Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

f82d15eed3...3c.msi

windows11-21h2-x64

10

Resubmissions

04/02/2025, 13:21

250204-ql4k9synbq 10

04/02/2025, 13:18

250204-qj2znaymfj 10

Analysis

  • max time kernel
    299s
  • max time network
    301s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04/02/2025, 13:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f82d15eed385a7a913b98a28bce9b27a7e3611e1c0c4d9fa65741d3fdd76d23c.msi

  • Size

    85.7MB

  • MD5

    bf866d9b4395b3c819a4cd3fd639c412

  • SHA1

    79b7f01af68b13036a493e25c83d80457a654c4c

  • SHA256

    f82d15eed385a7a913b98a28bce9b27a7e3611e1c0c4d9fa65741d3fdd76d23c

  • SHA512

    8c80f7d86d8b4df1c73b2da3cecd09f02a28b57edcf3e2597e874e549ff7cf183acb644a731ed95fb29aeea3334fc72d9144f536ad7e4868b6eec63a4bd83e13

  • SSDEEP

    1572864:BWVw9CW/3bB1B68jRGRdJFqisNA6IwEU7dwq3LnEpF2UOrZ+c4CGFyzodK2aZq9:BW5SrB6uRG6iQIu5LEzVON+vCjVY

Score
10/10
bumblebee2discoveryloaderpersistenceprivilege_escalation

Malware Config

Extracted

Family

bumblebee

Botnet

2

Attributes
  • dga

    45urhm0ldgxb.live

    gx6xly9rp6vl.live

    zv46ga4ntybq.live

    7n1hfolmrnbl.live

    vivh2xlt9i6q.live

    97t3nh4kk510.live

    kbkdtwucfl40.live

    qk6a1ahb63uz.live

    whko7loy7h5z.live

    dad1zg44n0bn.live

    7xwz4hw8dts9.live

    ovekd5n3gklq.live

    amwnef8mjo4v.live

    e7ivqfhnss0x.live

    rjql4nicl6bg.live

    4mo318kk29i4.live

    zpo18lm8vg1x.live

    jc51pt290y0n.live

    rg26t2dc4hf4.live

    qw9a58vunuja.live

    ugm94zjzl5nl.live

    mckag832orba.live

    pdw0v9voxlxr.live

    m4tx2apfmoxo.live

    n2uc737ef71m.live

    hkk3112645hz.live

    ugko9g5ipa4o.live

    8wgq2x4dybx9.live

    h81fx7sj8srr.live

    a4tgoqi1cm8x.live

  • dga_seed

    7834006444057268685

  • domain_length

    12

  • num_dga_domains

    300

  • port

    443

rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee
  • Bumblebee family
    bumblebee
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Blocklisted process makes network request 64 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 22 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Windows directory 14 IoCs
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 14 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\f82d15eed385a7a913b98a28bce9b27a7e3611e1c0c4d9fa65741d3fdd76d23c.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3332
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1536
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B69AA522AB2FB186B272812AC0D7BB49 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4016
      • C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe"
        3⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4900
        • C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe" C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe /permachine /childprocess /silent /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /cusid:S-1-5-21-2499603254-3415597248-1508446358-1000
          4⤵
          • Checks system information in the registry
          • Executes dropped EXE
          PID:2556
        • C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe /peruser /childprocess /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix /RegisterOneDriveLauncherAutoStartTask
          4⤵
          • Checks system information in the registry
          • Executes dropped EXE
          • Modifies system executable filetype association
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2308
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncConfig.exe
            "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncConfig.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1560
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
            /updateInstalled /background
            5⤵
            • Checks system information in the registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies system executable filetype association
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2136
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
              "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart /updateSource:ODU
              6⤵
              • Checks system information in the registry
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:488
              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /updateSource:ODU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix /RegisterOneDriveLauncherAutoStartTask
                7⤵
                • Adds Run key to start application
                • Checks system information in the registry
                • Executes dropped EXE
                • Modifies system executable filetype association
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1992
                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\25.005.0112.0003\FileSyncConfig.exe
                  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\25.005.0112.0003\FileSyncConfig.exe"
                  8⤵
                  • Executes dropped EXE
                  PID:3656
                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                  /updateInstalled /background
                  8⤵
                  • Checks system information in the registry
                  • Executes dropped EXE
                  • Modifies system executable filetype association
                  • Modifies Control Panel
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious behavior: AddClipboardFormatListener
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4324
                  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                    "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /client=Personal /background
                    9⤵
                    • Checks system information in the registry
                    • Executes dropped EXE
                    • Modifies system executable filetype association
                    • Modifies Control Panel
                    • Modifies Internet Explorer settings
                    • Modifies registry class
                    • Suspicious behavior: AddClipboardFormatListener
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:3168
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=OneDrive.exe --webview-exe-version=25.005.0112.0003 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-features=msEnhancedTrackingPreventionEnabled --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=3168.4396.6120613401677428293
                      10⤵
                      • Enumerates system info in registry
                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:4952
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x118,0x11c,0x120,0xf4,0x1c8,0x7fff8a093cb8,0x7fff8a093cc8,0x7fff8a093cd8
                        11⤵
                          PID:4552
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1900,5736854035919405055,12458215332588551436,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView" --webview-exe-name=OneDrive.exe --webview-exe-version=25.005.0112.0003 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
                          11⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          PID:3392
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,5736854035919405055,12458215332588551436,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView" --webview-exe-name=OneDrive.exe --webview-exe-version=25.005.0112.0003 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2192 /prefetch:3
                          11⤵
                            PID:4868
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,5736854035919405055,12458215332588551436,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView" --webview-exe-name=OneDrive.exe --webview-exe-version=25.005.0112.0003 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2492 /prefetch:8
                            11⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            PID:5128
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1900,5736854035919405055,12458215332588551436,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msEnhancedTrackingPreventionEnabled,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView" --webview-exe-name=OneDrive.exe --webview-exe-version=25.005.0112.0003 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
                            11⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            PID:5476
                        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                          "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /client=Personal /background
                          10⤵
                          • Checks system information in the registry
                          • Executes dropped EXE
                          • Modifies system executable filetype association
                          • Modifies Control Panel
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious behavior: AddClipboardFormatListener
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of SetWindowsHookEx
                          PID:5524
                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\25.005.0112.0003\Microsoft.SharePoint.exe
                      /silentConfig
                      8⤵
                      • Checks system information in the registry
                      • Executes dropped EXE
                      PID:3656
              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\Microsoft.SharePoint.exe
                /silentConfig
                5⤵
                • Checks system information in the registry
                • Executes dropped EXE
                PID:2476
        • C:\Windows\system32\srtasks.exe
          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
          2⤵
            PID:3340
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 91B512D4DFE750FCD8DE72CFACCC038E
            2⤵
            • System Location Discovery: System Language Discovery
            PID:4108
          • C:\Windows\System32\MsiExec.exe
            "C:\Windows\System32\MsiExec.exe" /Y "C:\Users\Admin\AppData\Roaming\HFvlKgDlGU.dll"
            2⤵
            • Blocklisted process makes network request
            PID:1796
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Checks SCSI registry key(s)
          PID:4728
        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\25.005.0112.0003\FileCoAuth.exe
          "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\25.005.0112.0003\FileCoAuth.exe" -Embedding
          1⤵
          • Executes dropped EXE
          PID:1012
        • C:\Windows\System32\CompPkgSrv.exe
          C:\Windows\System32\CompPkgSrv.exe -Embedding
          1⤵
            PID:5208
          • C:\Windows\System32\CompPkgSrv.exe
            C:\Windows\System32\CompPkgSrv.exe -Embedding
            1⤵
              PID:5348
            • C:\Windows\system32\NOTEPAD.EXE
              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\EnterUnlock.ps1xml
              1⤵
              • Opens file in notepad (likely ransom note)
              PID:5692
            • C:\Program Files\VideoLAN\VLC\vlc.exe
              "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnblockRead.mpg"
              1⤵
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:660
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
              1⤵
                PID:2996
              • C:\Windows\system32\BackgroundTransferHost.exe
                "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
                1⤵
                  PID:1304
                • C:\Windows\system32\SystemSettingsAdminFlows.exe
                  "C:\Windows\system32\SystemSettingsAdminFlows.exe" TroubleshootActivation
                  1⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:700
                • C:\Windows\system32\SystemSettingsAdminFlows.exe
                  "C:\Windows\system32\SystemSettingsAdminFlows.exe" EnterProductKey
                  1⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:2472
                • C:\Windows\System32\rundll32.exe
                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                  1⤵
                    PID:5040
                  • C:\Program Files\VideoLAN\VLC\vlc.exe
                    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\CompleteUnregister.ADT"
                    1⤵
                    • Suspicious behavior: AddClipboardFormatListener
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    PID:5952
                  • C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
                    "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\Downloads\LimitUnblock.pot"
                    1⤵
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    • Suspicious behavior: AddClipboardFormatListener
                    • Suspicious use of SetWindowsHookEx
                    PID:6064
                  • C:\Windows\System32\fontview.exe
                    "C:\Windows\System32\fontview.exe" C:\Users\Admin\Downloads\MergeDeny.fon
                    1⤵
                      PID:1232

                    Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Event Triggered Execution

                    3
                    T1546

                    Change Default File Association

                    1
                    T1546.001

                    Component Object Model Hijacking

                    1
                    T1546.015

                    Installer Packages

                    1
                    T1546.016

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Event Triggered Execution

                    3
                    T1546

                    Change Default File Association

                    1
                    T1546.001

                    Component Object Model Hijacking

                    1
                    T1546.015

                    Installer Packages

                    1
                    T1546.016

                    Defense Evasion

                    Modify Registry

                    3
                    T1112

                    System Binary Proxy Execution

                    1
                    T1218

                    Msiexec

                    1
                    T1218.007

                    Credential Access

                    Discovery

                    Network Share Discovery

                    1
                    T1135

                    Peripheral Device Discovery

                    2
                    T1120

                    Query Registry

                    7
                    T1012

                    System Information Discovery

                    6
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    System Network Configuration Discovery

                    1
                    T1016

                    Internet Connection Discovery

                    1
                    T1016.001

                    Lateral Movement

                    Collection

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncClient.dll
                      Filesize

                      10.6MB

                      MD5

                      ce762091b07a1eef5873cf2ca2ccfe46

                      SHA1

                      ca937fdfbeb7a3ddc8bff4c8fd90a977f818c706

                      SHA256

                      0216d51e7f157ac698185e2083150a1a622dd21f7466806663aaea0c14c87457

                      SHA512

                      c663e527e404642b7b9cd7d6b6c0299960277cb0c71769ebbd7c8e3841a0a5545f33c61481aa695c8b5a47246bb89788c70efa5341fb7c9fb2e459cbeae73eff

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncConfig.exe
                      Filesize

                      782KB

                      MD5

                      9a5a81a28a78af1e11b4bfcc1c0ff1c4

                      SHA1

                      9228b164fd2240c6e1d7ceb216666c5ee863d6d2

                      SHA256

                      2807caabb50d6c404fd89ed55bbcef17cc7f097867d25c960883d67a6f347928

                      SHA512

                      6432a02681441523127009cff7a0f511338041060d56a3f66caf566cf3de32a79dd9b15bdf6df5711de74d6391bd674219a6b535b97c894fe5c8a8593181c0f2

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncEvents.dll
                      Filesize

                      139KB

                      MD5

                      6793b0881f502b5c45b95b787ffa7137

                      SHA1

                      f1d3059ff3c53f8dca8197ce59b6f846ea26787d

                      SHA256

                      70e88f97b008eac45c45d41c699e421bb3cde5d6bf23c720270f7e8c92bfa4d8

                      SHA512

                      fb7ebbc5fe3466aa54cc94d3a57edb3f05e45c9fb46ec226b125873adb875e3618bb29e358ad6345521630990f7ba76efa8c05129bfa9527ca9d0fbcde9eef5b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncFS.dll
                      Filesize

                      886KB

                      MD5

                      15dbe04329abd84b195e45c3fe81da5e

                      SHA1

                      202b2308e0c082cbbba9bd68dbcf2957207fdee2

                      SHA256

                      0eb306e3e5ae724d747ee92ffb029ed6faafcf8b36684537e6976cf50b9a0a45

                      SHA512

                      bc9bf1e690fe1942ed3e9416afdaf92f8bea6a5de0dbde7cce8eaf8dd8638f31c4624f2defbbaa38758f5b4e2d8b1f6fd7b38b53cbeaf9719b1b63af7c2f2f08

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncHost.dll
                      Filesize

                      447KB

                      MD5

                      2638c0e13945eeb75e266c1f51a140d2

                      SHA1

                      6f741f5990f0c9729d4f11c478ac160a18d3f099

                      SHA256

                      0a261a94cfc32a4fcb8cae9ea191d9bca40031f0d93822d639884ee0ec3bd135

                      SHA512

                      cb0a6f618f6358d5f90325b432600391ed527628b0c0a891b29a33c953f15fa62c9cdfdac87b17de6d3cc571b69237353e1adf2e6f2901927c975f90b0f5fa24

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncRNWin32Lib.dll
                      Filesize

                      329KB

                      MD5

                      2e03813f24a885a2e8cc16e3f336d8ed

                      SHA1

                      ddb2db7511eee4a16351f7862d49cf5197566c88

                      SHA256

                      0183d2065e0b6148697968b73f2abd100a0e30f0d280d74299cdab69321439ed

                      SHA512

                      6b5508ee231788dcd1d38c9a1b9eed9910364c9369a187f03c0d5c78d35647d0d8f4c05d79077994353d35b1f2aa85e7c59e5ecf25ce9a5a6499dc74f5f109f4

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncSessions.dll
                      Filesize

                      6.0MB

                      MD5

                      ca61ed8e59551a0f95e0f7e1a2ff5d2c

                      SHA1

                      5afdb4f1505c140b5efd3a1c89ae44c8436391ac

                      SHA256

                      98a65c3a5f39c4dc056aa56fb9ca602b364ddb4163db9f9a6564e3b254d80565

                      SHA512

                      bbd035e1c6268313c125f74896f3c04d673309d5792416c93a56a299a84bce7591555f438b74f491de342531b33a240675b77ef65c5cd25df5a1b4890667ae45

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncTelemetryExtensions.dll
                      Filesize

                      472KB

                      MD5

                      a5fb1cefd0b47fc249373d35b9adf43f

                      SHA1

                      fbbde165c9185916ebe4fc51ac49bd9cca14d919

                      SHA256

                      16ecdba01cb869e4db022a27097f6ab9aace7590aa0d9ac4a8c10ddae7683d3d

                      SHA512

                      d02ce6566236bde1dea9b615cabefb189f236a075eb8a01a102653e5fb67684c47f32cc65f5cf2377023b8d076549f67c52803bbf8776f5c1a5c4d7854e6877d

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LoggingPlatform.dll
                      Filesize

                      646KB

                      MD5

                      26c10167cd870920a734cd37eb841bb5

                      SHA1

                      4187c3932755f9aa82844d79569d099ba9a6d524

                      SHA256

                      194f07c167910fba8b999edbe7209d133282f8230b59484bbd0377f68a68eb06

                      SHA512

                      d96def3c3b95bd56bbb45b71e6ab417c8041603049b4669ec976ad744c0b351b601fd2d547a6f344d5628cb5d88994ca7ed3baad9e6e9bc233a63ddfa5676288

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-black_scale-100.png
                      Filesize

                      1KB

                      MD5

                      72747c27b2f2a08700ece584c576af89

                      SHA1

                      5301ca4813cd5ff2f8457635bc3c8944c1fb9f33

                      SHA256

                      6f028542f6faeaaf1f564eab2605bedb20a2ee72cdd9930bde1a3539344d721b

                      SHA512

                      3e7f84d3483a25a52a036bf7fd87aac74ac5af327bb8e4695e39dada60c4d6607d1c04e7769a808be260db2af6e91b789008d276ccc6b7e13c80eb97e2818aba

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-black_scale-125.png
                      Filesize

                      1KB

                      MD5

                      b83ac69831fd735d5f3811cc214c7c43

                      SHA1

                      5b549067fdd64dcb425b88fabe1b1ca46a9a8124

                      SHA256

                      cbdcf248f8a0fcd583b475562a7cdcb58f8d01236c7d06e4cdbfe28e08b2a185

                      SHA512

                      4b2ee6b3987c048ab7cc827879b38fb3c216dab8e794239d189d1ba71122a74fdaa90336e2ea33abd06ba04f37ded967eb98fd742a02463b6eb68ab917155600

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-black_scale-150.png
                      Filesize

                      2KB

                      MD5

                      771bc7583fe704745a763cd3f46d75d2

                      SHA1

                      e38f9d7466eefc6d3d2aaa327f1bd42c5a5c7752

                      SHA256

                      36a6aad9a9947ab3f6ac6af900192f5a55870d798bca70c46770ccf2108fd62d

                      SHA512

                      959ea603abec708895b7f4ef0639c3f2d270cfdd38d77ac9bab8289918cbd4dbac3c36c11bb52c6f01b0adae597b647bb784bba513d77875979270f4962b7884

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-black_scale-200.png
                      Filesize

                      2KB

                      MD5

                      09773d7bb374aeec469367708fcfe442

                      SHA1

                      2bfb6905321c0c1fd35e1b1161d2a7663e5203d6

                      SHA256

                      67d1bb54fcb19c174de1936d08b5dbdb31b98cfdd280bcc5122fb0693675e4f2

                      SHA512

                      f500ea4a87a24437b60b0dc3ec69fcc5edbc39c2967743ddb41093b824d0845ffddd2df420a12e17e4594df39f63adad5abb69a29f8456fed03045a6b42388bc

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-black_scale-400.png
                      Filesize

                      6KB

                      MD5

                      e01cdbbd97eebc41c63a280f65db28e9

                      SHA1

                      1c2657880dd1ea10caf86bd08312cd832a967be1

                      SHA256

                      5cb8fd670585de8a7fc0ceede164847522d287ef17cd48806831ea18a0ceac1f

                      SHA512

                      ffd928e289dc0e36fa406f0416fb07c2eb0f3725a9cdbb27225439d75b8582d68705ec508e3c4af1fc4982d06d70ef868cafbfc73a637724dee7f34828d14850

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-white_scale-100.png
                      Filesize

                      2KB

                      MD5

                      19876b66df75a2c358c37be528f76991

                      SHA1

                      181cab3db89f416f343bae9699bf868920240c8b

                      SHA256

                      a024fc5dbe0973fd9267229da4ebfd8fc41d73ca27a2055715aafe0efb4f3425

                      SHA512

                      78610a040bbbb026a165a5a50dfbaf4208ebef7407660eea1a20e95c30d0d42ef1d13f647802a2f0638443ae2253c49945ebe018c3499ddbf00cfdb1db42ced1

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-white_scale-125.png
                      Filesize

                      3KB

                      MD5

                      8347d6f79f819fcf91e0c9d3791d6861

                      SHA1

                      5591cf408f0adaa3b86a5a30b0112863ec3d6d28

                      SHA256

                      e8b30bfcee8041f1a70e61ca46764416fd1df2e6086ba4c280bfa2220c226750

                      SHA512

                      9f658bc77131f4ac4f730ed56a44a406e09a3ceec215b7a0b2ed42d019d8b13d89ab117affb547a5107b5a84feb330329dc15e14644f2b52122acb063f2ba550

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-white_scale-150.png
                      Filesize

                      3KB

                      MD5

                      de5ba8348a73164c66750f70f4b59663

                      SHA1

                      1d7a04b74bd36ecac2f5dae6921465fc27812fec

                      SHA256

                      a0bbe33b798c3adac36396e877908874cffaadb240244095c68dff840dcbbf73

                      SHA512

                      85197e0b13a1ae48f51660525557cceaeed7d893dd081939f62e6e8921bb036c6501d3bb41250649048a286ff6bac6c9c1a426d2f58f3e3b41521db26ef6a17c

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-white_scale-200.png
                      Filesize

                      4KB

                      MD5

                      f1c75409c9a1b823e846cc746903e12c

                      SHA1

                      f0e1f0cf35369544d88d8a2785570f55f6024779

                      SHA256

                      fba9104432cbb8ebbd45c18ef1ba46a45dd374773e5aa37d411bb023ded8efd6

                      SHA512

                      ed72eb547e0c03776f32e07191ce7022d08d4bcc66e7abca4772cdd8c22d8e7a423577805a4925c5e804ed6c15395f3df8aac7af62f1129e4982685d7e46bd85

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-white_scale-400.png
                      Filesize

                      8KB

                      MD5

                      adbbeb01272c8d8b14977481108400d6

                      SHA1

                      1cc6868eec36764b249de193f0ce44787ba9dd45

                      SHA256

                      9250ef25efc2a9765cf1126524256fdfc963c8687edfdc4a2ecde50d748ada85

                      SHA512

                      c15951cf2dc076ed508665cd7dac2251c8966c1550b78549b926e98c01899ad825535001bd65eeb2f8680cd6753cd47e95606ecf453919f5827ed12bca062887

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.scale-100.png
                      Filesize

                      2KB

                      MD5

                      57a6876000151c4303f99e9a05ab4265

                      SHA1

                      1a63d3dd2b8bdc0061660d4add5a5b9af0ff0794

                      SHA256

                      8acbdd41252595b7410ca2ed438d6d8ede10bd17fe3a18705eedc65f46e4c1c4

                      SHA512

                      c6a2a9124bc6bcf70d2977aaca7e3060380a4d9428a624cc6e5624c75ebb6d6993c6186651d4e54edf32f3491d413714ef97a4cdc42bae94045cd804f0ad7cba

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.scale-125.png
                      Filesize

                      4KB

                      MD5

                      d03b7edafe4cb7889418f28af439c9c1

                      SHA1

                      16822a2ab6a15dda520f28472f6eeddb27f81178

                      SHA256

                      a5294e3c7cd855815f8d916849d87bd2357f5165eb4372f248fdf8b988601665

                      SHA512

                      59d99f0b9a7813b28bae3ea1ae5bdbbf0d87d32ff621ff20cbe1b900c52bb480c722dd428578dea5d5351cc36f1fa56b2c1712f2724344f026fe534232812962

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.scale-150.png
                      Filesize

                      5KB

                      MD5

                      a23c55ae34e1b8d81aa34514ea792540

                      SHA1

                      3b539dfb299d00b93525144fd2afd7dd9ba4ccbf

                      SHA256

                      3df4590386671e0d6fee7108e457eb805370a189f5fdfeaf2f2c32d5adc76abd

                      SHA512

                      1423a2534ae71174f34ee527fe3a0db38480a869cac50b08b60a2140b5587b3944967a95016f0b00e3ca9ced1f1452c613bb76c34d7ebd386290667084bce77d

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.scale-200.png
                      Filesize

                      6KB

                      MD5

                      13e6baac125114e87f50c21017b9e010

                      SHA1

                      561c84f767537d71c901a23a061213cf03b27a58

                      SHA256

                      3384357b6110f418b175e2f0910cffe588c847c8e55f2fe3572d82999a62c18e

                      SHA512

                      673c3bec7c2cd99c07ebfca0f4ab14cd6341086c8702fe9e8b5028aed0174398d7c8a94583da40c32cd0934d784062ad6db71f49391f64122459f8bb00222e08

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.scale-400.png
                      Filesize

                      15KB

                      MD5

                      e593676ee86a6183082112df974a4706

                      SHA1

                      c4e91440312dea1f89777c2856cb11e45d95fe55

                      SHA256

                      deb0ec0ee8f1c4f7ea4de2c28ff85087ee5ff8c7e3036c3b0a66d84bae32b6bb

                      SHA512

                      11d7ed45f461f44fa566449bb50bcfce35f73fc775744c2d45ea80aeb364fe40a68a731a2152f10edc059dea16b8bab9c9a47da0c9ffe3d954f57da0ff714681

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png
                      Filesize

                      783B

                      MD5

                      f4e9f958ed6436aef6d16ee6868fa657

                      SHA1

                      b14bc7aaca388f29570825010ebc17ca577b292f

                      SHA256

                      292cac291af7b45f12404f968759afc7145b2189e778b14d681449132b14f06b

                      SHA512

                      cd5d78317e82127e9a62366fd33d5420a6f25d0a6e55552335e64dc39932238abd707fe75d4f62472bc28a388d32b70ff08b6aa366c092a7ace3367896a2bd98

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png
                      Filesize

                      1018B

                      MD5

                      2c7a9e323a69409f4b13b1c3244074c4

                      SHA1

                      3c77c1b013691fa3bdff5677c3a31b355d3e2205

                      SHA256

                      8efeacefb92d64dfb1c4df2568165df6436777f176accfd24f4f7970605d16c2

                      SHA512

                      087c12e225c1d791d7ad0bf7d3544b4bed8c4fb0daaa02aee0e379badae8954fe6120d61fdf1a11007cbcdb238b5a02c54f429b6cc692a145aa8fbd220c0cb2d

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png
                      Filesize

                      1KB

                      MD5

                      552b0304f2e25a1283709ad56c4b1a85

                      SHA1

                      92a9d0d795852ec45beae1d08f8327d02de8994e

                      SHA256

                      262b9a30bb8db4fc59b5bc348aa3813c75e113066a087135d0946ad916f72535

                      SHA512

                      9559895b66ef533486f43274f7346ad3059c15f735c9ce5351adf1403c95c2b787372153d4827b03b6eb530f75efcf9ae89db1e9c69189e86d6383138ab9c839

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png
                      Filesize

                      1KB

                      MD5

                      22e17842b11cd1cb17b24aa743a74e67

                      SHA1

                      f230cb9e5a6cb027e6561fabf11a909aa3ba0207

                      SHA256

                      9833b80def72b73fca150af17d4b98c8cd484401f0e2d44320ecd75b5bb57c42

                      SHA512

                      8332fc72cd411f9d9fd65950d58bf6440563dc4bd5ce3622775306575802e20c967f0ee6bab2092769a11e2a4ea228dab91a02534beeb8afde8239dd2b90f23a

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png
                      Filesize

                      3KB

                      MD5

                      3c29933ab3beda6803c4b704fba48c53

                      SHA1

                      056fe7770a2ba171a54bd60b3c29c4fbb6d42f0c

                      SHA256

                      3a7ef7c0bda402fdaff19a479d6c18577c436a5f4e188da4c058a42ef09a7633

                      SHA512

                      09408a000a6fa8046649c61ccef36afa1046869506f019f739f67f5c1c05d2e313b95a60bd43d9be882688df1610ad7979dd9d1f16a2170959b526ebd89b8ef7

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.scale-100.png
                      Filesize

                      1KB

                      MD5

                      1f156044d43913efd88cad6aa6474d73

                      SHA1

                      1f6bd3e15a4bdb052746cf9840bdc13e7e8eda26

                      SHA256

                      4e11167708801727891e8dd9257152b7391fc483d46688d61f44b96360f76816

                      SHA512

                      df791d7c1e7a580e589613b5a56ba529005162d3564fffd4c8514e6afaa5eccea9cea9e1ac43bd9d74ee3971b2e94d985b103176db592e3c775d5feec7aac6d1

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.scale-125.png
                      Filesize

                      2KB

                      MD5

                      09f3f8485e79f57f0a34abd5a67898ca

                      SHA1

                      e68ae5685d5442c1b7acc567dc0b1939cad5f41a

                      SHA256

                      69e432d1eec44bed4aad35f72a912e1f0036a4b501a50aec401c9fa260a523e3

                      SHA512

                      0eafeaf735cedc322719049db6325ccbf5e92de229cace927b78a08317e842261b7adbda03ec192f71ee36e35eb9bf9624589de01beaec2c5597a605fc224130

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.scale-150.png
                      Filesize

                      3KB

                      MD5

                      ed306d8b1c42995188866a80d6b761de

                      SHA1

                      eadc119bec9fad65019909e8229584cd6b7e0a2b

                      SHA256

                      7e3f35d5eb05435be8d104a2eacf5bace8301853104a4ea4768601c607ddf301

                      SHA512

                      972a42f7677d57fcb8c8cb0720b21a6ffe9303ea58dde276cfe2f26ee68fe4cc8ae6d29f3a21a400253de7c0a212edf29981e9e2bca49750b79dd439461c8335

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.scale-200.png
                      Filesize

                      4KB

                      MD5

                      d9d00ecb4bb933cdbb0cd1b5d511dcf5

                      SHA1

                      4e41b1eda56c4ebe5534eb49e826289ebff99dd9

                      SHA256

                      85823f7a5a4ebf8274f790a88b981e92ede57bde0ba804f00b03416ee4feda89

                      SHA512

                      8b53dec59bba8b4033e5c6b2ff77f9ba6b929c412000184928978f13b475cd691a854fee7d55026e48eab8ac84cf34fc7cb38e3766bbf743cf07c4d59afb98f4

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.scale-400.png
                      Filesize

                      11KB

                      MD5

                      096d0e769212718b8de5237b3427aacc

                      SHA1

                      4b912a0f2192f44824057832d9bb08c1a2c76e72

                      SHA256

                      9a0b901e97abe02036c782eb6a2471e18160b89fd5141a5a9909f0baab67b1ef

                      SHA512

                      99eb3d67e1a05ffa440e70b7e053b7d32e84326671b0b9d2fcfcea2633b8566155477b2a226521bf860b471c5926f8e1f8e3a52676cacb41b40e2b97cb3c1173

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\Resources.pri
                      Filesize

                      18.1MB

                      MD5

                      4fbd1578d8beef2787c69a650c6e18a9

                      SHA1

                      51c7bfd3d23b7aaef7f6f9fa16f816714900c7e9

                      SHA256

                      2d9961faa1b5b8018f803a74c8e83c0036eed830fbe70fc9c57320bd8cddf1cf

                      SHA512

                      ab82c867dad53c2c839c16f031d97ebe9ba691be9ae0d9aed6370d34cd43594330f8167bc1e1a2dbfc99848a30aea5f6d3532590a263d4248db72319a26a3f00

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\OneDrive.VisualElementsManifest.xml
                      Filesize

                      344B

                      MD5

                      5ae2d05d894d1a55d9a1e4f593c68969

                      SHA1

                      a983584f58d68552e639601538af960a34fa1da7

                      SHA256

                      d21077ad0c29a4c939b8c25f1186e2b542d054bb787b1d3210e9cab48ec3080c

                      SHA512

                      152949f5b661980f33608a0804dd8c43d70e056ae0336e409006e764664496fef6e60daa09fecb8d74523d3e7928c0dbd5d8272d8be1cf276852d88370954adc

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\OneDrive.exe
                      Filesize

                      4.7MB

                      MD5

                      f83c519bafc1f92012005ea8d6c2638a

                      SHA1

                      8931607fd64580adb03b6088ab2fd1b410dc2132

                      SHA256

                      d63d180f84c8fc7b34fed95e838c025bba44a0cac18777b5582c01f4ae356207

                      SHA512

                      4883632e64651269cb279335f6a185dc6bf353cbe69c6f0984d5c5c8d6713918c0760357ebcfe6bb64ed7791574df59b221a84642390ac0f05a79b964bc6d330

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\OneDriveStandaloneUpdater.exe
                      Filesize

                      4.0MB

                      MD5

                      cb32f4c57c0a09f1fde92dd7ccb022c5

                      SHA1

                      26e9370af926369e6ac456f1d029bdec538239f3

                      SHA256

                      bf861f5bd384707e23148716240822208ceeba50c132fb172b784a6575e5e555

                      SHA512

                      445b2f3fa76013e2cbd11371b397ee57f7837908133594a79d8e764417fb3a3ba367e4f807685bb61324a23d2a7ba1ce6b86bf17d1046b8fd4f4a141a9be380b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\OneDriveTelemetryStable.dll
                      Filesize

                      2.2MB

                      MD5

                      f822197330dff32995f16a2eb431480f

                      SHA1

                      56592e098f294b86fdb752c6b491206e50d3ad64

                      SHA256

                      8954efe40c929c33741ce211bb14511d4dd47e0caf9813aed3746645bdb184f0

                      SHA512

                      f3e4942eb0ef93c29ba786ec9ace36b749c710744e1f3ada4d1e230c35e9c3a984cd398f84a59c3f6ca36172e1acdfa4234006a10be84f02d938830d00f2c310

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\Telemetry.dll
                      Filesize

                      996KB

                      MD5

                      cd7c9d058aee19cf91cdfcd144ff79e6

                      SHA1

                      48d8eb7e7f6a1a6a9b592323a212273e3a5d5e87

                      SHA256

                      44618801ef0d15721d3c2e87edb1dd2136971b84f811c43e90402fd3238c0251

                      SHA512

                      5ec6383087810c51b65c8a7e86360213b0c64deee15751626ec892c4355f4d3e4336f056052575c48eea29193bace5e3da142b14c9a6c58db4b62ab2939db592

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\UpdateRingSettings.dll
                      Filesize

                      629KB

                      MD5

                      72273505986d8a973aab58753a9a049e

                      SHA1

                      9b6b51b8bead46cd6a89253e9722d447e4ef70c4

                      SHA256

                      029fe60df36b90aa300770218302fcffd8ce1bda4b43d1c8c4a734d14e0cfc85

                      SHA512

                      b42d60b524e729ea456fb77f9edcde07fa234e1fbc2d10ffc9f2592aa9cc95157747e29d6b62f9f8326603301354f9a7d1695b5dfbe15e90365013f0a5fb8e06

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\msvcp140.dll
                      Filesize

                      557KB

                      MD5

                      5ba06ea21e0ba0b120f3612c6203be35

                      SHA1

                      6b38acb8f4b4f202eeea0c388712b2c75e657fd6

                      SHA256

                      e70a816aac7a38fd02f60e8b2d7d737f0ed43f059abfaa5788ed2943003239e1

                      SHA512

                      7b4535350488c09adabd15d8e3a4d2a968632d9d8b720365d4aeb4b8c262a728dca7460a924f39e2e461fde560d3482d29a25dbebee2eb073652c7e639da4a7d

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\pa-Arab-PK\localizable.json
                      Filesize

                      4B

                      MD5

                      c443b04d0fc26b0a5a4573a78e0082a1

                      SHA1

                      3c957535345645dce7190b85eb10b39da96b2518

                      SHA256

                      e3566b3a06430868d71e9287dfd6c6c520a3da027aabea01951d407ee131dc2f

                      SHA512

                      7bbf6dac485c9e59d02edabc91ff5b15bc1319cef6905c0077ee16e3b1f572b61bff85f2400bc0f5b4aeab0260bd5d68787d72c7a688d79192952f7957a44de3

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\ucrtbase.dll
                      Filesize

                      1.1MB

                      MD5

                      ff45246d2d557fe20f190841b5845522

                      SHA1

                      992180b9e283a0ee26e374ed8e66a5d9325ea351

                      SHA256

                      4d147c809638b6af98bbada8d9f8e9d36091259b418ac65dd5b92a404b746ac3

                      SHA512

                      9117b4b8447f02be0d7a15b15a371231c435f5af4710af6cc3db2c6079e694ca274cef8220c1a4eb3976087da529d13d8660f7d76e61daace609748d7650313e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\vcruntime140.dll
                      Filesize

                      96KB

                      MD5

                      e7e30bb38a404c386a2ac7ba9ee43b19

                      SHA1

                      f383dd93778153b7d2727b5147864c147e516f42

                      SHA256

                      91068e7b5e708f871cc0e0b85ef4132d6b24c39c9ff4efcae7613f3a5d1e9342

                      SHA512

                      48855d85a2b8bdab565bd72a321b7a714bd54ba224da02ba30899f4cb15c5212bec8d825c6654e741e7eeaf6aa813beff625439d3271487b5604780aa1f454fa

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\vcruntime140_1.dll
                      Filesize

                      37KB

                      MD5

                      b74bf21d9393a9843c759188060dfa38

                      SHA1

                      d7af133844d228afd136e388990472899234433e

                      SHA256

                      6c45d5948249dc2a46e2d40f9213f5a8ec3d5fb4c8ccaa96d380c0e50357ab8d

                      SHA512

                      1ae229b14fe673c1a50160f5ad4a1bcf7ab7371f79cf255a5ae0ea76d5732c17e39e133fcf1c3add8ef61a9e28da320c68b59c6f51fd11cb76b5f45c98c48afb

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\25.005.0112.0003\Assets\Square44x44Logo.altform-unplated_targetsize-16.png
                      Filesize

                      637B

                      MD5

                      b735ac2c67ff5335bd4215e4907abf32

                      SHA1

                      39d32221ec712532042f9175d83598ef0e842394

                      SHA256

                      3234a95ab229383eafa6f4036d6e5bcccdf441511fc86b83e5a8a8de2df9bd40

                      SHA512

                      8ec1bebeaee2dcafac2013c833eaf6da6123830e5a4d86dda722d9a26263c44c38fa603eb1ea43195010e31f6687142956324d274e2de9d8923774da5d3a4e68

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\25.005.0112.0003\Assets\Square44x44Logo.altform-unplated_targetsize-24.png
                      Filesize

                      1000B

                      MD5

                      1433673065290ad7497f1559b99528e2

                      SHA1

                      70169b46ff0dcffca74e3978206b9650bd5f4b31

                      SHA256

                      7fd2eba3f94391b2894a0fde79d3c09a253b371e258ab48aeb13320ac2d7321f

                      SHA512

                      60459ef7a11867f92970be857972ca24d5ca7507047898dbad1537cff3c04a67dc9c83bcfafa16917175d01da7376e7eff9288c8b6334a384df356fa70b87494

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\25.005.0112.0003\Assets\Square44x44Logo.altform-unplated_targetsize-256.png
                      Filesize

                      18KB

                      MD5

                      65e01ff43c980fc95ed04e60e7cc8132

                      SHA1

                      686c9751958e05fc180117542b5f1d9ae7bd6fcd

                      SHA256

                      4a4f966db5813b27a8217adb9a5d8b1d62dd00dad83261650d2f4ae3b6a02d01

                      SHA512

                      89dd2e9db684f6b68a0ec1766654019e7809c6423e90e85977dd2270e1f685c8b7afeb13fe5aff0cc21dd21d491f21c32ec0ea2480834b6f11b54d867c1cc696

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\25.005.0112.0003\Assets\Square44x44Logo.altform-unplated_targetsize-32.png
                      Filesize

                      1KB

                      MD5

                      3685995d9d28d9633cd4610e86a387c2

                      SHA1

                      bd5fef5096b4f947ff1bada0a900d1fca0e4b221

                      SHA256

                      2b515f953b65863e521b66c9ce37dd8756602823d2e0415bf6898a1e7c7bc55d

                      SHA512

                      4b07e829dc0c10f2216bea916fe2185f751385c5f389c30f5b4d15626f3c069a58137e8e863f88d1989a3907f22181103f01c3d601660970843a2857e5099e24

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\25.005.0112.0003\Assets\Square44x44Logo.altform-unplated_targetsize-48.png
                      Filesize

                      2KB

                      MD5

                      7f87b385d14233279ddbf44ae53d1345

                      SHA1

                      6aadef638a9bf41dcad3e1ce18fd3dc4cc695fa2

                      SHA256

                      24587df3a9381bf22922c5c194d828492f48287c97a42791305a4dbf62d145fd

                      SHA512

                      e0f42dab68b9fee96edfb6547232caf225acba8d02970bbc0164457eac130510f5c987eedc08f829aff06dd78ce2e64250fbfeb69d8c754af33996c39ead6d14

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\25.005.0112.0003\FileSyncConfig.exe
                      Filesize

                      783KB

                      MD5

                      586ab17abba77225d6cc78b82d9e45ea

                      SHA1

                      20b2c4eb8c02674dce8eb0cf73d234d3deb7c9e5

                      SHA256

                      b5cb0a9d7812d82506c15a44899183b519e6d716bc51fd932f5eef873a921223

                      SHA512

                      b156a5b62bf012b7edf8411e524c2204e91267540893e8f184b198f2e59d5f287ccf50bd2f80e13ad0025b0e3caaf2691af328206639966dcba61fcae48151cd

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\25.005.0112.0003\OneDrive.exe
                      Filesize

                      4.8MB

                      MD5

                      e7b3dd41c4fe318ccb5758de88154794

                      SHA1

                      343889d2e775a42eea7592b45c5b20ceb077c4b1

                      SHA256

                      ebf237ee00cc6820e1e2417202df550b8dc8554ed247fd3f95fe962ed81bd2c3

                      SHA512

                      a2df68542c66dde4234dda909f5362a06fb85185978e05faeb688349e52dde7674c729c61223e4e1de7f89b79b72c259c331c809f21485cdabf50b3fe839fe2e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\25.005.0112.0003\OneDriveStandaloneUpdater.exe
                      Filesize

                      4.0MB

                      MD5

                      2771dad3f6757ad5931c0d4b5d049fea

                      SHA1

                      111aef58cdcb91063debb53da9e3c39471bad872

                      SHA256

                      5bb9a233f4eb31627e5b4a80395af97d8975bf0484c89eafd572a388c5a48aab

                      SHA512

                      16b0a97d42c7d06c2803bfdaaca8629e3c1e713834f92210f0530fe2f585e52b41248cef2cd56cc9d54fb475445d571ece89d646bfe57a1c5330955c282d5582

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Crashpad\settings.dat
                      Filesize

                      152B

                      MD5

                      967adb60cfbafa6ef5c27318d159f69e

                      SHA1

                      944d2f967dac91dd53923869f86391754a2f9a00

                      SHA256

                      6a114f1a72d87b4100558547c42aa493c33c7c69580d1b179ee730caea975d54

                      SHA512

                      7c85823486c1507be6204da856530596bce5d642b05fc2c0118480422cbc3cf6e3b6fce32e1bd4d8cd26eb0325e688f50bb857e814422fcc43e959e403fbefdf

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Crashpad\settings.dat
                      Filesize

                      152B

                      MD5

                      be3d433f7d89d6df2bf4d1c580ec1418

                      SHA1

                      c40ad82629ecb8f785bbce5709946aa65602df01

                      SHA256

                      e468de165d4e57056628b12cf411b476812f0c81e62efcce8c33f19727f15696

                      SHA512

                      6eb009de9734c9c1c7f3ddf2dd22973265f963d814a388897d5267811880da95e036ab92da12af1d16b721f4ba89bbba1c2802e41191856c948210f5ec2fb62e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\Cache\data_2
                      Filesize

                      8KB

                      MD5

                      0962291d6d367570bee5454721c17e11

                      SHA1

                      59d10a893ef321a706a9255176761366115bedcb

                      SHA256

                      ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                      SHA512

                      f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                      Filesize

                      96B

                      MD5

                      982ebcc91f7e9305f23dfc5e30f5a17c

                      SHA1

                      701fb92f6916786736e3fbb296eee4917695cb4e

                      SHA256

                      a381999b6eb853d93c38a7f78a91653315bb384b797c60bb2659b930256847e0

                      SHA512

                      a2aea0f4700fee31089c92e8968bf321c1786e23ff1590793009c55aed88fc96b2c23ceeaf710fad5a09dd98ffc4f6b3b680da7be812c5a5fd7704b712f4c8f7

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                      Filesize

                      48B

                      MD5

                      90aeeab218940040d7b06c6017942b55

                      SHA1

                      2a5e80439d155dc083bdb0bce4d54fb5bd3f3c96

                      SHA256

                      b934d0cc392f1cd29bdc2be4046960db67c48e15b3173770cde48caf83e31384

                      SHA512

                      66a416b29cfeca5f962c983a96e25c6726080a5acdfbd12e038426024fef9b1e07e654b12543efc292267c33c96a27bc233ba35a1e06522d1a2351a0370c4e78

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\GPUCache\data_0
                      Filesize

                      8KB

                      MD5

                      cf89d16bb9107c631daabf0c0ee58efb

                      SHA1

                      3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                      SHA256

                      d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                      SHA512

                      8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\GPUCache\data_1
                      Filesize

                      264KB

                      MD5

                      f50f89a0a91564d0b8a211f8921aa7de

                      SHA1

                      112403a17dd69d5b9018b8cede023cb3b54eab7d

                      SHA256

                      b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                      SHA512

                      bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\GPUCache\data_3
                      Filesize

                      8KB

                      MD5

                      41876349cb12d6db992f1309f22df3f0

                      SHA1

                      5cf26b3420fc0302cd0a71e8d029739b8765be27

                      SHA256

                      e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                      SHA512

                      e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001
                      Filesize

                      41B

                      MD5

                      5af87dfd673ba2115e2fcf5cfdb727ab

                      SHA1

                      d5b5bbf396dc291274584ef71f444f420b6056f1

                      SHA256

                      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                      SHA512

                      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\Sync Data\LevelDB\CURRENT
                      Filesize

                      16B

                      MD5

                      46295cac801e5d4857d09837238a6394

                      SHA1

                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                      SHA256

                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                      SHA512

                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\ec4d9484-04fc-4058-83dd-800af0860a39.tmp
                      Filesize

                      8KB

                      MD5

                      ad8222819b7e55c198bdf484eedf0d41

                      SHA1

                      81868a9df72a62789100088dbc1856aed7ea93b3

                      SHA256

                      85108baf7037e4b3b613df577a920d895517689245c0877902f9f69a89c5016d

                      SHA512

                      493700cc5f853fdab86449fb3da52297764f383c586555b9f4f25bfdc09e386d4cc0deb00500f760e8b854b67db55ab348fa7ce17f33042d5cce727b67031ea9

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Business1\settings\Microsoft.ListSync.Settings.db
                      Filesize

                      16KB

                      MD5

                      9caed8c96174ed88142f7436e5510143

                      SHA1

                      7f63c366f1326b142a767d92899a4943a014d7cc

                      SHA256

                      e1b72fdb6fb9da58322f43b4ac4d23a84be5800fefd87fea07b6895ce091fea6

                      SHA512

                      94f50b56085a5ee5638b9651fd9d8674dd90da1cffddc4ae5b8c3e86d915f6e4d71d461254c4ea16e9b3f4659bcc83c03b5013a3ac89924a6d324272d5fc4407

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\global.ini
                      Filesize

                      3KB

                      MD5

                      3dc3a451512b2963a745ca529246ad47

                      SHA1

                      266f8c0aa6f251f943c03c00f210c3cd2e3f2fe3

                      SHA256

                      1ef7b042b660e4a973ed5ddeb939d18cf3c179c4c8edd92f663f42e711ed6a1a

                      SHA512

                      0b71b4eddbdc5a6d31b1bce2871e3482c7b45bf3b7e7aea201b3683790cf0ff2bee7d1ba4fe7e7735aafcfd9f0dc7bc1927ba9ad96b0cd7323c1430a2f2829ac

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\global.ini
                      Filesize

                      3KB

                      MD5

                      e1196435b75628a36731adc9b8a7edfa

                      SHA1

                      102202349d4e5d98f698a36e29b3152b177ff4dd

                      SHA256

                      b6a691b7ea830324061353cb8e69e0c414e01618fd0282032729af03d14dae0c

                      SHA512

                      987108b90df1114f3789d065ab2b833bf46ea6e7374ae84b33272b1b4e49809ba39f609f476cac46c8ff3998b80c251204de83e5ac54fbb81f719e502501a374

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini
                      Filesize

                      108B

                      MD5

                      38aa8f7a6d60942bdeb152d9e0e0672b

                      SHA1

                      129be8c81f401663cc2e1a137c3db7757ab77a34

                      SHA256

                      5a8c75c4ff38a470b8b9295e21653b11e7d739c901c8c4d5f28c6757b97c9399

                      SHA512

                      7651f89fe23ae636cc57b35e0087028cee804c150d3c3ff4f4b6fe03694daae1dd80da548addbff0683552152ad5334de6654c807e589bd33d0d84361f90ea2e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.json
                      Filesize

                      88KB

                      MD5

                      dc58aabc98e14496a754894185a20519

                      SHA1

                      1a9a1fd95edf9e180532bb0fcab53969f2c8fcbd

                      SHA256

                      b0d842c04507907384e659a0c0b1155b8bedb9ebac5f59d530dfc71309e51b65

                      SHA512

                      7529a282c477cc3e945e256be36114473e8ea25dfe64b8d47538c8807b0c213a6093d38c015b4afcd0781034c6880aba8e6d947432ea9a45c7f3aa01ed5014a3

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OY0860T8\620d466ec7616ee4cd28bf4512f7f7cd8043e015[1].xml
                      Filesize

                      2KB

                      MD5

                      dd2c9a225c2c0aa4128d7cd0fe6714bc

                      SHA1

                      090aec568265a96e93542abc990354ea74cc92d6

                      SHA256

                      756d24406627e05029b8b27f41c21a9d30e697de6d05e97137318e79c7d5fde9

                      SHA512

                      3776dd1431ce90caa9a9549017c3f771d41931c93328722dda88482a546ea399550fdb11e848d3885b7c0ee01ffe1787aff18a689c370f7ca0ba79ad34f9a0a2

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\60962b17-66b3-415b-a196-38452f91bd43.down_data
                      Filesize

                      555KB

                      MD5

                      5683c0028832cae4ef93ca39c8ac5029

                      SHA1

                      248755e4e1db552e0b6f8651b04ca6d1b31a86fb

                      SHA256

                      855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

                      SHA512

                      aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\MSI9A3C.tmp
                      Filesize

                      816KB

                      MD5

                      aa88d8f40a286b6d40de0f3abc836cfa

                      SHA1

                      c24eab9e4b10b159b589f4c3b64ef3db111ea1c8

                      SHA256

                      8d633efeda1249356b11bf8f46583242356e4f903056b53bd25a99511d1790a1

                      SHA512

                      6c2f2f6a2d66015f30158962d653e381136f0f30023380a0ce95bd0944d856113fbde65db52dbb3b5de1c0e2edf2cd53184e721c64b916834be4198c61224519

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\MSI9D2F.tmp
                      Filesize

                      877KB

                      MD5

                      6a639b68fe7f4e67b7510af13403772b

                      SHA1

                      255ba543d6fdd8f037823ff321ec00abe3575c54

                      SHA256

                      7118cd0d6956c84dc8ede10db84491d7884bfb0baa4a0ab96afc7eea47f46dd0

                      SHA512

                      43cfa4cdf669df71d7da59669ec9653c4facba4c2e6fe52deada469116b5c8b63a927a9ddc2f240ca9e1a2cc4335c12936007662bf47cd11c7e61392af219cef

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\wct57DF.tmp
                      Filesize

                      475B

                      MD5

                      4a43b1bdc52d916b570c76821cbb4386

                      SHA1

                      6dfc4582aad63f75106611ce444ce0cf55da30f5

                      SHA256

                      f775fdbe5a710b0a150972769f11a8e6a65e63f6f8f4b15f9144bb48f3bc6e01

                      SHA512

                      66ee8b7a156a429fb589bbfa921433a81a3054e4b41148b34deabc05d216fcfdff48db0e4e9e61c8e3534498e6b5ea0983feb46b757e8eabb3ec6e57c37c2afb

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\wct5C92.tmp
                      Filesize

                      475B

                      MD5

                      6e819bf8f2ed6e25456208ed1ef38d58

                      SHA1

                      2752efdd5a357f885bf07ab348ce72e66c2aa2c5

                      SHA256

                      3e024c0c3ba7b3bd3ae183449e88cb9500adebddac44c3c84f04b278cd1cb4ec

                      SHA512

                      856c3f6254994dd15bd5b081b4764b4d7a5a4f553293275cd0da9d8d8899fc5422165b2aaca7a632602f4f701347de4259a0925b1754c870bce8804c3e8d7bd3

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\wct6C51.tmp
                      Filesize

                      475B

                      MD5

                      7ecf61257f8196424cb762b7657b434b

                      SHA1

                      8e94db34c716d4e1b235e826bbe8cdd037c35cc0

                      SHA256

                      7690ec57664275adcdc2b6d5f3e5eaedf115efad670dfd25078f7b28b6cf5b81

                      SHA512

                      782eb3cf92bc13fdde5fe23b47c805ec0a17fc01eb86a00ee69de72414e65fd21127725de09c6a2a89e111328f7fe966a0ff2da749dfbb66a5e824497f84e7ac

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\wctFADB.tmp
                      Filesize

                      475B

                      MD5

                      26513b07bbe7a0268987e2d4c673a765

                      SHA1

                      83d59f401933109222ee37860ac351e51bc72dc4

                      SHA256

                      51504326ee67c2534407d9c8eea72f13fd6cbb3a6e7dbea7be587c7caffcf89f

                      SHA512

                      e4c19c04ff0878d98ce4cb0be6d2df81ec9b62174e991a9eeff6753685d7c33c8d3bb319df3a30558d0a91086737aab6021fe19a196b1270858b53ce636f76aa

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
                      Filesize

                      570B

                      MD5

                      4c54446a47975ef4b461843ce22bf11a

                      SHA1

                      1291bffdd8235a2064be4b3fe56b1ac9914b6cea

                      SHA256

                      504e125dea5bf9c56c92284d64381ad42849b66b63c4d09dcd325d8deef3652f

                      SHA512

                      9a6b3822b7b54228ad7ee8c5064c2383a9eda30847c53b9f2bf1805fbd1a0fc4a9730f6a5623f6c6f4dc75447401d6cb19648e6cc6e92314a32f4091847d9210

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.NlY660
                      Filesize

                      76B

                      MD5

                      3c91ee04f90ea831f0f5cc682120774d

                      SHA1

                      0e9fea125d95ab7331754cd9a49adad0e8401291

                      SHA256

                      4999e7bc5073763fddfd07f719ee2a8ddec7e636d1958488a853b2ae64984f1c

                      SHA512

                      6fb26d946f30cc99e2b9aa8d0e7effce102a17e7cdccfc7a777b04ec04bfe130ccc0a0a3e7f89c0b6d4dcf6e1e8aa491420ef1683f841c0d8243f799790c4cee

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.Ya5952
                      Filesize

                      630B

                      MD5

                      a5347bee35e617f53d0e35e2f2b8ab0b

                      SHA1

                      6799f25f0c92fd592924d4203cf5ff00bb762e55

                      SHA256

                      3bc526b84bc3ef1b7f112a6d82353dd9cb8f5f6d734a667b51806c65907324cd

                      SHA512

                      83d73d4c179eede02591789d90669c82145618cc9c13ed83a61195b6506650727bb8c9af881135dba8b98f9c1c9660ed4f38bfc30dfe500189834f96a548af36

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.lock
                      Filesize

                      18B

                      MD5

                      df93df6f652273885c62c1d5af51ae57

                      SHA1

                      124698abc7b812d583734ef95508d1f9f01d4fd8

                      SHA256

                      93b6bd92ea477358c962a7a9f883239872d857397c18e03be5237511258025d9

                      SHA512

                      097c156474f9c8e0eb542c44bdb47bddf7c97b9ba20fe3ffdcbb3b23339696a250afaf7b9bbf15bf34dcf47a4dc4f6541cef899f4c38dbc2cc3913c3986c14fc

                      Download Submit

                    • memory/660-3160-0x00007FFF882A0000-0x00007FFF89350000-memory.dmp

                      Filesize

                      16.7MB

                      Download

                    • memory/660-3175-0x00007FFF8D3B0000-0x00007FFF8D407000-memory.dmp

                      Filesize

                      348KB

                      Download

                    • memory/660-3161-0x00007FFF89870000-0x00007FFF89A7B000-memory.dmp

                      Filesize

                      2.0MB

                      Download

                    • memory/660-3162-0x00007FFF8F3C0000-0x00007FFF8F401000-memory.dmp

                      Filesize

                      260KB

                      Download

                    • memory/660-3163-0x00007FFF8EF00000-0x00007FFF8EF21000-memory.dmp

                      Filesize

                      132KB

                      Download

                    • memory/660-3164-0x00007FFF8F3A0000-0x00007FFF8F3B8000-memory.dmp

                      Filesize

                      96KB

                      Download

                    • memory/660-3165-0x00007FFF8EEE0000-0x00007FFF8EEF1000-memory.dmp

                      Filesize

                      68KB

                      Download

                    • memory/660-3151-0x00007FFF94A80000-0x00007FFF94AB4000-memory.dmp

                      Filesize

                      208KB

                      Download

                    • memory/660-3154-0x00007FFFA6780000-0x00007FFFA6797000-memory.dmp

                      Filesize

                      92KB

                      Download

                    • memory/660-3158-0x00007FFF91740000-0x00007FFF9175D000-memory.dmp

                      Filesize

                      116KB

                      Download

                    • memory/660-3157-0x00007FFF94840000-0x00007FFF94851000-memory.dmp

                      Filesize

                      68KB

                      Download

                    • memory/660-3156-0x00007FFFA2260000-0x00007FFFA2277000-memory.dmp

                      Filesize

                      92KB

                      Download

                    • memory/660-3155-0x00007FFFA6240000-0x00007FFFA6251000-memory.dmp

                      Filesize

                      68KB

                      Download

                    • memory/660-3152-0x00007FFF89CB0000-0x00007FFF89F66000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/660-3153-0x00007FFFA7610000-0x00007FFFA7628000-memory.dmp

                      Filesize

                      96KB

                      Download

                    • memory/660-3150-0x00007FF6854F0000-0x00007FF6855E8000-memory.dmp

                      Filesize

                      992KB

                      Download

                    • memory/660-3159-0x00007FFF8F410000-0x00007FFF8F421000-memory.dmp

                      Filesize

                      68KB

                      Download

                    • memory/660-3172-0x00007FFF8C640000-0x00007FFF8C6A7000-memory.dmp

                      Filesize

                      412KB

                      Download

                    • memory/660-3176-0x00007FFF87AA0000-0x00007FFF87AB1000-memory.dmp

                      Filesize

                      68KB

                      Download

                    • memory/660-3166-0x00007FFF8ED60000-0x00007FFF8ED71000-memory.dmp

                      Filesize

                      68KB

                      Download

                    • memory/660-3174-0x00007FFF8E7B0000-0x00007FFF8E7C1000-memory.dmp

                      Filesize

                      68KB

                      Download

                    • memory/660-3173-0x00007FFF8C5C0000-0x00007FFF8C63C000-memory.dmp

                      Filesize

                      496KB

                      Download

                    • memory/660-3167-0x00007FFF8E920000-0x00007FFF8E931000-memory.dmp

                      Filesize

                      68KB

                      Download

                    • memory/660-3171-0x00007FFF8E6C0000-0x00007FFF8E6F0000-memory.dmp

                      Filesize

                      192KB

                      Download

                    • memory/660-3170-0x00007FFF8E8C0000-0x00007FFF8E8D8000-memory.dmp

                      Filesize

                      96KB

                      Download

                    • memory/660-3169-0x00007FFF8E8E0000-0x00007FFF8E8F1000-memory.dmp

                      Filesize

                      68KB

                      Download

                    • memory/660-3168-0x00007FFF8E900000-0x00007FFF8E91B000-memory.dmp

                      Filesize

                      108KB

                      Download

                    • memory/1012-3093-0x000001497FA30000-0x000001497FC63000-memory.dmp

                      Filesize

                      2.2MB

                      Download

                    • memory/1796-1637-0x0000022D63340000-0x0000022D63559000-memory.dmp

                      Filesize

                      2.1MB

                      Download

                    • memory/1796-1635-0x0000022D63340000-0x0000022D63559000-memory.dmp

                      Filesize

                      2.1MB

                      Download

                    • memory/1796-1636-0x0000022D63340000-0x0000022D63559000-memory.dmp

                      Filesize

                      2.1MB

                      Download

                    • memory/1796-1638-0x0000022D63340000-0x0000022D63559000-memory.dmp

                      Filesize

                      2.1MB

                      Download

                    • memory/1796-1650-0x0000022D63340000-0x0000022D63559000-memory.dmp

                      Filesize

                      2.1MB

                      Download

                    • memory/2136-1452-0x00000228C6B30000-0x00000228C75E2000-memory.dmp

                      Filesize

                      10.7MB

                      Download

                    • memory/2136-1695-0x00000228C6B30000-0x00000228C75E2000-memory.dmp

                      Filesize

                      10.7MB

                      Download

                    • memory/2136-2568-0x00000228C6B30000-0x00000228C75E2000-memory.dmp

                      Filesize

                      10.7MB

                      Download

                    • memory/3392-2849-0x00007FFFB55C0000-0x00007FFFB55C1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/5524-3100-0x000001E9AE8C0000-0x000001E9AEBB5000-memory.dmp

                      Filesize

                      3.0MB

                      Download

                    • memory/5524-3099-0x000001E9A7840000-0x000001E9A7A73000-memory.dmp

                      Filesize

                      2.2MB

                      Download