Overview

overview

10

Static

static

OneDriveSetup.exe

windows7_x64

1

OneDriveSetup.exe

windows10_x64

10

Analysis

  • max time kernel
    65s
  • max time network
    129s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    21-07-2021 14:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    OneDriveSetup.exe

  • Size

    37.6MB

  • MD5

    16143a6b432ca69e69e8764bca56ed3f

  • SHA1

    e9c7a9a2f2901e3a39077d7eefdb4ade17a6dc27

  • SHA256

    12266562456721eee56d850057587c00f058699db1c5a36cf7bf4a7d287bb51b

  • SHA512

    4dd0b60404a7ca14947dc523c60edb6f6a21fcea9e63524e733eba31585e00ee1ade9c9f8d29fefa6d56a869a1c00a4a228f6cdf915ba76dbfda096f5849c160

Score
10/10
discoverypersistence

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 5 IoCs
    persistence
  • Registers COM server for autorun 1 TTPs
    persistence
  • Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 47 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OneDriveSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\OneDriveSetup.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4092
    • C:\Users\Admin\AppData\Local\Temp\OneDriveSetup.exe
      C:\Users\Admin\AppData\Local\Temp\OneDriveSetup.exe /peruser /childprocess /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions
      2⤵
      • Modifies system executable filetype association
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2116
      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\FileSyncConfig.exe
        "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\FileSyncConfig.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        PID:1868
      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
        /updateInstalled /background
        3⤵
        • Modifies system executable filetype association
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4168
        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
          "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart /updateSource:ODU
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4672
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
            C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /updateSource:ODU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4756
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.119.0613.0001\FileSyncConfig.exe
              "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.119.0613.0001\FileSyncConfig.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops desktop.ini file(s)
              • Modifies registry class
              PID:4940
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 1740
              6⤵
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5000
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s seclogon
    1⤵
    • Suspicious use of NtCreateUserProcessOtherParentProcess
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2120

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\FileSyncClient.dll
    MD5

    bd677672bb00bd48126458d43141b793

    SHA1

    d47a1a17e5ce0c1e3b492c13e2f23ba420b97564

    SHA256

    ab4f4c25009439e5eb1f2e3f12f7f84edbec86bc7f059bd48688b6473a91a7e2

    SHA512

    0cee136f293fe30c48129621b8c5d7fb42a262fda55bd13c108e49af405d53cf83707b95d7bf638fe72b4e9f4fbfdbb41794c924d61436982968baef5e9bed63

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\FileSyncConfig.exe
    MD5

    038f50c8c852158f84f3d030015e468c

    SHA1

    939cf42e5420d66ca21dc5fb8ada119b59bfdb12

    SHA256

    ee17d8b9fc4ff8acd467b49ddf386cae822c5587ec9a84841f1c11464a6430f4

    SHA512

    1016a13dd8f91d9f7e381bbd6484961b8a510ce5179896e0569bf3455e376c4b51da8cbabb87621e43998a78cfc6e0aabb3c20aa51377019d0c2acdb018919a9

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\FileSyncSessions.dll
    MD5

    1a51658455b25bd3d211f2de1bb2936f

    SHA1

    8492b64e951764277c2244105dd3798552e38e53

    SHA256

    18288445b3eb20f774f0e899a4133aeef8b88e94c86f5911ea1216a0bf50a46f

    SHA512

    1a5f7411d5068e192c44958c6fb2a161aa5918456bcb3ec1ab08e331eb417cbaf8ae1bd6e7157d5ed4c79c5ce04bdf38e8cd000fe8f407258bf297d3c644622b

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\FileSyncTelemetryExtensions.dll
    MD5

    182b66ddc8dd9bc915a92dbeccad2da5

    SHA1

    a19a861d25cb7479a1d535282074d48d75e6a319

    SHA256

    e4409c286268ef2141c0aa54b4c17ed628bb830599734f67d088e86ca9a55bb7

    SHA512

    57bd32d23040cbb6a92b1af19be7d198018c5a30ce02814828d9d7587ebdcf9813d0c39df86834b923a2b6d1da68a6ffc9efddc673648520f2478da2e42ec84d

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\FileSyncViews.dll
    MD5

    dc58a0ac40db2c7f80dc1628b85e2ed1

    SHA1

    39454a535d1468665e040c186ac5cf9cc994666a

    SHA256

    80d8f65d82b21c82c23c8e7b9d2679749643fc80fcffa8e71faca5e5c846f626

    SHA512

    3d0a8e18359fc0e6c4523449a653f3c56efad93bd92a442f2795a407df1687c14244cb1d18cc22465e62b04f93cb19e57fa9ac6ea8a2aad5eb413c33e218eaaa

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\LogUploader.dll
    MD5

    66ad43ec5b8b17de4bd66fa1938ca551

    SHA1

    e3f603e9b0d3297ae90ab0fff5e46c45af5f1ff4

    SHA256

    a5c719c5bd6f0302c1f7e6f103db6c946116904765f8b801552df1c7a6d9dfe3

    SHA512

    8f6af08121f0b52e6b2b64eece4be39b0d23963aa07c3297b51e338debe470e49792bf0ca9f2a8e719835164af25b6079152ab56bc3f6e98972a8d0b5e1a0e71

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\LoggingPlatform.DLL
    MD5

    d4eceaff8ef80fc33082bac952b29788

    SHA1

    1f59d2b850ffca373436967decfdf9fdcbd87bb6

    SHA256

    17bcfab2d45bfeac65b2816fd6ba14390fd0806cd79e509ecbde540433005261

    SHA512

    7618150d5bcd248f94f5536f3ca1b5b9eb8837a4aab51c1c6a842ae0a3ac1d5c998a5ad3230187378f7063cfb4c3eac12a068e267b487517b8cbf97ecbc8bed7

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\MSVCP140.dll
    MD5

    f3cd2c1220d03ab767c62550977ceb0b

    SHA1

    53bbe406a32a510b4b6cd1de904686a644eb9e2b

    SHA256

    e2195dfd9b112b7192a381a18056eb0a2c6a152e565867581868e839f0f59029

    SHA512

    cb51507d74db8871c7cd1adffe1a21a7633f7502b82fbf086523b17e84033f8f86cd113beff714a55ee6545fb5718deddf6fa193007f6a0f3d029162577c4a6b

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\OneDriveTelemetryStable.dll
    MD5

    f4ab16a375cbd1a3d6a4f3d97a3547ee

    SHA1

    59626a392036a5360248562d399fd6f5e343c558

    SHA256

    223a4fec9339633253b5caceb26fde821a9f282b48a48f6d1a1a2f8672dc07f4

    SHA512

    44b84cec32e35877d65f7ab77465ecbb8ae07e0d5a7376b618359b6c925dd35ad6944a11d70d9e9d9277c3525b4b9f43652cecfb6087b0000d972388dbf825c5

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Qt5Core.dll
    MD5

    691ba7140d5a93bb181db0f78fa5fe67

    SHA1

    ac2bd0c5730faf1fe16954f7ed855f5ee9d2978f

    SHA256

    2a986948e93fd47a80216aa17879bb01cf38d06305eb150f03ee5622f662f352

    SHA512

    0f711efe1f1d5f6ddd6663fdaa6ba5acdf219551a1d1b937d1f38285385a2b78c967141574c626d860905539cae07cb2dd2d7c91ad7279da7876d0c3cb353f73

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Qt5Gui.dll
    MD5

    f8fc9cda23a75509a8c880199825d0c4

    SHA1

    5f0ed03501ad48af880c6634d32a2a3a9886e96b

    SHA256

    24cbbe305d7bcce189977136896d68274331008528affd5b545b4dce3cc8dc18

    SHA512

    9725fd473d46c43e0f37369cd5ee1fb8703b51df61af8531f25b5065cd656b3ef7b95689fe672854c92ea7a1528836c44a5a48e051fb7d972ead372a84226d51

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Qt5Network.dll
    MD5

    087caa863bfa647a1c6a5c0013be77f3

    SHA1

    be7e9c01f7bb3e4a8eb72c2ded046fb32853df28

    SHA256

    7ca3dcd505b34e63deec39d00e5c793facb9ab51a64040032e133b50cb660813

    SHA512

    b4f25edcdd2f8d80cf51b444b3453fa9fad8f2c238345f2f39be9be008ee830fb9c61aff257f50c3c9699798e0a9df4272c37ca481ca130ac8e037bc6782e1d5

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Qt5Qml.dll
    MD5

    211d7a242e80001f17b2cbf5e771f1bd

    SHA1

    03f848f700207251caf91b529e7c891a0b3e9179

    SHA256

    bdf217a4f2307ae7c9970ebec4148e8e10e28157cb4f9768ec9b5aa50fd46ed7

    SHA512

    9b355758b17e35e409f73b1d37bbde8e018eecda9795aa350aa2219d53964966bbaabd32b5ac706054988f9b54f155dad2a9ae3e1661872fad6061c1b7ce50b9

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Qt5QmlModels.dll
    MD5

    1dfb470ba7b70d5c7fa2cd0bc6ef6969

    SHA1

    414da3b222170ca76e3737bd8f64a7b5de1397df

    SHA256

    a4bb0eab83336be670e1a3035816842435a957f7aa9384643c6738652db6d9cb

    SHA512

    56be4d726bb91b73e77bbcf7a580dc433d0843d4360dde0f64b6867548f91761a70cd4f7b2b45709486939938649af7375303b63a249e52da85425e66f28a76a

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Qt5Quick.dll
    MD5

    72e1e3648f3172e58301f6dbb3f2939c

    SHA1

    507eb19a5bd17044da601c1d225e3f5df1c47b2d

    SHA256

    bfa8a2cfcf23c625b028e723df0426170ce53e9d2bae17b3413192c8454e8396

    SHA512

    e4d583d53a8e267704cb31714de74ef165f9af8c1de4d5eda8b535f3fb5b7579fe9e6f80d020b4babe426b74c12b82fa1278ee827e44e02fe8640589618117f5

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Qt5Widgets.dll
    MD5

    38860a2c4156935b8ba89a81ed3c2920

    SHA1

    304a2d11566105e2049bf35730d85a558c717d2e

    SHA256

    eb08ee65aeff8160dfb06fe74bbd93c203be970c2cfdf2043e575281402ac800

    SHA512

    29a18ae2aed5d409f2945c3c3fceda14ff34eb5fa01e9b0b823372b12175a65fa72936f1dd5fbf3bd9cb6e3324d5f6eed323b377a23d28cd99d380f6124591c2

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Qt5WinExtras.dll
    MD5

    059eef337a44b33513904e4fcfab3139

    SHA1

    c80fdb900e9bf9188380537222962db726fc769f

    SHA256

    7ffe299398b1742b1d0fc70a157ec448693cfd0a7e6f0996dd6916d7fa42b139

    SHA512

    0a6419b2db84bc9d31457bb35091218602200d2979b7551666ffca7e63631fd798b719b6298221e58c87bcc56f7e23ce9922cf68d168c37b9fee7d891e399d0c

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\SyncEngine.DLL
    MD5

    870224ddea021be4593fc5615c9de99d

    SHA1

    b86eb30365bf58bf51262e680c7101a8b1de4a91

    SHA256

    fe2841fd3f5ab4f375ae1de2fb1cb85b002df56413a042f9f7d37b20672092d5

    SHA512

    ba30563d6c89fc83cbc208cb9d88c5a932f55c3a53a008bdd32bb74d1838129aa0487d301c50b06bddf451835b0b52a5581d9a9ea7aabf42ff19021adcb911d2

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Telemetry.dll
    MD5

    edb34ea7f82e478f16421c0f0bc35af1

    SHA1

    b89fd47cebdf09d858d856f1ef1cf348d2279165

    SHA256

    f4fb81ed2bd4196d51e6ba2d8807025cb5a6dc5fedb3889aa50487d57941f5f4

    SHA512

    4f2ef3c72c52f984f8f65674ad183c14a8c34312978b7f8996c8867bb055e9e7d3f06292870191c0c98227b26a463f12bc35f5d66a33a1c8d5e0332cc2fcbc79

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\UpdateRingSettings.dll
    MD5

    66b38c62f6ff9f06f417cf80b1123a94

    SHA1

    bea4e506cbd0550f142676b280a1add02d7dd4b6

    SHA256

    0cebdd3ee3e3c23e546de82f7e5a2c115a77d30e432cd74f02008f56f0a7c3db

    SHA512

    b5692cbf3a6a5c3aefdad3ef26327f21ca7b05562f3d1963cd24715ea83fe8b06928f7977f020258f1827e0280db0f3b8b4fb734a36a4682dae4a62321f02ddd

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\VCRUNTIME140.dll
    MD5

    ed15882d55a355a57e54c4e65ccf3bd0

    SHA1

    83954d6ae0c1536ae6571f27d034cafd8e7e6579

    SHA256

    2514eccaabcc4b100eb468eaa07d5aec06c4b3e02f6089f2153c518d40225992

    SHA512

    676261afcaea0415b86ce4cc1b498be53fa44f1c8bcf6a826ccbcb444a2d2191de554544440277005a9c4364284b38ea758f4e4d9bfb2e3cdc4617843a011edb

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\WebView2Loader.dll
    MD5

    0105fb50c44d0a6e811dfdd3f20c8e2c

    SHA1

    5d8736143ad90c65621470a297fd112f105655ea

    SHA256

    3b03fb6619d630ed693ada6bd529cc2d9655c92a41e9e553e60eaddb23d14b76

    SHA512

    e68215ccf2932b903c0d8bb42cb7f322c7ea8d5dcf88b77f7fd6faffea54b1fd0ea23ea32512af8802fef6e8c891b370b5640ed5c3a67fa1aa45e301b72f2366

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\WnsClientApi.dll
    MD5

    f11a23d45cbe4509162b2e617469c68c

    SHA1

    68c5d5ecafaad49a21436c4c90cf3ee0d5985130

    SHA256

    0bbd56476cfb18a63ba36e2d97eab3f12755bfe485b0c6bb41ceaadca78f5621

    SHA512

    63e2b97b25886c1cbf1edcc65fac9f7e274ff383e5cfc4d5a0f5fab7899b94d7474f381796df2929a813a8dfee837a984440a5d8e1da0f6e19b85363ba9cf570

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\adal.dll
    MD5

    ea697be83efc0b89c84890072ecd3d65

    SHA1

    967f53cf4fc3cbb6a1ff9c8d2a3ac6815e319c48

    SHA256

    f690de5f485d8b3a6f9d232a0e698fbb60e53b9231479c7395d0e0746ef40aee

    SHA512

    3c3cdbad1e043835108627f3ccde6312e3156d06087bea87fc1f14433fcf4ff980b79da3d3fe4f932f12d0ea7f13e9183800fa1410c9db30d9c4339d89f1c1a0

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\libcrypto-1_1.dll
    MD5

    385e4bf8494763d717c1cb4537b916e7

    SHA1

    514fcbcc7a06bf71d6d766ca7367ae3563f81f12

    SHA256

    e731d1e9f8fc27dc1da28e060e5663e69ba798e8b9cf2f85fe39ddba825e0bcb

    SHA512

    211fa36f4c3d8fc8c30737a030f87e97a484e0fb8b9a2d89a2deb53fb2623168d316a3ff1ba2f2d70213a1ec4cbc47f697b3bdf67ae57e15f4ba4d477a680a36

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\libssl-1_1.dll
    MD5

    838c2efb4816fda23172cd31a7a01b95

    SHA1

    9801c7c95b944d0299cadb1a6f769100f4013a33

    SHA256

    0f0022cd25056a20696e55adbe62426fac3a4e8dd2cd189ae26897055fe72671

    SHA512

    8137fac498f14420a6b3674629417bcd130d6879fb0f2f7df58d421daafd2cec5e10b44159249394f3e5c7b8764241a7007d6187fe01d276c2c9fd0b8085ef92

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\ucrtbase.dll
    MD5

    c5d96252ee7abe9b2b1b644e39719168

    SHA1

    d21b82d50ce1101d96ce9b504aed0e231d987127

    SHA256

    8da4dd074a600bec873628d1c744b8ef851f584ab3002191926036bec32dd6e9

    SHA512

    98529ed27acb41640d699ba19ab3a5a4be45788b41f3a583c99c1bf1a03ab0a41ce4007194c15d83f03dd35a746537525638d38e990769865f226c7600257d15

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
    MD5

    b5414ec90ba64871a2353adda12b333f

    SHA1

    7b32fb54db1984d91360ea0ac177b0f53f8fb982

    SHA256

    ac3d9c04f19234a58578b9c9938ac19d62a13f3de89407ad2d85efaf2881bac2

    SHA512

    e4d7423dcc09a014ad53432a1c5a154ebcae7f820128141c069f0bd6d08829b72fe6b603121c7488ba2a96d16b6e9fd7ba9241989789faad69528764d0f1b3b9

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.ini
    MD5

    1d6b944e2b62de09632ecb1a63a23d1a

    SHA1

    18ae96647f6c1a42768d118fd66753b7c9cb81c5

    SHA256

    5b42085656f0d6344042e4e32ad929c87b5d0348cb06ae6d77f0900bf2fee7e6

    SHA512

    ae9e6360bdc00c23363c8358d074c77d3322314c06f27fc3370c840a937a1d50fb601252f70b6019388171327c89c3cc6b6041bfab4daa9eed394553e52a1a88

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\FileSyncClient.dll
    MD5

    bd677672bb00bd48126458d43141b793

    SHA1

    d47a1a17e5ce0c1e3b492c13e2f23ba420b97564

    SHA256

    ab4f4c25009439e5eb1f2e3f12f7f84edbec86bc7f059bd48688b6473a91a7e2

    SHA512

    0cee136f293fe30c48129621b8c5d7fb42a262fda55bd13c108e49af405d53cf83707b95d7bf638fe72b4e9f4fbfdbb41794c924d61436982968baef5e9bed63

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\FileSyncSessions.dll
    MD5

    1a51658455b25bd3d211f2de1bb2936f

    SHA1

    8492b64e951764277c2244105dd3798552e38e53

    SHA256

    18288445b3eb20f774f0e899a4133aeef8b88e94c86f5911ea1216a0bf50a46f

    SHA512

    1a5f7411d5068e192c44958c6fb2a161aa5918456bcb3ec1ab08e331eb417cbaf8ae1bd6e7157d5ed4c79c5ce04bdf38e8cd000fe8f407258bf297d3c644622b

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\FileSyncTelemetryExtensions.dll
    MD5

    182b66ddc8dd9bc915a92dbeccad2da5

    SHA1

    a19a861d25cb7479a1d535282074d48d75e6a319

    SHA256

    e4409c286268ef2141c0aa54b4c17ed628bb830599734f67d088e86ca9a55bb7

    SHA512

    57bd32d23040cbb6a92b1af19be7d198018c5a30ce02814828d9d7587ebdcf9813d0c39df86834b923a2b6d1da68a6ffc9efddc673648520f2478da2e42ec84d

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\FileSyncViews.dll
    MD5

    dc58a0ac40db2c7f80dc1628b85e2ed1

    SHA1

    39454a535d1468665e040c186ac5cf9cc994666a

    SHA256

    80d8f65d82b21c82c23c8e7b9d2679749643fc80fcffa8e71faca5e5c846f626

    SHA512

    3d0a8e18359fc0e6c4523449a653f3c56efad93bd92a442f2795a407df1687c14244cb1d18cc22465e62b04f93cb19e57fa9ac6ea8a2aad5eb413c33e218eaaa

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\LogUploader.dll
    MD5

    66ad43ec5b8b17de4bd66fa1938ca551

    SHA1

    e3f603e9b0d3297ae90ab0fff5e46c45af5f1ff4

    SHA256

    a5c719c5bd6f0302c1f7e6f103db6c946116904765f8b801552df1c7a6d9dfe3

    SHA512

    8f6af08121f0b52e6b2b64eece4be39b0d23963aa07c3297b51e338debe470e49792bf0ca9f2a8e719835164af25b6079152ab56bc3f6e98972a8d0b5e1a0e71

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\LoggingPlatform.dll
    MD5

    d4eceaff8ef80fc33082bac952b29788

    SHA1

    1f59d2b850ffca373436967decfdf9fdcbd87bb6

    SHA256

    17bcfab2d45bfeac65b2816fd6ba14390fd0806cd79e509ecbde540433005261

    SHA512

    7618150d5bcd248f94f5536f3ca1b5b9eb8837a4aab51c1c6a842ae0a3ac1d5c998a5ad3230187378f7063cfb4c3eac12a068e267b487517b8cbf97ecbc8bed7

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\LoggingPlatform.dll
    MD5

    d4eceaff8ef80fc33082bac952b29788

    SHA1

    1f59d2b850ffca373436967decfdf9fdcbd87bb6

    SHA256

    17bcfab2d45bfeac65b2816fd6ba14390fd0806cd79e509ecbde540433005261

    SHA512

    7618150d5bcd248f94f5536f3ca1b5b9eb8837a4aab51c1c6a842ae0a3ac1d5c998a5ad3230187378f7063cfb4c3eac12a068e267b487517b8cbf97ecbc8bed7

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\OneDriveTelemetryStable.dll
    MD5

    f4ab16a375cbd1a3d6a4f3d97a3547ee

    SHA1

    59626a392036a5360248562d399fd6f5e343c558

    SHA256

    223a4fec9339633253b5caceb26fde821a9f282b48a48f6d1a1a2f8672dc07f4

    SHA512

    44b84cec32e35877d65f7ab77465ecbb8ae07e0d5a7376b618359b6c925dd35ad6944a11d70d9e9d9277c3525b4b9f43652cecfb6087b0000d972388dbf825c5

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Qt5Core.dll
    MD5

    691ba7140d5a93bb181db0f78fa5fe67

    SHA1

    ac2bd0c5730faf1fe16954f7ed855f5ee9d2978f

    SHA256

    2a986948e93fd47a80216aa17879bb01cf38d06305eb150f03ee5622f662f352

    SHA512

    0f711efe1f1d5f6ddd6663fdaa6ba5acdf219551a1d1b937d1f38285385a2b78c967141574c626d860905539cae07cb2dd2d7c91ad7279da7876d0c3cb353f73

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Qt5Gui.dll
    MD5

    f8fc9cda23a75509a8c880199825d0c4

    SHA1

    5f0ed03501ad48af880c6634d32a2a3a9886e96b

    SHA256

    24cbbe305d7bcce189977136896d68274331008528affd5b545b4dce3cc8dc18

    SHA512

    9725fd473d46c43e0f37369cd5ee1fb8703b51df61af8531f25b5065cd656b3ef7b95689fe672854c92ea7a1528836c44a5a48e051fb7d972ead372a84226d51

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Qt5Gui.dll
    MD5

    f8fc9cda23a75509a8c880199825d0c4

    SHA1

    5f0ed03501ad48af880c6634d32a2a3a9886e96b

    SHA256

    24cbbe305d7bcce189977136896d68274331008528affd5b545b4dce3cc8dc18

    SHA512

    9725fd473d46c43e0f37369cd5ee1fb8703b51df61af8531f25b5065cd656b3ef7b95689fe672854c92ea7a1528836c44a5a48e051fb7d972ead372a84226d51

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Qt5Network.dll
    MD5

    087caa863bfa647a1c6a5c0013be77f3

    SHA1

    be7e9c01f7bb3e4a8eb72c2ded046fb32853df28

    SHA256

    7ca3dcd505b34e63deec39d00e5c793facb9ab51a64040032e133b50cb660813

    SHA512

    b4f25edcdd2f8d80cf51b444b3453fa9fad8f2c238345f2f39be9be008ee830fb9c61aff257f50c3c9699798e0a9df4272c37ca481ca130ac8e037bc6782e1d5

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Qt5Qml.dll
    MD5

    211d7a242e80001f17b2cbf5e771f1bd

    SHA1

    03f848f700207251caf91b529e7c891a0b3e9179

    SHA256

    bdf217a4f2307ae7c9970ebec4148e8e10e28157cb4f9768ec9b5aa50fd46ed7

    SHA512

    9b355758b17e35e409f73b1d37bbde8e018eecda9795aa350aa2219d53964966bbaabd32b5ac706054988f9b54f155dad2a9ae3e1661872fad6061c1b7ce50b9

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Qt5Qml.dll
    MD5

    211d7a242e80001f17b2cbf5e771f1bd

    SHA1

    03f848f700207251caf91b529e7c891a0b3e9179

    SHA256

    bdf217a4f2307ae7c9970ebec4148e8e10e28157cb4f9768ec9b5aa50fd46ed7

    SHA512

    9b355758b17e35e409f73b1d37bbde8e018eecda9795aa350aa2219d53964966bbaabd32b5ac706054988f9b54f155dad2a9ae3e1661872fad6061c1b7ce50b9

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Qt5Qml.dll
    MD5

    211d7a242e80001f17b2cbf5e771f1bd

    SHA1

    03f848f700207251caf91b529e7c891a0b3e9179

    SHA256

    bdf217a4f2307ae7c9970ebec4148e8e10e28157cb4f9768ec9b5aa50fd46ed7

    SHA512

    9b355758b17e35e409f73b1d37bbde8e018eecda9795aa350aa2219d53964966bbaabd32b5ac706054988f9b54f155dad2a9ae3e1661872fad6061c1b7ce50b9

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Qt5QmlModels.dll
    MD5

    1dfb470ba7b70d5c7fa2cd0bc6ef6969

    SHA1

    414da3b222170ca76e3737bd8f64a7b5de1397df

    SHA256

    a4bb0eab83336be670e1a3035816842435a957f7aa9384643c6738652db6d9cb

    SHA512

    56be4d726bb91b73e77bbcf7a580dc433d0843d4360dde0f64b6867548f91761a70cd4f7b2b45709486939938649af7375303b63a249e52da85425e66f28a76a

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Qt5Quick.dll
    MD5

    72e1e3648f3172e58301f6dbb3f2939c

    SHA1

    507eb19a5bd17044da601c1d225e3f5df1c47b2d

    SHA256

    bfa8a2cfcf23c625b028e723df0426170ce53e9d2bae17b3413192c8454e8396

    SHA512

    e4d583d53a8e267704cb31714de74ef165f9af8c1de4d5eda8b535f3fb5b7579fe9e6f80d020b4babe426b74c12b82fa1278ee827e44e02fe8640589618117f5

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Qt5Widgets.dll
    MD5

    38860a2c4156935b8ba89a81ed3c2920

    SHA1

    304a2d11566105e2049bf35730d85a558c717d2e

    SHA256

    eb08ee65aeff8160dfb06fe74bbd93c203be970c2cfdf2043e575281402ac800

    SHA512

    29a18ae2aed5d409f2945c3c3fceda14ff34eb5fa01e9b0b823372b12175a65fa72936f1dd5fbf3bd9cb6e3324d5f6eed323b377a23d28cd99d380f6124591c2

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Qt5WinExtras.dll
    MD5

    059eef337a44b33513904e4fcfab3139

    SHA1

    c80fdb900e9bf9188380537222962db726fc769f

    SHA256

    7ffe299398b1742b1d0fc70a157ec448693cfd0a7e6f0996dd6916d7fa42b139

    SHA512

    0a6419b2db84bc9d31457bb35091218602200d2979b7551666ffca7e63631fd798b719b6298221e58c87bcc56f7e23ce9922cf68d168c37b9fee7d891e399d0c

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\SyncEngine.dll
    MD5

    870224ddea021be4593fc5615c9de99d

    SHA1

    b86eb30365bf58bf51262e680c7101a8b1de4a91

    SHA256

    fe2841fd3f5ab4f375ae1de2fb1cb85b002df56413a042f9f7d37b20672092d5

    SHA512

    ba30563d6c89fc83cbc208cb9d88c5a932f55c3a53a008bdd32bb74d1838129aa0487d301c50b06bddf451835b0b52a5581d9a9ea7aabf42ff19021adcb911d2

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Telemetry.dll
    MD5

    edb34ea7f82e478f16421c0f0bc35af1

    SHA1

    b89fd47cebdf09d858d856f1ef1cf348d2279165

    SHA256

    f4fb81ed2bd4196d51e6ba2d8807025cb5a6dc5fedb3889aa50487d57941f5f4

    SHA512

    4f2ef3c72c52f984f8f65674ad183c14a8c34312978b7f8996c8867bb055e9e7d3f06292870191c0c98227b26a463f12bc35f5d66a33a1c8d5e0332cc2fcbc79

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\Telemetry.dll
    MD5

    edb34ea7f82e478f16421c0f0bc35af1

    SHA1

    b89fd47cebdf09d858d856f1ef1cf348d2279165

    SHA256

    f4fb81ed2bd4196d51e6ba2d8807025cb5a6dc5fedb3889aa50487d57941f5f4

    SHA512

    4f2ef3c72c52f984f8f65674ad183c14a8c34312978b7f8996c8867bb055e9e7d3f06292870191c0c98227b26a463f12bc35f5d66a33a1c8d5e0332cc2fcbc79

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\UpdateRingSettings.dll
    MD5

    66b38c62f6ff9f06f417cf80b1123a94

    SHA1

    bea4e506cbd0550f142676b280a1add02d7dd4b6

    SHA256

    0cebdd3ee3e3c23e546de82f7e5a2c115a77d30e432cd74f02008f56f0a7c3db

    SHA512

    b5692cbf3a6a5c3aefdad3ef26327f21ca7b05562f3d1963cd24715ea83fe8b06928f7977f020258f1827e0280db0f3b8b4fb734a36a4682dae4a62321f02ddd

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\UpdateRingSettings.dll
    MD5

    66b38c62f6ff9f06f417cf80b1123a94

    SHA1

    bea4e506cbd0550f142676b280a1add02d7dd4b6

    SHA256

    0cebdd3ee3e3c23e546de82f7e5a2c115a77d30e432cd74f02008f56f0a7c3db

    SHA512

    b5692cbf3a6a5c3aefdad3ef26327f21ca7b05562f3d1963cd24715ea83fe8b06928f7977f020258f1827e0280db0f3b8b4fb734a36a4682dae4a62321f02ddd

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\WebView2Loader.dll
    MD5

    0105fb50c44d0a6e811dfdd3f20c8e2c

    SHA1

    5d8736143ad90c65621470a297fd112f105655ea

    SHA256

    3b03fb6619d630ed693ada6bd529cc2d9655c92a41e9e553e60eaddb23d14b76

    SHA512

    e68215ccf2932b903c0d8bb42cb7f322c7ea8d5dcf88b77f7fd6faffea54b1fd0ea23ea32512af8802fef6e8c891b370b5640ed5c3a67fa1aa45e301b72f2366

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\WnsClientApi.dll
    MD5

    f11a23d45cbe4509162b2e617469c68c

    SHA1

    68c5d5ecafaad49a21436c4c90cf3ee0d5985130

    SHA256

    0bbd56476cfb18a63ba36e2d97eab3f12755bfe485b0c6bb41ceaadca78f5621

    SHA512

    63e2b97b25886c1cbf1edcc65fac9f7e274ff383e5cfc4d5a0f5fab7899b94d7474f381796df2929a813a8dfee837a984440a5d8e1da0f6e19b85363ba9cf570

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\adal.dll
    MD5

    ea697be83efc0b89c84890072ecd3d65

    SHA1

    967f53cf4fc3cbb6a1ff9c8d2a3ac6815e319c48

    SHA256

    f690de5f485d8b3a6f9d232a0e698fbb60e53b9231479c7395d0e0746ef40aee

    SHA512

    3c3cdbad1e043835108627f3ccde6312e3156d06087bea87fc1f14433fcf4ff980b79da3d3fe4f932f12d0ea7f13e9183800fa1410c9db30d9c4339d89f1c1a0

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\libcrypto-1_1.dll
    MD5

    385e4bf8494763d717c1cb4537b916e7

    SHA1

    514fcbcc7a06bf71d6d766ca7367ae3563f81f12

    SHA256

    e731d1e9f8fc27dc1da28e060e5663e69ba798e8b9cf2f85fe39ddba825e0bcb

    SHA512

    211fa36f4c3d8fc8c30737a030f87e97a484e0fb8b9a2d89a2deb53fb2623168d316a3ff1ba2f2d70213a1ec4cbc47f697b3bdf67ae57e15f4ba4d477a680a36

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\libssl-1_1.dll
    MD5

    838c2efb4816fda23172cd31a7a01b95

    SHA1

    9801c7c95b944d0299cadb1a6f769100f4013a33

    SHA256

    0f0022cd25056a20696e55adbe62426fac3a4e8dd2cd189ae26897055fe72671

    SHA512

    8137fac498f14420a6b3674629417bcd130d6879fb0f2f7df58d421daafd2cec5e10b44159249394f3e5c7b8764241a7007d6187fe01d276c2c9fd0b8085ef92

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\msvcp140.dll
    MD5

    f3cd2c1220d03ab767c62550977ceb0b

    SHA1

    53bbe406a32a510b4b6cd1de904686a644eb9e2b

    SHA256

    e2195dfd9b112b7192a381a18056eb0a2c6a152e565867581868e839f0f59029

    SHA512

    cb51507d74db8871c7cd1adffe1a21a7633f7502b82fbf086523b17e84033f8f86cd113beff714a55ee6545fb5718deddf6fa193007f6a0f3d029162577c4a6b

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\msvcp140.dll
    MD5

    f3cd2c1220d03ab767c62550977ceb0b

    SHA1

    53bbe406a32a510b4b6cd1de904686a644eb9e2b

    SHA256

    e2195dfd9b112b7192a381a18056eb0a2c6a152e565867581868e839f0f59029

    SHA512

    cb51507d74db8871c7cd1adffe1a21a7633f7502b82fbf086523b17e84033f8f86cd113beff714a55ee6545fb5718deddf6fa193007f6a0f3d029162577c4a6b

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\ucrtbase.dll
    MD5

    c5d96252ee7abe9b2b1b644e39719168

    SHA1

    d21b82d50ce1101d96ce9b504aed0e231d987127

    SHA256

    8da4dd074a600bec873628d1c744b8ef851f584ab3002191926036bec32dd6e9

    SHA512

    98529ed27acb41640d699ba19ab3a5a4be45788b41f3a583c99c1bf1a03ab0a41ce4007194c15d83f03dd35a746537525638d38e990769865f226c7600257d15

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\vcruntime140.dll
    MD5

    ed15882d55a355a57e54c4e65ccf3bd0

    SHA1

    83954d6ae0c1536ae6571f27d034cafd8e7e6579

    SHA256

    2514eccaabcc4b100eb468eaa07d5aec06c4b3e02f6089f2153c518d40225992

    SHA512

    676261afcaea0415b86ce4cc1b498be53fa44f1c8bcf6a826ccbcb444a2d2191de554544440277005a9c4364284b38ea758f4e4d9bfb2e3cdc4617843a011edb

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\vcruntime140.dll
    MD5

    ed15882d55a355a57e54c4e65ccf3bd0

    SHA1

    83954d6ae0c1536ae6571f27d034cafd8e7e6579

    SHA256

    2514eccaabcc4b100eb468eaa07d5aec06c4b3e02f6089f2153c518d40225992

    SHA512

    676261afcaea0415b86ce4cc1b498be53fa44f1c8bcf6a826ccbcb444a2d2191de554544440277005a9c4364284b38ea758f4e4d9bfb2e3cdc4617843a011edb

    Download Submit

  • \Users\Admin\AppData\Local\Microsoft\OneDrive\21.109.0530.0001\vcruntime140.dll
    MD5

    ed15882d55a355a57e54c4e65ccf3bd0

    SHA1

    83954d6ae0c1536ae6571f27d034cafd8e7e6579

    SHA256

    2514eccaabcc4b100eb468eaa07d5aec06c4b3e02f6089f2153c518d40225992

    SHA512

    676261afcaea0415b86ce4cc1b498be53fa44f1c8bcf6a826ccbcb444a2d2191de554544440277005a9c4364284b38ea758f4e4d9bfb2e3cdc4617843a011edb

    Download Submit

  • memory/1868-116-0x0000000000000000-mapping.dmp

    Download

  • memory/2116-114-0x0000000000000000-mapping.dmp

    Download

  • memory/4168-129-0x0000000000000000-mapping.dmp

    Download

  • memory/4168-181-0x0000000007660000-0x0000000007BBC000-memory.dmp

    Filesize

    5.4MB

    Download

  • memory/4672-182-0x0000000000000000-mapping.dmp

    Download

  • memory/4756-183-0x0000000000000000-mapping.dmp

    Download

  • memory/4940-184-0x0000000000000000-mapping.dmp

    Download