE0-8E73-8F37736C912D}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\ = "StorageProviderUriSource Class" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Interface\{944903E8-B03F-43A0-8341-872200D2DA9C}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\odopen\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\Interface\{2EB31403-EBE0-41EA-AE91-A1953104EA55}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\TypeLib C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\TypeLib\ = "{082D3FEC-D0D0-4DF6-A988-053FECE7B884}" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\odopen C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2} C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Interface\{2387C6BD-9A36-41A2-88ED-FF731E529384}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Interface\{8B9F14F4-9559-4A3F-B7D0-312E992B6D98} C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Interface\{679EC955-75AA-4FB2-A7ED-8C0152ECF409}\ = "ISyncEngineDeviceNotifications" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\Interface\{10C9242E-D604-49B5-99E4-BF87945EF86C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\Interface\{9E1CD0DF-72E7-4284-9598-342C0A46F96B}\TypeLib C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Interface\{B54E7079-90C9-4C62-A6B8-B2834C33A04A}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\ContextMenuOptIn C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\ = "FileSyncClient AutoPlayHandler Class" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\Interface\{0299ECA9-80B6-43C8-A79A-FB1C5F19E7D8}\TypeLib C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_CLASSES\INTERFACE\{2387C6BD-9A36-41A2-88ED-FF731E529384}\PROXYSTUBCLSID32 C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\BannerNotificationHandler.BannerNotificationHandler\CurVer\ = "BannerNotificationHandler.AutoBannerNotificationHandlerPlayHandler.1" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\ = "NucleusNativeMessaging Class" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\Interface\{2387C6BD-9A36-41A2-88ED-FF731E529384}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32 C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\Interface\{e9de26a1-51b2-47b4-b1bf-c87059cc02a7}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_CLASSES\WOW6432NODE\INTERFACE\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\PROXYSTUBCLSID32 C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_CLASSES\WOW6432NODE\INTERFACE\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\TYPELIB C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\Interface\{2EB31403-EBE0-41EA-AE91-A1953104EA55}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A} C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\Interface\{1196AE48-D92B-4BC7-85DE-664EC3F761F1} C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Interface\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\Interface\{5d65dd0d-81bf-4ff4-aeea-6effb445cb3f}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\TypeLib\{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}\1.0\FLAGS\ = "0" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\Interface\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Interface\{EE15BBBB-9E60-4C52-ABCB-7540FF3DF6B3}\TypeLib C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\Interface\{31508CC7-9BC7-494B-9D0F-7B1C7F144182}\TypeLib\ = "{C9F3F6BB-3172-4CD8-9EB7-37C9BE601C87}" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}\ = "IGetLinkCallback" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17} C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\Interface\{944903E8-B03F-43A0-8341-872200D2DA9C}\TypeLib C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\odopen\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /url:\"%1\"" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_CLASSES\INTERFACE\{C1439245-96B4-47FC-B391-679386C5D40F}\PROXYSTUBCLSID32 C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_CLASSES\INTERFACE\{466F31F7-9892-477E-B189-FA5C59DE3603}\TYPELIB C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_CLASSES\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\INPROCSERVER32 C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\Interface\{d8c80ebb-099c-4208-afa3-fbc4d11f8a3c}\TypeLib C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\Interface\{B05D37A9-03A2-45CF-8850-F660DF0CBF07}\ = "IOneDriveInfoProvider" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\FileSyncClient.FileSyncClient.1\CLSID\ = "{7B37E4E2-C62F-4914-9620-8FB5062718CC}" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E} C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Interface\{b5c25645-7426-433f-8a5f-42b7ff27a7b2}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\VersionIndependentProgID\ = "FileSyncClient.AutoPlayHandler" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Interface\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Interface\{385ED83D-B50C-4580-B2C3-9E64DBE7F511}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32 C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Interface\{AEEBAD4E-3E0A-415B-9B94-19C499CD7B6A}\TypeLib C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A} C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\WOW6432Node\Interface\{ACDB5DB0-C9D5-461C-BAAA-5DCE0B980E40}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\pysilon\pysilon.exe N/A
N/A N/A C:\Users\Admin\pysilon\pysilon.exe N/A
N/A N/A C:\Users\Admin\pysilon\pysilon.exe N/A
N/A N/A C:\Users\Admin\pysilon\pysilon.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\pysilon\pysilon.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\pysilon\pysilon.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5332 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
PID 5332 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
PID 1756 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1756 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1756 wrote to memory of 5220 N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe C:\Windows\system32\cmd.exe
PID 1756 wrote to memory of 5220 N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe C:\Windows\system32\cmd.exe
PID 5220 wrote to memory of 1460 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 5220 wrote to memory of 1460 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 5220 wrote to memory of 1276 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\pysilon\pysilon.exe
PID 5220 wrote to memory of 1276 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\pysilon\pysilon.exe
PID 5220 wrote to memory of 1764 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 5220 wrote to memory of 1764 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1276 wrote to memory of 3472 N/A C:\Users\Admin\pysilon\pysilon.exe C:\Users\Admin\pysilon\pysilon.exe
PID 1276 wrote to memory of 3472 N/A C:\Users\Admin\pysilon\pysilon.exe C:\Users\Admin\pysilon\pysilon.exe
PID 3472 wrote to memory of 5360 N/A C:\Users\Admin\pysilon\pysilon.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3472 wrote to memory of 5360 N/A C:\Users\Admin\pysilon\pysilon.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3472 wrote to memory of 5752 N/A C:\Users\Admin\pysilon\pysilon.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3472 wrote to memory of 5752 N/A C:\Users\Admin\pysilon\pysilon.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5436 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
PID 5436 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
PID 5436 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
PID 924 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
PID 924 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
PID 924 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
PID 3212 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
PID 3212 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\source_prepared.exe C:\Users\Admin\AppData\Local\Temp\source_prepared.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe

"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe

"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\pysilon\""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\pysilon\activate.bat

C:\Windows\system32\attrib.exe

attrib +s +h .

C:\Users\Admin\pysilon\pysilon.exe

"pysilon.exe"

C:\Windows\system32\taskkill.exe

taskkill /f /im "source_prepared.exe"

C:\Users\Admin\pysilon\pysilon.exe

"pysilon.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\pysilon\""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell (Get-CimInstance Win32_ComputerSystemProduct).UUID

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe

"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe

"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe

"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe

/updateInstalled /background

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe

"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"

C:\Users\Admin\AppData\Local\Temp\source_prepared.exe

"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc

C:\Windows\System32\oobe\UserOOBEBroker.exe

C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileCoAuth.exe

"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileCoAuth.exe" -Embedding

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileCoAuth.exe

"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileCoAuth.exe" -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 discord.com udp
US 162.159.135.232:443 discord.com tcp
US 162.159.133.234:443 gateway.discord.gg tcp
N/A 127.0.0.1:52650 tcp
US 8.8.8.8:53 232.135.159.162.in-addr.arpa udp
GB 2.18.66.48:443 tcp
GB 2.18.66.48:443 tcp
US 95.100.195.152:443 r.bing.com tcp
US 95.100.195.152:443 r.bing.com tcp
US 95.100.195.152:443 r.bing.com tcp
US 95.100.195.152:443 r.bing.com tcp
US 95.100.195.152:443 r.bing.com tcp
US 95.100.195.152:443 r.bing.com tcp
US 20.42.65.89:443 browser.pipe.aria.microsoft.com tcp
US 95.100.195.190:443 www.bing.com tcp
US 13.107.253.64:443 t-ring-s.msedge.net tcp
US 150.171.28.254:443 ax-ring.msedge.net tcp
US 52.123.128.254:443 dual-s-ring.msedge.net tcp
US 8.8.8.8:53 254.128.123.52.in-addr.arpa udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
GB 23.62.195.195:443 cxcs.microsoft.net tcp
US 95.100.195.195:443 www.bing.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI53322\ucrtbase.dll

MD5 5dd82151d2d8e2c0f1fba4ffb493baed
SHA1 12e24daa8902eb0c46cd8497666633f7ce9a8b58
SHA256 ee847c9d37eb901945ddccc2de73f657e3e92b148ae863b63e7f97d05ed558cb
SHA512 d00ba48b4614d2822e26c3bbdfaa171792dfab52bb50f16e66bdbb53efcef3d9b0e2d35816a40c787a63f5fdd8cc494ec5172c001f25e0ae42645cef330ddf5b

C:\Users\Admin\AppData\Local\Temp\_MEI53322\python312.dll

MD5 f23aa992b8e0a301ec8f473d6b784f4b
SHA1 ee73a5da238341cb21a781a3ddcb187d1f971680
SHA256 0ddfba7779ebc44f2fa819a78b54bc730a5543274986e973beee024fab0ecfc6
SHA512 028abb66298fee6173d34f80940f5bdd3988a8373234f32a780ae93e155d90af191d85164077d9b76dc3651bda4d9902ccbfd03d37be3e9662006b65c3defb35

C:\Users\Admin\AppData\Local\Temp\_MEI53322\VCRUNTIME140.dll

MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

memory/1756-1317-0x00007FFA95100000-0x00007FFA957D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI53322\_ctypes.pyd

MD5 6e02d07340dfaea121a64bef762e0d67
SHA1 48b107a7391772ed849fd1f13a7d2eca9fc09593
SHA256 7035c88e2a0099785ef34f89275de92b34ef3299f01c816d844832c55701c3e3
SHA512 8790af18a4ac4a23f67c8c8e5db1217a399fe75519878e89da4faf87b08c8448aab42aa9ddf40087bc3e959a5490d861531637f3978b2ddcda4d727e60887b6e

C:\Users\Admin\AppData\Local\Temp\_MEI53322\python3.dll

MD5 77896345d4e1c406eeff011f7a920873
SHA1 ee8cdd531418cfd05c1a6792382d895ac347216f
SHA256 1e9224ba7190b6301ef47befa8e383d0c55700255d04a36f7dac88ea9573f2fb
SHA512 3e98b1b605d70244b42a13a219f9e124944da199a88ad4302308c801685b0c45a037a76ded319d08dbf55639591404665befe2091f0f4206a9472fee58d55c22

C:\Users\Admin\AppData\Local\Temp\_MEI53322\base_library.zip

MD5 898e35281a756640780dbc31a0b78452
SHA1 845b59cfd9fb152725f250a872e9d1d7a66af258
SHA256 0daa440c78582a693dabbc2325a06d817131bb170bad436b126bad896f1377cd
SHA512 421cc4a15e94293e53f1039b8bb5be7edcbc8e3e0e4abc7f34faf991993f51cb5f51493b58bb341cb9579347ec134b02104454075a8e7e33e45b8e3a66a44d79

memory/1756-1325-0x00007FFA9EDB0000-0x00007FFA9EDD5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI53322\libffi-8.dll

MD5 013a0b2653aa0eb6075419217a1ed6bd
SHA1 1b58ff8e160b29a43397499801cf8ab0344371e7
SHA256 e9d8eb01bb9b02ce3859ba4527938a71b4668f98897d46f29e94b27014036523
SHA512 0bd13fa1d55133ee2a96387e0756f48133987bacd99d1f58bab3be7bffdf868092060c17ab792dcfbb4680f984f40d3f7cc24abdd657b756496aa8884b8f6099

memory/1756-1327-0x00007FFA9EE50000-0x00007FFA9EE5F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI53322\_bz2.pyd

MD5 74bc4cb52e6b10983fdc2d40d611d8a4
SHA1 fc181a1167d77759781dc086e374f90c78930b7b
SHA256 57e4e02f82eeed869625e9e5e4f2d51f4f4819b24e04c8cee840d82133f2161a
SHA512 378c3fb1f8556cf2a3a0a5df5811903c1626a36fb5f6b52f719e3aa2e066fe1b7db83883f13bd57d5ff81a409919b9fafea0c1acb0980841bd62997a6b25b259

memory/1756-1331-0x00007FFA9EE00000-0x00007FFA9EE19000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI53322\_lzma.pyd

MD5 b5527d2f85ff0ef7c781447601c55e8e
SHA1 3c1f96424de9c6075d3dde9c2700027fe6dadb66
SHA256 67f56b6b023600b2ef2dac5b37c75d8df7197f3db714621055a2e37422316e27
SHA512 2ecaa3feda6669e541a9704c380bfa99580e2790795cacd626b3c99e906e698b42c62e7ee69bc48d1f4d3131a91901615b601523d0d95b2d9ba7ec6659a10a62

memory/1756-1333-0x00007FFA987D0000-0x00007FFA987FD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-memory-l1-1-0.dll

MD5 9b0dc77df914ae8c848226bd22df2185
SHA1 925af803f125713297bffbd3f005759ac9591b83
SHA256 074bcaf27670e09e3fda81251886e3340c72cc8d2a4deb6e78f9d2f6b8c93a3f
SHA512 978a78fd9fe5b7771db353b0c10bb0d9f05d78964e0b6a7a3e93702c41b324396508d4223b2683ebeb0b6f5a7f080a6f33a4a0d0031b468505fcf28b622510b2

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-libraryloader-l1-1-0.dll

MD5 0f5bed8c9c9a292aff1c4cc8065c1925
SHA1 b70fca28a5933514fd8a96c4f9c5185a377b1882
SHA256 bc3634c53e7746777421ade3c332da1218561b4f77da4fe3ce5e8c3ceb9c4b0d
SHA512 4a9f350665b1b46e47ea912e04c32db47552442d739f43b93614c9403951d55b9432a6cc9143674d3ff4e003d428098f0dc06496a9b327be573718edbd9253e3

C:\Users\Admin\AppData\Local\Temp\_MEI53322\libjpeg-9.dll

MD5 c22b781bb21bffbea478b76ad6ed1a28
SHA1 66cc6495ba5e531b0fe22731875250c720262db1
SHA256 1eed2385030348c84bbdb75d41d64891be910c27fab8d20fc9e85485fcb569dd
SHA512 9b42cad4a715680a27cd79f466fd2913649b80657ff042528cba2946631387ed9fb027014d215e1baf05839509ca5915d533b91aa958ae0525dea6e2a869b9e4

C:\Users\Admin\AppData\Local\Temp\_MEI53322\libcrypto-3.dll

MD5 f8076a47c6f0dac4754d2a0186f63884
SHA1 d228339ff131fba16f023ec8fa40c658991eb01f
SHA256 3423134795ab8fce58190ae156d4b5d70053bebe6c9a228bea3281855e5357fa
SHA512 a6d4144cbba4a26edf563806696d312d8a3486122b165aae2c1692defc2828f3ff6bd6a7f24df730ff11c12bc60ac4408f9475c19b543ed1116b0a5d3466300b

C:\Users\Admin\AppData\Local\Temp\_MEI53322\freetype.dll

MD5 04a9825dc286549ee3fa29e2b06ca944
SHA1 5bed779bf591752bb7aa9428189ec7f3c1137461
SHA256 50249f68b4faf85e7cd8d1220b7626a86bc507af9ae400d08c8e365f9ab97cde
SHA512 0e937e4de6cbc9d40035b94c289c2798c77c44fc1dc7097201f9fab97c7ff9e56113c06c51693f09908283eda92945b36de67351f893d4e3162e67c078cff4ec

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-crt-utility-l1-1-0.dll

MD5 73e6469b985df8837aeaaa7123708887
SHA1 01673b8891422406bb982d07128dbb3b112b5276
SHA256 95873f3e33077346ca2a3bc7bf7daa7bd2e3048a5484dca4f4528f2b7b538bf9
SHA512 9caef7ac1ca4b43c16df34f1e1d798250b678150042857f9c7fcedb6b2a776056e6881b92c9698cfebe38be09f0af889fce393a354148e754b45afbac146e449

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-crt-time-l1-1-0.dll

MD5 a2de503c4cc56e7de302876fefaae2e7
SHA1 041d5af579283b6ecc8ebfebba21bc8a3af550f1
SHA256 864f666db947dba0cce45f9e47a985a2096cb81da843eb2e63a7fb2c8ea80e46
SHA512 e5593d4857e6b07e7f46b5ec5f6ce50d61d2f82f9d1f1f3343eef1b57e9551b05eb8c5544e1073ac14f97f302839ba08ac86b547cee2b6e7f1079cc738f5c17d

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-crt-string-l1-1-0.dll

MD5 f93b73105c623f5b60819b31924ae650
SHA1 feed1a77273538526af520c355ba165f8f9efd1f
SHA256 f104b2be7f464444232179f3db768221ee0258f9bf3f5c500553b678f2e465ce
SHA512 47e16f338f2b4d2208302eb6b46890afb92c8f8e9a4de8093f60f77b46608cd1b369fbc426ca361909044d310430390e69490c3a5930193035a906f26051467d

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-crt-stdio-l1-1-0.dll

MD5 2a2cff22add761ba49544b5169452940
SHA1 e2583066dc07dcf111930970a57ed330fda9930e
SHA256 04698815e80b8c6c799c6001b0f8220e9a8f2ff88496f808f5d6a49a1f0dab06
SHA512 88adfbba1d385c82fa29f191ee3ea854c5c4aba50b558da7c054019b371a22a7e9e90f37d62d484e3dbe75faa29c977059e1d7c4447ff69749d1b7e0bf523a51

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-crt-runtime-l1-1-0.dll

MD5 0710252cc8f1ed7288521d87c7c6aeb2
SHA1 e5f1e9f8d53d299f65f44e860f3e7deb841a28d9
SHA256 8ee3f2277018ab3e2c52969ee793a4b9ef054c269250e4bde2639f27cfda42c8
SHA512 b99293cf71f90266ce2173df0a09a46ecbfd78526b1d131eba35bf42213ad3801edcd958b2ac9919075674e017502f1be46bbdfa001d879b5562b6de8657a440

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-crt-process-l1-1-0.dll

MD5 cf363f6b59b37f7211d64e098c648a3d
SHA1 5a433297b508d6b274c43e58ea071b26a25a0402
SHA256 80ac7de93f382e9a52137a2fee0d1359a63d19595ac3c9caf72300fd478fdcf9
SHA512 642b589198c8b6d43351464c7f50dec7965c3e6f4bbc4a04feac83c3f9b6fd3860ae8d417abc83491e08d522f4ed2155c283c356acf3e1d12332921dbdec2da2

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-crt-private-l1-1-0.dll

MD5 469dae932dbb2348e4cb0be98c15bb66
SHA1 629dd000ee762686734029471c819ec3726d2b7d
SHA256 dac4a9a9150157dc0b7d1b8f91404cb137c1cc08ffcb6246d601f7a4c8d6f798
SHA512 0fba809005cb7f5e779f4330597c5f5bd36f3b7e0a9ecca609421f05f07a21bb05068a59c0f23a569ee1eadba1930c8474ca3e4f15fdcfde1fbab963544fc432

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-crt-math-l1-1-0.dll

MD5 6edfbe13cae07d22814d0394de60115d
SHA1 0aed26b5d88392ef9a4eebaa4b78bc63291c0075
SHA256 adcf89c534aace75761f79de850f0966f79bd119bd8e87635611943e6d2a317e
SHA512 396c19be2604a7751b664939e3762d32e99dfa55e410a380c9afa302786f55fc9342f9e0a7b97930ba96e843d2ade68d761f41198e1c4d0e0ae43d7e06365365

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-crt-locale-l1-1-0.dll

MD5 7b2b1566e32ecb3751083aa82f56d3f6
SHA1 8511372cc3a3800c43f642b729fd800579285f24
SHA256 ef84b20de4057bd4b64cbcecbea3b9b5c6cc671caa2c7d39d8a02437f1a37b81
SHA512 abf17270321db379732b58ffbea5feb34f62b06bdf023b7f96fb7dfd93d4d1aa9e5f8d8ec2ecb91edb65236446a552ea60fb8e96f677595c3993cdb5bb83e0c1

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-crt-heap-l1-1-0.dll

MD5 dde305b5ba450c86dc0bc240815358ed
SHA1 d3fb825bdeafe9e37e85116932b9254341acdf51
SHA256 28c2796dd9af7261873f180262ceaffb39fb529539925454b9c6cd01137e14f9
SHA512 70648d364fb28347a5f94cbefd5c5a8adb6b0d565a7c6d3624f8c3a0c76c6a51b099fac6dacb39937c23ea4208d2c095a3c63b45918c3617bc2fc71886fee0cf

memory/1756-1380-0x00007FFA9AF30000-0x00007FFA9AF45000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 9f61a852aa4c60ddaacc4d58ba922a35
SHA1 7240245e2aec02f0e3d069716e95358ae52efeb5
SHA256 e95c2ff8c37d29eb7c125a205191ed728a879e7a1527804877cc2080f411a20c
SHA512 746ff87d88fc32655121450159090b4b85c953ea89ae23fb9ff8f338c6b1ac78a87e7121a4c2c13732fbb942362d141f5a98c5ba5d62ad792a9531c95ac88fad

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-crt-environment-l1-1-0.dll

MD5 4caebb22adf188fccb49eb1da05935ea
SHA1 b9dd16e75cd5cfd06cc2db105dec90f01454b4dd
SHA256 998506d8270b5109bf9b0290302183bf1f4551b95722a9f9c15f02d1f90bd532
SHA512 1e37491f541f035a295e0350377b90512407d68ac0e46664d8f8b158ced538431df219db968042378e2a23fb5e798bb6e290a1cb1ecf27633150c197d0bb663c

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-crt-convert-l1-1-0.dll

MD5 e18a689ac01df28a36fc2508d8cc6e03
SHA1 4654999e493502baa8a77b99548a6d841d4b7c67
SHA256 ddb8e51047b92c2b3caab9956962f0af57a5d2840536c33620f07970eaddd8d1
SHA512 c6fb1d517e4383036428889bcb41b6db8f74bf0fdb9ac6cfff37b8834c1026f9a2f48d709aad4b9ac4baf3b1f3092ce5f68bbb2d07f250c599969db7f31d7dc9

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-crt-conio-l1-1-0.dll

MD5 ef555b0c47da9db3359842b4041fa669
SHA1 f3120292d39c248963ecddcdc08247faa4a5f1f7
SHA256 4b3d67596ec2f93fe9639f3f846073cb541b615070cd5094876c5f47b8b47579
SHA512 6846fc469d5c2e7719bc53068252a3139267d5ee390b6ff999c1919e81eb8543ebd2dc7873554b6d537430cdb6875aaec5d7bfb425be9d1e7668505f04268b3a

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-util-l1-1-0.dll

MD5 942fb04662bcc37fdcd80e35a53660ae
SHA1 e0dd736441dcb038ca89179878bdc25238bf314b
SHA256 716c6b088974726268612511e5190459d329a1eee7cbb7dbaa1307775ce66db8
SHA512 67fa78ffd4b68167698a09822e65c2dc6b5ec8859a6157aa3f36c95e167dbecba9266630ecfacc72748367d38484432cd5e305953fd7da4bb549a1c8d935e08d

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-timezone-l1-1-0.dll

MD5 0f6e970dea277438d33eed6a6a61709f
SHA1 34619c9343296107c404dbb11de00affe97185f9
SHA256 c88c3678a4e1bee3f12b2ce947f3bc37ed3d3231a5801ea822cc2c28fa87b078
SHA512 5122e116cb430382419fb205154b96d6e02812230b29d25c6e55f01ff889bcaa1fca9d4eebb04733ec19fb0f8f2785898b5cfe5e2204acd8e7e9884df1b9de1b

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-sysinfo-l1-2-0.dll

MD5 7284671ec86b78c730efb85947c11122
SHA1 3fbf601e0443521081356c20a6d6f3f4e6338a28
SHA256 d77af2a15be5a51cd242c142d755fcafad76af9b57e472179f8c23f0790f106d
SHA512 a29177ded3a23d7bc04f1aa903ff0a63cc9a661335b02e5b913c780bbd4a072ec5b7ca5891fd3a53e9b1b6d3b5ede4b68224da5657c35485137d22ccf8ca7d8a

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-sysinfo-l1-1-0.dll

MD5 f7901231dfeeffeb8ada850c2fe62b42
SHA1 f77d25807d6de27895494aa341075d3d9e999f45
SHA256 a7db43f8af86df869faab7d50626a097a20961579613ddd79ee5580748a4793d
SHA512 5c310067ff89f6cd624c67748c4ba80a522582ae5aae03dfaced74d152962c2d69aa669fb5e3a37091d90492852a2110539a99fb5202b0b14b86a232a8350842

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-synch-l1-2-0.dll

MD5 3edf358d26f05f473dc894d6868446a5
SHA1 1d78885a66e177a94c1af8daa35bcac4e8724f24
SHA256 6e5a3ddfdc21561c0f4e8ef77a4df9f19b1bf9212c91de92946f230e8a6ec91b
SHA512 e20d1e030688cf449ac0a3c7d4f43d5e54c3e65d44371db03c62ae8c8c33e74ca9b77d6ef95f2234b9b33cd7e9d58d7035d32c945bc43c22421641f66d55ea0f

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-synch-l1-1-0.dll

MD5 acb35f65f19e48bc685c06efaa692e26
SHA1 5a48a3d685c829fbb22281e245abbf2742398c82
SHA256 590d924e988503e023848ebdc3f3f01bfcc4e3f7717816c5a68b8f8414ab41f9
SHA512 3bb3ef453916825f675c245424bf18a847a0990398d1fbd349fe3e265aa1aa7c1bf90eedc447bf7de2eda95ed6fb2f8e4e79e3f0222536097afc0e629c5bb42a

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-string-l1-1-0.dll

MD5 698704e1735825ed67348bcd561bc5df
SHA1 7b6c821a3ddf9488e1a4126a54c5fda2155ded5c
SHA256 dce5934af79f7f22d5bd58a9fa6fcf4734ef13ca3b58a26579a6d7471e6b27e5
SHA512 27a392b95ddb368dddce19287b8da5be7f860afeb15a5735d324265b77cdcf78dc6dc33555572f13c0a4e540b8bf900bd3552a183643772708b928b4204f3e35

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-rtlsupport-l1-1-0.dll

MD5 2e107df701850a43e2baba0427859a9e
SHA1 4dac4434b88420a9a67efe4e9b19d877526d7310
SHA256 7e7950b535768988313ae1689be3844f471293e293cec4be845e17c1e8940623
SHA512 369a6133373a1e0a11f807946e32b56b310755d55560004803677dd9b107f401ea9bd9de1f4a93e50e9152f5191b6a5ff36bc78901f070752e28b1b769057c0f

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-profile-l1-1-0.dll

MD5 da5fd555e8136836d33993da6fa23c03
SHA1 02ee3584d0b3dabb0ec36a12e28ea0081a0da3b6
SHA256 6f3b67e02abb67d7fbec15a1415e1858b4900654baa52120e8d887b552b57f2c
SHA512 7425be678d7f829fa110973cee0ad4e6c6d2e3f48a121d5aee5eb619d7e540262320d4b13cfd238c5aa045c9bdcbefe715c4f0fe66e1cb45cde5ecc7c3f8483e

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-processthreads-l1-1-1.dll

MD5 605d8a1ae34b7ee0b92fb5fbdfaacd8b
SHA1 6f62d615fa91c9707ab03995a690c41cb1a7f34d
SHA256 2aaa351f7d1e423ecfd6db6550b1f7d6ef8c76afe238e8491aa7e4827615edd2
SHA512 ee7ddd2bae12e32ad78625f1a2e7efbd83962cbf1251ee429b3ee3e85170f29fec474489cee57089fe23b60fd5097b44980abaaf4ec542df757e6cad8a55c708

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-processthreads-l1-1-0.dll

MD5 2aa1981502b92392e07dc1fbf16b6480
SHA1 9511302223d575a7a108217246ee82dd77b87d30
SHA256 89e233a1b4277f34899e5c4416a9202e3a4fc154c1fb3f56832bb5d90b5e8117
SHA512 005901bf7f9284acb8da987d0b6a5b066966ebcfac1546badd6f4a613287473c0b3d1ef33eacfb270d258c041bbf8303b6068a6adcee2dc6fe6a9e6907c01411

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-processenvironment-l1-1-0.dll

MD5 fa75c06452ddf3d61913a678be6ec7e2
SHA1 4dc8d6f91cba5396f7a4a7820e5574562cce1b6d
SHA256 b958a3e2f5b42ab500995c9d258278a9ad1f8c3a4986f5a1bf04c5decdc8b29e
SHA512 180bde9a8ec16f1c0fd56b131511b79d297cbfa3ee4c9207f7e675eb8e2a295a2a3df1211e25e12854fd099e27570a12ba90d3ffb00da455b7b1ab2f11b8ee11

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-namedpipe-l1-1-0.dll

MD5 e76e0353ee10885c4153f8d5735e62cf
SHA1 cf14fbeda65e5f0b75ad770c53d9af13dc8a4c48
SHA256 f54c36f6cdf0a40ae1ab1772eb27c2e3900e9e21d4f8f2a564a1b3b0326f7dcb
SHA512 ee94cf461aa975f03c046b41ba7d89715f373c78f198a5fe4f918c811781832fadcaac374205da105b9dd76bfd63a15a3073a87b55df5833654537c4bfb971b2

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-kernel32-legacy-l1-1-1.dll

MD5 1190c9c96d3d54b0062b2aa07c345e07
SHA1 9da3cb7923d46eab3704e0521700bd645a27d860
SHA256 cd694dd9de1e8f62ddf41952550310c10264f677c153371b3cc3ff8f68280019
SHA512 e2284e713ea1f78bd4ebb08c6eb279ee3b85b404b96bc75fcb2a23d862815e37773edb31d7eb625f688f9d412d16d3388029e3dc53262b29dd5a6fa8c0bd83d9

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-interlocked-l1-1-0.dll

MD5 ddaef501b07a1130bd236ae285ac9055
SHA1 48febee39cd3c741af1e572a1e2a66cffc646149
SHA256 0c957fd8229184147101bd44501495a94a869122fe665fd56e6f2208ffa66a71
SHA512 9cbb1ade3b6e46400cdad04cbd6c345a08d0924c5bc1feb277c5232216b85bea2a7d38f8b8a5f65b4b6757e72f1032e87557c82f1cfaca75dca084e15398d66e

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-heap-l1-1-0.dll

MD5 45cf0dc216451c35c9c1570eee9aab29
SHA1 787aeab05fd1c0ca2dc44ed502a172997c1010a8
SHA256 fdd78958d9dd6287372197954648d433128d581c26b970cb489c59b399441691
SHA512 558559848166a2fbc4ac11a7ded85eb8fba1b8bc3435557bd7de170cd98fc6d3afe2312ae74147d467aace66178cc166a20321a51ebb5de6799023fffc6198d9

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-handle-l1-1-0.dll

MD5 bdaa0f3421a238477c2cf269d7dd138a
SHA1 72d57f9901d6d404dd1d44548a395c0d61ff863e
SHA256 f98f0004552417be91b3e15340abe1d1b02d78b45217fb93abe4f9ef6b54d108
SHA512 c2cf66fbdd1533141b537db11a2dfe5b21aa3b82a910d6e444c86ead87293bc77e760f62f70f123e6936cf2bd678786fd24f16fc781c1470b499cb672c4d07c3

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-file-l2-1-0.dll

MD5 dbc82f123f6888c0efd2aa7bee02707b
SHA1 76c95b72a671830e8590e104448f92180c10006a
SHA256 a5993dc5b4fbc0b2463537666bd0f19b3e9824fc4933490278091877bfd707f0
SHA512 547bb55c8337816494597ec796f75838594d3abd6ac24fe5692b28ef9a5af338dfeba17875854b89a21381bfaf41613e072fb632272547762283cae6474fd8c7

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-file-l1-2-0.dll

MD5 85496fce62c235a881dbe880c2b675a0
SHA1 8358f22d29ce31b9f9a8ec5ad440eb1a55f01433
SHA256 8ae99e14f909b91faa3163fc0f9c2a904de1ee5ebba342d708f747276c9d7ca8
SHA512 d0df9266b21e41a64a096ed0b567a0916d352c7fc9aa7c7ffe819c21a4e3552e79badb88c4829d2580643f86a58e191ad853de1d0e282f16f84a44a741782cc9

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-file-l1-1-0.dll

MD5 b6381298d05d704ff02fd878ea692f89
SHA1 2ae2466fcf92c19419ac59e841225ef4877374ec
SHA256 26b3ec7f0ef1d09cfaca62c823566b41be9e83606b996ce92339744d96d34a6b
SHA512 6f3ecdd01c9fd3fb722f48d992bce3234d1f17d247c736252e539171cfe2ecf9e6b282beb359f0a68ddf2142371062ad176fb74692a3820d07b81a60215afc8a

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-fibers-l1-1-1.dll

MD5 46173f3aaeb1830adb3f6cb19bc9fe13
SHA1 5bacc120a80d0ef4722d1489c0563b95f99d1a99
SHA256 affc96d5aa19b374be7a56a859980b56858e22f2a221da8513eec42ffd21a718
SHA512 15f24097564fc57c0f05b1f08043b2789b18a638452018078d262038c407a8ce16658a208c58356ba81146c7a312c054d5b7e9c8d69d19b2cb833500e90c1648

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-fibers-l1-1-0.dll

MD5 fded3e98ae081924dde40f9851967c9c
SHA1 76f3540b40df321216a77268e1d44fa27724e28a
SHA256 8d2e1a7dca9b8c4f6ea8c09bb7db9c729f1c3d16cbbb073f66101fb6f0c30f94
SHA512 64cd2af48b550b43ac424aff7e979f54038b9fcb8e78db777efdd7136efd29a26a3190fcac8d2b0e4a72cab57d6b3b5268240920a8c60b3fc95477e69ffd44f2

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-errorhandling-l1-1-0.dll

MD5 8821e530975129539a0df5ad9485fe6d
SHA1 aea17422ce8fe1ecb0d0542a0df8e3641a1a107e
SHA256 3686c5f867b56611e3766a1c03b6a0480aa99d6ae515238f004f6a2084758776
SHA512 ddcce5f3f6ce35e128c5b3933ecfccece4975e534e1bea2af04efa63dac9d3e9520eb9b3512955bd7d74c3f749169fb4a7e3ea942e895dd70bdb1a343786ca01

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-debug-l1-1-0.dll

MD5 4e82c65e6fac410d119050117d51d88c
SHA1 24e972034996da634fe9a704948f560e03933032
SHA256 4dd548f706fc8b6f72dafd6901454c45b7720d7bad5726bef3c7957f8c0ede8c
SHA512 e024f356ad94dc0b3a1654fe2cfb19a53a4b0fde0cd116d7dd4fba6f4cec60bab8df9447c13c501e75bd202585c296505b865677c77287cf350d4661eb648643

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-datetime-l1-1-0.dll

MD5 7db195e84b72f05c526a87409f33ee12
SHA1 7027364a274c0f8aba2a2e272fee0c5e1e7c5ded
SHA256 ae2fa471ffb72f41c710a44a05dc6f2715ac83833e653fb611b7681599c95bd5
SHA512 405a0091fed7e9d91d495ead66c00694dcd25a770736fffc05d406e40a810181648b8f420e75641ec173fbe3ef421fbabc36b2392a1b9dbe3ea1a446af95848f

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-console-l1-1-0.dll

MD5 c45ac67ce87993a1eb2150a4e215ccd1
SHA1 cf337047a279001680585e40629fa997ee14eeba
SHA256 002ef1614c26c22c55e9b33b4577fb6a3ed900bc27d5a0025d6d047c64bcf973
SHA512 540c73913ac933061bfb825607f3759a90e7c0be3f04fef801630375f80acf37c92693b0e6ba6e413022cc67e6a17747e43ca0ebb79f4ca89d6fae2b7720cb3d

C:\Users\Admin\AppData\Local\Temp\_MEI53322\api-ms-win-core-localization-l1-2-0.dll

MD5 24739ebbf1e51b4106518b09f0d26b38
SHA1 b90e291f502afa76922e01c1eddf0f95626957f6
SHA256 7ac6b6ad7094b606bfb194230ca16b6436bcecd4669a1cfcfd880e25ef3bd106
SHA512 6da9d0aaec46e9f9dd5b0cf865075e88390500bdb7aa04f17c961ff8db8a3f1238812b31aed451583c2e1431f3e447418e745cdbc82beccfb8a004522c1b1d3d

memory/1756-1381-0x00007FFA901E0000-0x00007FFA90702000-memory.dmp

memory/1756-1382-0x00007FFA9AA40000-0x00007FFA9AA59000-memory.dmp

memory/1756-1383-0x00007FFA9EA60000-0x00007FFA9EA6D000-memory.dmp

memory/1756-1384-0x00007FFA98790000-0x00007FFA987C3000-memory.dmp

memory/1756-1386-0x00007FFA95030000-0x00007FFA950FD000-memory.dmp

memory/1756-1385-0x00007FFA95100000-0x00007FFA957D0000-memory.dmp

memory/1756-1388-0x00007FFA98780000-0x00007FFA9878D000-memory.dmp

memory/1756-1389-0x00007FFA98770000-0x00007FFA9877B000-memory.dmp

memory/1756-1387-0x00007FFA9EDB0000-0x00007FFA9EDD5000-memory.dmp

memory/1756-1390-0x00007FFA98620000-0x00007FFA98647000-memory.dmp

memory/1756-1391-0x00007FFA94F10000-0x00007FFA9502B000-memory.dmp

memory/1756-1392-0x00007FFA9AF30000-0x00007FFA9AF45000-memory.dmp

memory/1756-1393-0x00007FFA98760000-0x00007FFA9876D000-memory.dmp

memory/1756-1412-0x00007FFA95A90000-0x00007FFA95A9C000-memory.dmp

memory/1756-1411-0x00007FFA95AA0000-0x00007FFA95AB2000-memory.dmp

memory/1756-1410-0x00007FFA9AA40000-0x00007FFA9AA59000-memory.dmp

memory/1756-1409-0x00007FFA985E0000-0x00007FFA985EB000-memory.dmp

memory/1756-1408-0x00007FFA95AC0000-0x00007FFA95ACD000-memory.dmp

memory/1756-1407-0x00007FFA95AD0000-0x00007FFA95ADB000-memory.dmp

memory/1756-1406-0x00007FFA95AE0000-0x00007FFA95AEC000-memory.dmp

memory/1756-1405-0x00007FFA95AF0000-0x00007FFA95AFB000-memory.dmp

memory/1756-1404-0x00007FFA95B00000-0x00007FFA95B0B000-memory.dmp

memory/1756-1403-0x00007FFA95B90000-0x00007FFA95B9C000-memory.dmp

memory/1756-1402-0x00007FFA95BA0000-0x00007FFA95BAE000-memory.dmp

memory/1756-1401-0x00007FFA95BB0000-0x00007FFA95BBD000-memory.dmp

memory/1756-1400-0x00007FFA985B0000-0x00007FFA985BC000-memory.dmp

memory/1756-1399-0x00007FFA985C0000-0x00007FFA985CB000-memory.dmp

memory/1756-1398-0x00007FFA985D0000-0x00007FFA985DC000-memory.dmp

memory/1756-1397-0x00007FFA985F0000-0x00007FFA985FC000-memory.dmp

memory/1756-1396-0x00007FFA98600000-0x00007FFA9860B000-memory.dmp

memory/1756-1395-0x00007FFA98610000-0x00007FFA9861B000-memory.dmp

memory/1756-1394-0x00007FFA901E0000-0x00007FFA90702000-memory.dmp

memory/1756-1413-0x00007FFA95A70000-0x00007FFA95A86000-memory.dmp

memory/1756-1415-0x00007FFA95A50000-0x00007FFA95A62000-memory.dmp

memory/1756-1414-0x00007FFA98790000-0x00007FFA987C3000-memory.dmp

memory/1756-1416-0x00007FFA95030000-0x00007FFA950FD000-memory.dmp

memory/1756-1417-0x00007FFA95A10000-0x00007FFA95A24000-memory.dmp

memory/1756-1418-0x00007FFA94EE0000-0x00007FFA94F02000-memory.dmp

memory/1756-1419-0x00007FFA959F0000-0x00007FFA95A0B000-memory.dmp

memory/1756-1420-0x00007FFA98620000-0x00007FFA98647000-memory.dmp

memory/1756-1423-0x00007FFA94E10000-0x00007FFA94E5D000-memory.dmp

memory/1756-1421-0x00007FFA94F10000-0x00007FFA9502B000-memory.dmp

memory/1756-1422-0x00007FFA94E60000-0x00007FFA94E79000-memory.dmp

memory/1756-1426-0x00007FFA94DB0000-0x00007FFA94DE2000-memory.dmp

memory/1756-1425-0x00007FFA94DF0000-0x00007FFA94E01000-memory.dmp

memory/1756-1424-0x00007FFA98760000-0x00007FFA9876D000-memory.dmp

memory/1756-1427-0x00007FFA94D80000-0x00007FFA94D9E000-memory.dmp

memory/1756-1428-0x00007FFA95A70000-0x00007FFA95A86000-memory.dmp

memory/1756-1433-0x00007FFA94C20000-0x00007FFA94C4A000-memory.dmp

memory/1756-1432-0x00007FFA95A50000-0x00007FFA95A62000-memory.dmp

memory/1756-1431-0x00007FFA949F0000-0x00007FFA94A1F000-memory.dmp

memory/1756-1430-0x00007FFA94D40000-0x00007FFA94D78000-memory.dmp

memory/1756-1429-0x00007FFA94C50000-0x00007FFA94CAD000-memory.dmp

memory/1756-1434-0x00007FFA949C0000-0x00007FFA949E4000-memory.dmp

memory/1756-1435-0x00007FFA94EE0000-0x00007FFA94F02000-memory.dmp

memory/1756-1436-0x00007FFA83D70000-0x00007FFA83EE7000-memory.dmp

memory/1756-1438-0x00007FFA949A0000-0x00007FFA949B8000-memory.dmp

memory/1756-1437-0x00007FFA959F0000-0x00007FFA95A0B000-memory.dmp

memory/1756-1439-0x00007FFA94D00000-0x00007FFA94D0B000-memory.dmp

memory/1756-1440-0x00007FFA94E10000-0x00007FFA94E5D000-memory.dmp

memory/1756-1442-0x00007FFA94930000-0x00007FFA9493C000-memory.dmp

memory/1756-1444-0x00007FFA94920000-0x00007FFA9492B000-memory.dmp

memory/1756-1443-0x00007FFA94DB0000-0x00007FFA94DE2000-memory.dmp

memory/1756-1441-0x00007FFA94940000-0x00007FFA9494B000-memory.dmp

memory/1756-1445-0x00007FFA94910000-0x00007FFA9491C000-memory.dmp

memory/1756-1447-0x00007FFA94900000-0x00007FFA9490B000-memory.dmp

memory/1756-1446-0x00007FFA949F0000-0x00007FFA94A1F000-memory.dmp

memory/1756-1449-0x00007FFA948F0000-0x00007FFA948FC000-memory.dmp

memory/1756-1448-0x00007FFA94C20000-0x00007FFA94C4A000-memory.dmp

memory/1756-1450-0x00007FFA949C0000-0x00007FFA949E4000-memory.dmp

memory/1756-1451-0x00007FFA948E0000-0x00007FFA948ED000-memory.dmp

memory/1756-1452-0x00007FFA83D70000-0x00007FFA83EE7000-memory.dmp

memory/1756-1463-0x00007FFA949A0000-0x00007FFA949B8000-memory.dmp

memory/1756-1462-0x00007FFA90E80000-0x00007FFA90EB4000-memory.dmp

memory/1756-1461-0x00007FFA91CF0000-0x00007FFA91CFC000-memory.dmp

memory/1756-1460-0x00007FFA91380000-0x00007FFA91392000-memory.dmp

memory/1756-1459-0x00007FFA947B0000-0x00007FFA947BD000-memory.dmp

memory/1756-1458-0x00007FFA947C0000-0x00007FFA947CB000-memory.dmp

memory/1756-1457-0x00007FFA947D0000-0x00007FFA947DC000-memory.dmp

memory/1756-1456-0x00007FFA947E0000-0x00007FFA947EB000-memory.dmp

memory/1756-1455-0x00007FFA947F0000-0x00007FFA947FB000-memory.dmp

memory/1756-1454-0x00007FFA948C0000-0x00007FFA948CC000-memory.dmp

memory/1756-1453-0x00007FFA948D0000-0x00007FFA948DE000-memory.dmp

memory/1756-1464-0x00007FFA83B20000-0x00007FFA83D6A000-memory.dmp

memory/1756-1465-0x00007FFA83320000-0x00007FFA83B1B000-memory.dmp

memory/1756-1467-0x00007FFA90E20000-0x00007FFA90E75000-memory.dmp

memory/1756-1466-0x00007FFA94930000-0x00007FFA9493C000-memory.dmp

memory/1756-1468-0x00007FFA83040000-0x00007FFA83320000-memory.dmp

memory/1756-1469-0x00007FFA80F40000-0x00007FFA83033000-memory.dmp

memory/1756-1470-0x00007FFA91360000-0x00007FFA91377000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_svlzhx4v.nog.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1756-1522-0x00007FFA98760000-0x00007FFA9876D000-memory.dmp

memory/1756-1534-0x00007FFA95AF0000-0x00007FFA95AFB000-memory.dmp

memory/1756-1533-0x00007FFA95B00000-0x00007FFA95B0B000-memory.dmp

memory/1756-1532-0x00007FFA95B90000-0x00007FFA95B9C000-memory.dmp

memory/1756-1531-0x00007FFA95BA0000-0x00007FFA95BAE000-memory.dmp

memory/1756-1530-0x00007FFA95BB0000-0x00007FFA95BBD000-memory.dmp

memory/1756-1529-0x00007FFA985B0000-0x00007FFA985BC000-memory.dmp

memory/1756-1528-0x00007FFA985C0000-0x00007FFA985CB000-memory.dmp

memory/1756-1527-0x00007FFA985D0000-0x00007FFA985DC000-memory.dmp

memory/1756-1526-0x00007FFA985E0000-0x00007FFA985EB000-memory.dmp

memory/1756-1525-0x00007FFA985F0000-0x00007FFA985FC000-memory.dmp

memory/1756-1524-0x00007FFA98600000-0x00007FFA9860B000-memory.dmp

memory/1756-1523-0x00007FFA98610000-0x00007FFA9861B000-memory.dmp

memory/1756-1521-0x00007FFA94F10000-0x00007FFA9502B000-memory.dmp

memory/1756-1520-0x00007FFA98620000-0x00007FFA98647000-memory.dmp

memory/1756-1519-0x00007FFA98770000-0x00007FFA9877B000-memory.dmp

memory/1756-1518-0x00007FFA98780000-0x00007FFA9878D000-memory.dmp

memory/1756-1536-0x00007FFA95AD0000-0x00007FFA95ADB000-memory.dmp

memory/1756-1535-0x00007FFA95AE0000-0x00007FFA95AEC000-memory.dmp

memory/1756-1517-0x00007FFA95030000-0x00007FFA950FD000-memory.dmp

memory/1756-1516-0x00007FFA98790000-0x00007FFA987C3000-memory.dmp

memory/1756-1515-0x00007FFA9EA60000-0x00007FFA9EA6D000-memory.dmp

memory/1756-1514-0x00007FFA9AA40000-0x00007FFA9AA59000-memory.dmp

memory/1756-1513-0x00007FFA901E0000-0x00007FFA90702000-memory.dmp

memory/1756-1512-0x00007FFA9AF30000-0x00007FFA9AF45000-memory.dmp

memory/1756-1511-0x00007FFA987D0000-0x00007FFA987FD000-memory.dmp

memory/1756-1510-0x00007FFA9EE00000-0x00007FFA9EE19000-memory.dmp

memory/1756-1509-0x00007FFA9EE50000-0x00007FFA9EE5F000-memory.dmp

memory/1756-1508-0x00007FFA9EDB0000-0x00007FFA9EDD5000-memory.dmp

memory/1756-1507-0x00007FFA95100000-0x00007FFA957D0000-memory.dmp

memory/1756-1545-0x00007FFA94E60000-0x00007FFA94E79000-memory.dmp

memory/1756-1537-0x00007FFA95AC0000-0x00007FFA95ACD000-memory.dmp

memory/1756-1549-0x00007FFA949C0000-0x00007FFA949E4000-memory.dmp

memory/1756-1548-0x00007FFA94DB0000-0x00007FFA94DE2000-memory.dmp

memory/1756-1547-0x00007FFA94DF0000-0x00007FFA94E01000-memory.dmp

memory/1756-1546-0x00007FFA94E10000-0x00007FFA94E5D000-memory.dmp

memory/1756-1544-0x00007FFA959F0000-0x00007FFA95A0B000-memory.dmp

memory/1756-1543-0x00007FFA94EE0000-0x00007FFA94F02000-memory.dmp

memory/1756-1542-0x00007FFA95A10000-0x00007FFA95A24000-memory.dmp

memory/1756-1541-0x00007FFA95A50000-0x00007FFA95A62000-memory.dmp

memory/1756-1540-0x00007FFA95A70000-0x00007FFA95A86000-memory.dmp

memory/1756-1539-0x00007FFA95A90000-0x00007FFA95A9C000-memory.dmp

memory/1756-1538-0x00007FFA95AA0000-0x00007FFA95AB2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI12762\attrs-24.2.0.dist-info\INSTALLER

MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

memory/3472-2944-0x00007FFA98610000-0x00007FFA9861B000-memory.dmp

memory/3472-2948-0x00007FFA985D0000-0x00007FFA985DC000-memory.dmp

memory/3472-2947-0x00007FFA985E0000-0x00007FFA985EB000-memory.dmp

memory/3472-2946-0x00007FFA985F0000-0x00007FFA985FC000-memory.dmp

memory/3472-2945-0x00007FFA98600000-0x00007FFA9860B000-memory.dmp

memory/3472-2942-0x00007FFA94F10000-0x00007FFA9502B000-memory.dmp

memory/3472-2941-0x00007FFA98620000-0x00007FFA98647000-memory.dmp

memory/3472-2940-0x00007FFA98770000-0x00007FFA9877B000-memory.dmp

memory/3472-2939-0x00007FFA98780000-0x00007FFA9878D000-memory.dmp

memory/3472-2938-0x00007FFA95030000-0x00007FFA950FD000-memory.dmp

memory/3472-2934-0x00007FFA901E0000-0x00007FFA90702000-memory.dmp

memory/3472-2932-0x00007FFA987D0000-0x00007FFA987FD000-memory.dmp

memory/3472-2928-0x00007FFA95100000-0x00007FFA957D0000-memory.dmp

memory/3472-2943-0x00007FFA98760000-0x00007FFA9876D000-memory.dmp

memory/3472-2937-0x00007FFA98790000-0x00007FFA987C3000-memory.dmp

memory/3472-2936-0x00007FFA9EA60000-0x00007FFA9EA6D000-memory.dmp

memory/3472-2935-0x00007FFA9AA40000-0x00007FFA9AA59000-memory.dmp

memory/3472-2933-0x00007FFA9AF30000-0x00007FFA9AF45000-memory.dmp

memory/3472-2931-0x00007FFA9EE00000-0x00007FFA9EE19000-memory.dmp

memory/3472-2930-0x00007FFA9EE50000-0x00007FFA9EE5F000-memory.dmp

memory/3472-2929-0x00007FFA9EDB0000-0x00007FFA9EDD5000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

MD5 76fbe77cbc68f3bd5f0decad25775716
SHA1 2ebc2dea0b2224ea73fb5413d94ad38218122bf3
SHA256 8d59129db45c9f234318144380c9d167d89a9faa8e2a6aede9b5a3bcfdf650b6
SHA512 1a5d850914bd033defe42de3a333c2a7497927a07289258acd5ec08e973b4ed45030b0f299d6da5bac16ad607ed471b3db52a5c9676a532ecaa0836682618230

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

MD5 0c71204dc7dd088aa8f1b279e29d7bf5
SHA1 475dbeb8589312574e6b5f3ca2913b8b80af155b
SHA256 28f655f695c0992c73fa7b02fca2c93b65aec5b8c82297e1be30ed9016eb54a1
SHA512 f10ec78286923446833e4f19900a790be0440885688fe273a811648de090a765ea82ef8ccc062987ec12285e0de608b803671d01358a18dd4504f90845169826

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\6524d3f6-daee-40e1-8443-1fa1344d52c2.down_data

MD5 5683c0028832cae4ef93ca39c8ac5029
SHA1 248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256 855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512 aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.json

MD5 e516a60bc980095e8d156b1a99ab5eee
SHA1 238e243ffc12d4e012fd020c9822703109b987f6
SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
SHA512 9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZS61I3D6\update100[2].xml

MD5 53244e542ddf6d280a2b03e28f0646b7
SHA1 d9925f810a95880c92974549deead18d56f19c37
SHA256 36a6bd38a8a6f5a75b73caffae5ae66dfabcaefd83da65b493fa881ea8a64e7d
SHA512 4aa71d92ea2c46df86565d97aac75395371d3e17877ab252a297b84dca2ab251d50aaffc62eab9961f0df48de6f12be04a1f4a2cbde75b9ae7bcce6eb5450c62

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe

MD5 fb4aa59c92c9b3263eb07e07b91568b5
SHA1 6071a3e3c4338b90d892a8416b6a92fbfe25bb67
SHA256 e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9
SHA512 60aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.ini

MD5 77b179bf41fc05720ded6b3f548c02c5
SHA1 6ff5716391e797783dd0e6c1ac813ecbb162ac48
SHA256 da6d80c38ceff5a3612ff991f1767208c6a16c43879c311837cf776a377ac1d3
SHA512 39b407734afb66e20890c6f619361bfde07235eaaff77a5a1a60add75d23d87c31a3b4281fe2a26c38cf73b71be0d103db67904f563ea4bab8922671cd71040a

C:\Users\Admin\AppData\Local\Temp\tmp3F90.tmp

MD5 5b16ef80abd2b4ace517c4e98f4ff551
SHA1 438806a0256e075239aa8bbec9ba3d3fb634af55
SHA256 bbc70091b3834af5413b9658b07269badd4cae8d96724bf1f7919f6aab595009
SHA512 69a22b063ab92ca7e941b826400c62be41ae0317143387c8aa8c727b5c9ee3528ddd4014de22a2a2e2cbae801cb041fe477d68d2684353cdf6c83d7ee97c43d4

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini

MD5 cc04d6015cd4395c9b980b280254156e
SHA1 87b176f1330dc08d4ffabe3f7e77da4121c8e749
SHA256 884d272d16605590e511ae50c88842a8ce203a864f56061a3c554f8f8265866e
SHA512 d3cb7853b69649c673814d5738247b5fbaaae5bb7b84e4c7b3ff5c4f1b1a85fc7261a35f0282d79076a9c862e5e1021d31a318d8b2e5a74b80500cb222642940

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-400.png

MD5 e593676ee86a6183082112df974a4706
SHA1 c4e91440312dea1f89777c2856cb11e45d95fe55
SHA256 deb0ec0ee8f1c4f7ea4de2c28ff85087ee5ff8c7e3036c3b0a66d84bae32b6bb
SHA512 11d7ed45f461f44fa566449bb50bcfce35f73fc775744c2d45ea80aeb364fe40a68a731a2152f10edc059dea16b8bab9c9a47da0c9ffe3d954f57da0ff714681

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png

MD5 3c29933ab3beda6803c4b704fba48c53
SHA1 056fe7770a2ba171a54bd60b3c29c4fbb6d42f0c
SHA256 3a7ef7c0bda402fdaff19a479d6c18577c436a5f4e188da4c058a42ef09a7633
SHA512 09408a000a6fa8046649c61ccef36afa1046869506f019f739f67f5c1c05d2e313b95a60bd43d9be882688df1610ad7979dd9d1f16a2170959b526ebd89b8ef7

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png

MD5 22e17842b11cd1cb17b24aa743a74e67
SHA1 f230cb9e5a6cb027e6561fabf11a909aa3ba0207
SHA256 9833b80def72b73fca150af17d4b98c8cd484401f0e2d44320ecd75b5bb57c42
SHA512 8332fc72cd411f9d9fd65950d58bf6440563dc4bd5ce3622775306575802e20c967f0ee6bab2092769a11e2a4ea228dab91a02534beeb8afde8239dd2b90f23a

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDriveStandaloneUpdater.exe

MD5 9cdabfbf75fd35e615c9f85fedafce8a
SHA1 57b7fc9bf59cf09a9c19ad0ce0a159746554d682
SHA256 969fbb03015dd9f33baf45f2750e36b77003a7e18c3954fab890cddc94046673
SHA512 348923f497e615a5cd0ed428eb1e30a792dea310585645b721235d48f3f890398ad51d8955c1e483df0a712ba2c0a18ad99b977be64f5ee6768f955b12a4a236

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDrive.VisualElementsManifest.xml

MD5 5ae2d05d894d1a55d9a1e4f593c68969
SHA1 a983584f58d68552e639601538af960a34fa1da7
SHA256 d21077ad0c29a4c939b8c25f1186e2b542d054bb787b1d3210e9cab48ec3080c
SHA512 152949f5b661980f33608a0804dd8c43d70e056ae0336e409006e764664496fef6e60daa09fecb8d74523d3e7928c0dbd5d8272d8be1cf276852d88370954adc

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Resources.pri

MD5 7473be9c7899f2a2da99d09c596b2d6d
SHA1 0f76063651fe45bbc0b5c0532ad87d7dc7dc53ac
SHA256 e1252527bc066da6838344d49660e4c6ff2d1ddfda036c5ec19b07fdfb90c8c3
SHA512 a4a5c97856e314eedbad38411f250d139a668c2256d917788697c8a009d5408d559772e0836713853704e6a3755601ae7ee433e07a34bd0e7f130a3e28729c45

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-400.png

MD5 096d0e769212718b8de5237b3427aacc
SHA1 4b912a0f2192f44824057832d9bb08c1a2c76e72
SHA256 9a0b901e97abe02036c782eb6a2471e18160b89fd5141a5a9909f0baab67b1ef
SHA512 99eb3d67e1a05ffa440e70b7e053b7d32e84326671b0b9d2fcfcea2633b8566155477b2a226521bf860b471c5926f8e1f8e3a52676cacb41b40e2b97cb3c1173

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-200.png

MD5 d9d00ecb4bb933cdbb0cd1b5d511dcf5
SHA1 4e41b1eda56c4ebe5534eb49e826289ebff99dd9
SHA256 85823f7a5a4ebf8274f790a88b981e92ede57bde0ba804f00b03416ee4feda89
SHA512 8b53dec59bba8b4033e5c6b2ff77f9ba6b929c412000184928978f13b475cd691a854fee7d55026e48eab8ac84cf34fc7cb38e3766bbf743cf07c4d59afb98f4

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-150.png

MD5 ed306d8b1c42995188866a80d6b761de
SHA1 eadc119bec9fad65019909e8229584cd6b7e0a2b
SHA256 7e3f35d5eb05435be8d104a2eacf5bace8301853104a4ea4768601c607ddf301
SHA512 972a42f7677d57fcb8c8cb0720b21a6ffe9303ea58dde276cfe2f26ee68fe4cc8ae6d29f3a21a400253de7c0a212edf29981e9e2bca49750b79dd439461c8335

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-125.png

MD5 09f3f8485e79f57f0a34abd5a67898ca
SHA1 e68ae5685d5442c1b7acc567dc0b1939cad5f41a
SHA256 69e432d1eec44bed4aad35f72a912e1f0036a4b501a50aec401c9fa260a523e3
SHA512 0eafeaf735cedc322719049db6325ccbf5e92de229cace927b78a08317e842261b7adbda03ec192f71ee36e35eb9bf9624589de01beaec2c5597a605fc224130

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-100.png

MD5 1f156044d43913efd88cad6aa6474d73
SHA1 1f6bd3e15a4bdb052746cf9840bdc13e7e8eda26
SHA256 4e11167708801727891e8dd9257152b7391fc483d46688d61f44b96360f76816
SHA512 df791d7c1e7a580e589613b5a56ba529005162d3564fffd4c8514e6afaa5eccea9cea9e1ac43bd9d74ee3971b2e94d985b103176db592e3c775d5feec7aac6d1

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png

MD5 552b0304f2e25a1283709ad56c4b1a85
SHA1 92a9d0d795852ec45beae1d08f8327d02de8994e
SHA256 262b9a30bb8db4fc59b5bc348aa3813c75e113066a087135d0946ad916f72535
SHA512 9559895b66ef533486f43274f7346ad3059c15f735c9ce5351adf1403c95c2b787372153d4827b03b6eb530f75efcf9ae89db1e9c69189e86d6383138ab9c839

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png

MD5 2c7a9e323a69409f4b13b1c3244074c4
SHA1 3c77c1b013691fa3bdff5677c3a31b355d3e2205
SHA256 8efeacefb92d64dfb1c4df2568165df6436777f176accfd24f4f7970605d16c2
SHA512 087c12e225c1d791d7ad0bf7d3544b4bed8c4fb0daaa02aee0e379badae8954fe6120d61fdf1a11007cbcdb238b5a02c54f429b6cc692a145aa8fbd220c0cb2d

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png

MD5 f4e9f958ed6436aef6d16ee6868fa657
SHA1 b14bc7aaca388f29570825010ebc17ca577b292f
SHA256 292cac291af7b45f12404f968759afc7145b2189e778b14d681449132b14f06b
SHA512 cd5d78317e82127e9a62366fd33d5420a6f25d0a6e55552335e64dc39932238abd707fe75d4f62472bc28a388d32b70ff08b6aa366c092a7ace3367896a2bd98

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-200.png

MD5 13e6baac125114e87f50c21017b9e010
SHA1 561c84f767537d71c901a23a061213cf03b27a58
SHA256 3384357b6110f418b175e2f0910cffe588c847c8e55f2fe3572d82999a62c18e
SHA512 673c3bec7c2cd99c07ebfca0f4ab14cd6341086c8702fe9e8b5028aed0174398d7c8a94583da40c32cd0934d784062ad6db71f49391f64122459f8bb00222e08

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-150.png

MD5 a23c55ae34e1b8d81aa34514ea792540
SHA1 3b539dfb299d00b93525144fd2afd7dd9ba4ccbf
SHA256 3df4590386671e0d6fee7108e457eb805370a189f5fdfeaf2f2c32d5adc76abd
SHA512 1423a2534ae71174f34ee527fe3a0db38480a869cac50b08b60a2140b5587b3944967a95016f0b00e3ca9ced1f1452c613bb76c34d7ebd386290667084bce77d

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-100.png

MD5 57a6876000151c4303f99e9a05ab4265
SHA1 1a63d3dd2b8bdc0061660d4add5a5b9af0ff0794
SHA256 8acbdd41252595b7410ca2ed438d6d8ede10bd17fe3a18705eedc65f46e4c1c4
SHA512 c6a2a9124bc6bcf70d2977aaca7e3060380a4d9428a624cc6e5624c75ebb6d6993c6186651d4e54edf32f3491d413714ef97a4cdc42bae94045cd804f0ad7cba

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-400.png

MD5 adbbeb01272c8d8b14977481108400d6
SHA1 1cc6868eec36764b249de193f0ce44787ba9dd45
SHA256 9250ef25efc2a9765cf1126524256fdfc963c8687edfdc4a2ecde50d748ada85
SHA512 c15951cf2dc076ed508665cd7dac2251c8966c1550b78549b926e98c01899ad825535001bd65eeb2f8680cd6753cd47e95606ecf453919f5827ed12bca062887

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-200.png

MD5 f1c75409c9a1b823e846cc746903e12c
SHA1 f0e1f0cf35369544d88d8a2785570f55f6024779
SHA256 fba9104432cbb8ebbd45c18ef1ba46a45dd374773e5aa37d411bb023ded8efd6
SHA512 ed72eb547e0c03776f32e07191ce7022d08d4bcc66e7abca4772cdd8c22d8e7a423577805a4925c5e804ed6c15395f3df8aac7af62f1129e4982685d7e46bd85

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-150.png

MD5 de5ba8348a73164c66750f70f4b59663
SHA1 1d7a04b74bd36ecac2f5dae6921465fc27812fec
SHA256 a0bbe33b798c3adac36396e877908874cffaadb240244095c68dff840dcbbf73
SHA512 85197e0b13a1ae48f51660525557cceaeed7d893dd081939f62e6e8921bb036c6501d3bb41250649048a286ff6bac6c9c1a426d2f58f3e3b41521db26ef6a17c

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png

MD5 8347d6f79f819fcf91e0c9d3791d6861
SHA1 5591cf408f0adaa3b86a5a30b0112863ec3d6d28
SHA256 e8b30bfcee8041f1a70e61ca46764416fd1df2e6086ba4c280bfa2220c226750
SHA512 9f658bc77131f4ac4f730ed56a44a406e09a3ceec215b7a0b2ed42d019d8b13d89ab117affb547a5107b5a84feb330329dc15e14644f2b52122acb063f2ba550

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-100.png

MD5 19876b66df75a2c358c37be528f76991
SHA1 181cab3db89f416f343bae9699bf868920240c8b
SHA256 a024fc5dbe0973fd9267229da4ebfd8fc41d73ca27a2055715aafe0efb4f3425
SHA512 78610a040bbbb026a165a5a50dfbaf4208ebef7407660eea1a20e95c30d0d42ef1d13f647802a2f0638443ae2253c49945ebe018c3499ddbf00cfdb1db42ced1

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-400.png

MD5 e01cdbbd97eebc41c63a280f65db28e9
SHA1 1c2657880dd1ea10caf86bd08312cd832a967be1
SHA256 5cb8fd670585de8a7fc0ceede164847522d287ef17cd48806831ea18a0ceac1f
SHA512 ffd928e289dc0e36fa406f0416fb07c2eb0f3725a9cdbb27225439d75b8582d68705ec508e3c4af1fc4982d06d70ef868cafbfc73a637724dee7f34828d14850

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-200.png

MD5 09773d7bb374aeec469367708fcfe442
SHA1 2bfb6905321c0c1fd35e1b1161d2a7663e5203d6
SHA256 67d1bb54fcb19c174de1936d08b5dbdb31b98cfdd280bcc5122fb0693675e4f2
SHA512 f500ea4a87a24437b60b0dc3ec69fcc5edbc39c2967743ddb41093b824d0845ffddd2df420a12e17e4594df39f63adad5abb69a29f8456fed03045a6b42388bc

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-150.png

MD5 771bc7583fe704745a763cd3f46d75d2
SHA1 e38f9d7466eefc6d3d2aaa327f1bd42c5a5c7752
SHA256 36a6aad9a9947ab3f6ac6af900192f5a55870d798bca70c46770ccf2108fd62d
SHA512 959ea603abec708895b7f4ef0639c3f2d270cfdd38d77ac9bab8289918cbd4dbac3c36c11bb52c6f01b0adae597b647bb784bba513d77875979270f4962b7884

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-125.png

MD5 b83ac69831fd735d5f3811cc214c7c43
SHA1 5b549067fdd64dcb425b88fabe1b1ca46a9a8124
SHA256 cbdcf248f8a0fcd583b475562a7cdcb58f8d01236c7d06e4cdbfe28e08b2a185
SHA512 4b2ee6b3987c048ab7cc827879b38fb3c216dab8e794239d189d1ba71122a74fdaa90336e2ea33abd06ba04f37ded967eb98fd742a02463b6eb68ab917155600

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-100.png

MD5 72747c27b2f2a08700ece584c576af89
SHA1 5301ca4813cd5ff2f8457635bc3c8944c1fb9f33
SHA256 6f028542f6faeaaf1f564eab2605bedb20a2ee72cdd9930bde1a3539344d721b
SHA512 3e7f84d3483a25a52a036bf7fd87aac74ac5af327bb8e4695e39dada60c4d6607d1c04e7769a808be260db2af6e91b789008d276ccc6b7e13c80eb97e2818aba

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDrive.exe

MD5 c2938eb5ff932c2540a1514cc82c197c
SHA1 2d7da1c3bfa4755ba0efec5317260d239cbb51c3
SHA256 5d8273bf98397e4c5053f8f154e5f838c7e8a798b125fcad33cab16e2515b665
SHA512 5deb54462615e39cf7871418871856094031a383e9ad82d5a5993f1e67b7ade7c2217055b657c0d127189792c3bcf6c1fcfbd3c5606f6134adfafcccfa176441

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png

MD5 d03b7edafe4cb7889418f28af439c9c1
SHA1 16822a2ab6a15dda520f28472f6eeddb27f81178
SHA256 a5294e3c7cd855815f8d916849d87bd2357f5165eb4372f248fdf8b988601665
SHA512 59d99f0b9a7813b28bae3ea1ae5bdbbf0d87d32ff621ff20cbe1b900c52bb480c722dd428578dea5d5351cc36f1fa56b2c1712f2724344f026fe534232812962

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe

MD5 57bd9bd545af2b0f2ce14a33ca57ece9
SHA1 15b4b5afff9abba2de64cbd4f0989f1b2fbc4bf1
SHA256 a3a4b648e4dcf3a4e5f7d13cc3d21b0353e496da75f83246cc8a15fada463bdf
SHA512 d134f9881312ddbd0d61f39fd62af5443a4947d3de010fef3b0f6ebf17829bd4c2f13f6299d2a7aad35c868bb451ef6991c5093c2809e6be791f05f137324b39

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini

MD5 6f59c8d2b87c5838e85daddf7f148c58
SHA1 dcb49bdf9f27bdee3f49e4269680d5693958152f
SHA256 dab85825e86843e5cfe20d1a11bde5765793020061563f4ba6f7993a561e7a22
SHA512 37a553f254f9f3fa7201892ac235c92309fc851b73e851579162a4d1d883ce324655a57459eb7f8a780780ad1405e764e31dace73726dc2cb7480b4c3336b0f8

C:\Users\Admin\AppData\Local\Temp\_MEI32122\SDL2.dll

MD5 ec3c1d17b379968a4890be9eaab73548
SHA1 7dbc6acee3b9860b46c0290a9b94a344d1927578
SHA256 aaa11e97c3621ed680ff2388b91acb394173b96a6e8ffbf3b656079cd00a0b9f
SHA512 06a7880ec80174b48156acd6614ab42fb4422cd89c62d11a7723a3c872f213bfc6c1006df8bdc918bb79009943d2b65c6a5c5e89ad824d1a940ddd41b88a1edb

C:\Users\Admin\AppData\Local\Temp\_MEI32122\SDL2_ttf.dll

MD5 eb0ce62f775f8bd6209bde245a8d0b93
SHA1 5a5d039e0c2a9d763bb65082e09f64c8f3696a71
SHA256 74591aab94bb87fc9a2c45264930439bbc0d1525bf2571025cd9804e5a1cd11a
SHA512 34993240f14a89179ac95c461353b102ea74e4180f52c206250bb42c4c8427a019ea804b09a6903674ac00ab2a3c4c686a86334e483110e79733696aa17f4eb6

C:\Users\Admin\AppData\Local\Temp\_MEI32122\SDL2_mixer.dll

MD5 b7b45f61e3bb00ccd4ca92b2a003e3a3
SHA1 5018a7c95dc6d01ba6e3a7e77dd26c2c74fd69bc
SHA256 1327f84e3509f3ccefeef1c12578faf04e9921c145233687710253bf903ba095
SHA512 d3449019824124f3edbda57b3b578713e9c9915e173d31566cd8e4d18f307ac0f710250fe6a906dd53e748db14bfa76ec1b58a6aef7d074c913679a47c5fdbe7

C:\Users\Admin\AppData\Local\Temp\_MEI32122\SDL2_image.dll

MD5 25e2a737dcda9b99666da75e945227ea
SHA1 d38e086a6a0bacbce095db79411c50739f3acea4
SHA256 22b27380d4f1f217f0e5d5c767e5c244256386cd9d87f8ddf303baaf9239fc4c
SHA512 63de988387047c17fd028a894465286fd8f6f8bd3a1321b104c0ceb5473e3e0b923153b4999143efbdd28684329a33a5b468e43f25214037f6cddd4d1884adb8

C:\Users\Admin\AppData\Local\Temp\_MEI32122\_tcl_data\encoding\euc-cn.enc

MD5 c5aa0d11439e0f7682dae39445f5dab4
SHA1 73a6d55b894e89a7d4cb1cd3ccff82665c303d5c
SHA256 1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
SHA512 eee6058bd214c59bcc11e6de7265da2721c119cc9261cfd755a98e270ff74d2d73e3e711aa01a0e3414c46d82e291ef0df2ad6c65ca477c888426d5a1d2a3bc5

C:\Users\Admin\AppData\Local\Temp\_MEI32122\libogg-0.dll

MD5 0d65168162287df89af79bb9be79f65b
SHA1 3e5af700b8c3e1a558105284ecd21b73b765a6dc
SHA256 2ec2322aec756b795c2e614dab467ef02c3d67d527ad117f905b3ab0968ccf24
SHA512 69af81fd2293c31f456b3c78588bb6a372fe4a449244d74bfe5bfaa3134a0709a685725fa05055cfd261c51a96df4b7ebd8b9e143f0e9312c374e54392f8a2c2

C:\Users\Admin\AppData\Local\Temp\_MEI32122\libopus-0.dll

MD5 3fb9d9e8daa2326aad43a5fc5ddab689
SHA1 55523c665414233863356d14452146a760747165
SHA256 fd8de9169ccf53c5968eec0c90e9ff3a66fb451a5bf063868f3e82007106b491
SHA512 f263ea6e0fab84a65fe3a9b6c0fe860919eee828c84b888a5aa52dea540434248d1e810a883a2aff273cd9f22c607db966dd8776e965be6d2cfe1b50a1af1f57

C:\Users\Admin\AppData\Local\Temp\_MEI32122\libpng16-16.dll

MD5 55009dd953f500022c102cfb3f6a8a6c
SHA1 07af9f4d456ddf86a51da1e4e4c5b54b0cf06ddb
SHA256 20391787cba331cfbe32fbf22f328a0fd48924e944e80de20ba32886bf4b6fd2
SHA512 4423d3ec8fef29782f3d4a21feeac9ba24c9c765d770b2920d47b4fb847a96ff5c793b20373833b4ff8bc3d8fa422159c64beffb78ce5768ed22742740a8c6c6

C:\Users\Admin\AppData\Local\Temp\_MEI32122\pygame\zlib1.dll

MD5 ee06185c239216ad4c70f74e7c011aa6
SHA1 40e66b92ff38c9b1216511d5b1119fe9da6c2703
SHA256 0391066f3e6385a9c0fe7218c38f7bd0b3e0da0f15a98ebb07f1ac38d6175466
SHA512 baae562a53d491e19dbf7ee2cff4c13d42de6833036bfdaed9ed441bcbf004b68e4088bd453b7413d60faaf1b334aee71241ba468437d49050b8ccfa9232425d

Analysis: behavioral4

Detonation Overview

Submitted

2024-12-16 14:48

Reported

2024-12-16 15:19

Platform

win11-20241007-en

Max time kernel

438s

Max time network

1156s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A