Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Microsoft OneDriver' = '%APPDATA%\Microsoft OneDrive.exe'
- microsoft onedrive.exe
- %APPDATA%\microsoft onedrive.exe
- 'be######etapiandroid.world':80
- http://be######etapiandroid.world/wordpress/user/login/api.jsp
- DNS ASK be######etapiandroid.world
- '%APPDATA%\microsoft onedrive.exe'