Malware Log Analysis

shared / Angelltann
content copied

content

Start:: CloseProcesses: HKU\S-1-5-21-4114025117-2984660217-649229269-1001\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Angeline\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" (No File) <==== ATTENTION HKU\S-1-5-21-4114025117-2984660217-649229269-1001\...\RunOnce: [Uninstall 26.145.0728.0011] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Angeline\AppData\Local\Microsoft\OneDrive\26.145.0728.0011" (No File) DeleteKey: HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{58885423-9AD1-4F16-8F3B-BE64759E3C1A} DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-4114025117-2984660217-649229269-1001\Products\324588851DA961F4F8B3EB4657E9C3A1 DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F0E8FAA8CAD4E0042ABC85061B13EF3B C:\Users\Angeline\AppData\Local\Brwfxw74WFxXHV File: C:\Users\Angeline\Cookies Folder: C:\Users\Angeline\Cookies Unlock: C:\WINDOWS\Installer\2f78e0ac.msi File: C:\WINDOWS\Installer\2f78e0ac.msi C:\WINDOWS\Installer\2f78e0ac.msi EmptyTemp: End::