Overview

overview

10

Static

static

3

tmp3ptg42ho.msi

windows10-ltsc_2021-x64

10

tmp3ptg42ho.msi

windows10-2004-x64

10

tmp3ptg42ho.msi

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 01:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tmp3ptg42ho.msi
  • Size 85.7MB
  • Sample260602-cdgjwaa19w
  • SHA256 f82d15eed385a7a913b98a28bce9b27a7e3611e1c0c4d9fa65741d3fdd76d23c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adware2defense_evasiondiscoverybumblebeeloaderpersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Extracted

Family

  • bumblebee

Botnet

  • 2

Attributes
  • dga

    45urhm0ldgxb.live

    gx6xly9rp6vl.live

    zv46ga4ntybq.live

    7n1hfolmrnbl.live

    vivh2xlt9i6q.live

    97t3nh4kk510.live

    kbkdtwucfl40.live

    qk6a1ahb63uz.live

    whko7loy7h5z.live

    dad1zg44n0bn.live

    7xwz4hw8dts9.live

    ovekd5n3gklq.live

    amwnef8mjo4v.live

    e7ivqfhnss0x.live

    rjql4nicl6bg.live

    4mo318kk29i4.live

    zpo18lm8vg1x.live

    jc51pt290y0n.live

    rg26t2dc4hf4.live

    qw9a58vunuja.live

    ugm94zjzl5nl.live

    mckag832orba.live

    pdw0v9voxlxr.live

    m4tx2apfmoxo.live

    n2uc737ef71m.live

    hkk3112645hz.live

    ugko9g5ipa4o.live

    8wgq2x4dybx9.live

    h81fx7sj8srr.live

    a4tgoqi1cm8x.live

  • dga_seed

    7834006444057268685

  • domain_length

    12

  • num_dga_domains

    300

  • port

    443

  • tld

    .live

rc4.plain

Signatures

  • Family: BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 18 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 14 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Badlisted process makes network request 64 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Checks system information in the registry 2 TTPs 28 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmp3ptg42ho.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4528
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4612
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 95958B00669F9E8BB772464C98100312 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1124
      • C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe"
        3⤵
        • Executes dropped EXE
        • Checks system information in the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3940
        • C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe" C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe /permachine /childprocess /silent /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /cusid:S-1-5-21-2043432456-1617298091-2772621413-1000
          4⤵
          • Executes dropped EXE
          • Checks system information in the registry
          PID:4452
        • C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe /peruser /childprocess /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix /RegisterOneDriveLauncherAutoStartTask
          4⤵
          • Executes dropped EXE
          • Modifies system executable filetype association
          • Checks system information in the registry
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3900
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncConfig.exe
            "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncConfig.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops desktop.ini file(s)
            • Modifies registry class
            PID:3400
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
            /updateInstalled /background
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies system executable filetype association
            • Checks system information in the registry
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:432
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
              "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart /updateSource:ODU
              6⤵
              • Executes dropped EXE
              • Checks system information in the registry
              • Suspicious behavior: EnumeratesProcesses
              PID:1568
              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /updateSource:ODU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix /RegisterOneDriveLauncherAutoStartTask /EnableOneDriveLauncherRampDownloads /EnableDeltaBuildToTelemetryFeatureSet /ArgPerformNucleusLocalAccessRepair /PerformEdgeNucleusRepair /PerformChromeNucleusRepair /NucleusLNARepairVersion:1 /DisableRedirectionForShortCuts
                7⤵
                • Executes dropped EXE
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Checks system information in the registry
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:4180
                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\FileSyncConfig.exe
                  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\FileSyncConfig.exe"
                  8⤵
                  • Executes dropped EXE
                  PID:3032
                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                  /updateInstalled /background
                  8⤵
                  • Executes dropped EXE
                  • Modifies system executable filetype association
                  • Checks system information in the registry
                  • Modifies Control Panel
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Modifies system certificate store
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:2300
                  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                    "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /client=Personal /background
                    9⤵
                    • Executes dropped EXE
                    • Modifies system executable filetype association
                    • Checks whether UAC is enabled
                    • Checks system information in the registry
                    • Modifies Control Panel
                    • Modifies Internet Explorer settings
                    • Modifies registry class
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:4804
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=OneDrive.exe --webview-exe-version=26.084.0504.0007 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-features=msEnhancedTrackingPreventionEnabled --mojo-named-platform-channel-pipe=4804.1240.17313447024543750120
                      10⤵
                      • Drops file in Windows directory
                      • Enumerates system info in registry
                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                      • Suspicious use of WriteProcessMemory
                      PID:4752
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x188,0x18c,0x190,0x164,0x94,0x7ffb5968b078,0x7ffb5968b084,0x7ffb5968b090
                        11⤵
                          PID:1800
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView" --webview-exe-name=OneDrive.exe --webview-exe-version=26.084.0504.0007 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1712,i,13616436921469709483,14940472029540213187,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:2
                          11⤵
                            PID:5248
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView" --webview-exe-name=OneDrive.exe --webview-exe-version=26.084.0504.0007 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2020,i,13616436921469709483,14940472029540213187,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:11
                            11⤵
                              PID:5284
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView" --webview-exe-name=OneDrive.exe --webview-exe-version=26.084.0504.0007 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2300,i,13616436921469709483,14940472029540213187,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:13
                              11⤵
                                PID:5424
                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView" --webview-exe-name=OneDrive.exe --webview-exe-version=26.084.0504.0007 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3552,i,13616436921469709483,14940472029540213187,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
                                11⤵
                                  PID:5868
                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                                "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /client=Personal /background
                                10⤵
                                • Executes dropped EXE
                                • Modifies system executable filetype association
                                • Checks system information in the registry
                                • Modifies Control Panel
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:6040
                          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\OneDrive.Sync.Service.exe
                            /silentConfig
                            8⤵
                            • Executes dropped EXE
                            • Checks system information in the registry
                            PID:1980
                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\Microsoft.SharePoint.exe
                      /silentConfig
                      5⤵
                      • Executes dropped EXE
                      • Checks system information in the registry
                      PID:3456
              • C:\Windows\system32\srtasks.exe
                C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                2⤵
                  PID:4060
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding 87717742C367E21FC7B2F9573ED3A7BC
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:3004
                • C:\Windows\System32\MsiExec.exe
                  "C:\Windows\System32\MsiExec.exe" /Y "C:\Users\Admin\AppData\Roaming\HFvlKgDlGU.dll"
                  2⤵
                  • Badlisted process makes network request
                  PID:3468
              • C:\Windows\system32\msiexec.exe
                C:\Windows\system32\msiexec.exe
                1⤵
                  PID:3812
                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
                  C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:4408
                  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\Microsoft.SharePoint.exe
                    "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\Microsoft.SharePoint.exe" /silentConfig
                    2⤵
                    • Executes dropped EXE
                    • Checks system information in the registry
                    PID:5012
                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\OneDriveLauncher.exe
                  C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\OneDriveLauncher.exe
                  1⤵
                  • Executes dropped EXE
                  • Checks system information in the registry
                  PID:3528
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                  • Checks SCSI registry key(s)
                  PID:2248
                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\OneDriveLauncher.exe
                  C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\OneDriveLauncher.exe
                  1⤵
                  • Executes dropped EXE
                  • Checks system information in the registry
                  PID:4644
                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\FileCoAuth.exe
                  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\FileCoAuth.exe" -Embedding
                  1⤵
                  • Executes dropped EXE
                  PID:1852

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Event Triggered Execution

                      3
                      T1546

                      Change Default File Association

                      1
                      T1546.001

                      Component Object Model Hijacking

                      1
                      T1546.015

                      Installer Packages

                      1
                      T1546.016

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Event Triggered Execution

                      3
                      T1546

                      Change Default File Association

                      1
                      T1546.001

                      Component Object Model Hijacking

                      1
                      T1546.015

                      Installer Packages

                      1
                      T1546.016

                      Defense Evasion

                      Modify Registry

                      5
                      T1112

                      Subvert Trust Controls

                      1
                      T1553

                      Install Root Certificate

                      1
                      T1553.004

                      System Binary Proxy Execution

                      1
                      T1218

                      Msiexec

                      1
                      T1218.007

                      Credential Access

                      Discovery

                      Network Share Discovery

                      1
                      T1135

                      Peripheral Device Discovery

                      2
                      T1120

                      Query Registry

                      6
                      T1012

                      System Information Discovery

                      6
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      Lateral Movement

                      Collection

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      FileSyncConfig.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncConfig.exe
                      • Size 782KB
                      • SHA256 2807caabb50d6c404fd89ed55bbcef17cc7f097867d25c960883d67a6f347928
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      FileSyncEvents.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncEvents.dll
                      • Size 139KB
                      • SHA256 70e88f97b008eac45c45d41c699e421bb3cde5d6bf23c720270f7e8c92bfa4d8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      FileSyncFS.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncFS.dll
                      • Size 886KB
                      • SHA256 0eb306e3e5ae724d747ee92ffb029ed6faafcf8b36684537e6976cf50b9a0a45
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      FileSyncHost.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncHost.dll
                      • Size 447KB
                      • SHA256 0a261a94cfc32a4fcb8cae9ea191d9bca40031f0d93822d639884ee0ec3bd135
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      FileSyncRNWin32Lib.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncRNWin32Lib.dll
                      • Size 329KB
                      • SHA256 0183d2065e0b6148697968b73f2abd100a0e30f0d280d74299cdab69321439ed
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      FileSyncTelemetryExtensions.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncTelemetryExtensions.dll
                      • Size 472KB
                      • SHA256 16ecdba01cb869e4db022a27097f6ab9aace7590aa0d9ac4a8c10ddae7683d3d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      LoggingPlatform.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LoggingPlatform.dll
                      • Size 646KB
                      • SHA256 194f07c167910fba8b999edbe7209d133282f8230b59484bbd0377f68a68eb06
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.contrast-black_scale-100.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-black_scale-100.png
                      • Size 1KB
                      • SHA256 6f028542f6faeaaf1f564eab2605bedb20a2ee72cdd9930bde1a3539344d721b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-black_scale-125.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-black_scale-125.png
                      • Size 1KB
                      • SHA256 cbdcf248f8a0fcd583b475562a7cdcb58f8d01236c7d06e4cdbfe28e08b2a185
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-black_scale-150.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-black_scale-150.png
                      • Size 2KB
                      • SHA256 36a6aad9a9947ab3f6ac6af900192f5a55870d798bca70c46770ccf2108fd62d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-black_scale-200.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-black_scale-200.png
                      • Size 2KB
                      • SHA256 67d1bb54fcb19c174de1936d08b5dbdb31b98cfdd280bcc5122fb0693675e4f2
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-black_scale-400.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-black_scale-400.png
                      • Size 6KB
                      • SHA256 5cb8fd670585de8a7fc0ceede164847522d287ef17cd48806831ea18a0ceac1f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-100.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-white_scale-100.png
                      • Size 2KB
                      • SHA256 a024fc5dbe0973fd9267229da4ebfd8fc41d73ca27a2055715aafe0efb4f3425
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-125.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-white_scale-125.png
                      • Size 3KB
                      • SHA256 e8b30bfcee8041f1a70e61ca46764416fd1df2e6086ba4c280bfa2220c226750
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-150.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-white_scale-150.png
                      • Size 3KB
                      • SHA256 a0bbe33b798c3adac36396e877908874cffaadb240244095c68dff840dcbbf73
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-200.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-white_scale-200.png
                      • Size 4KB
                      • SHA256 fba9104432cbb8ebbd45c18ef1ba46a45dd374773e5aa37d411bb023ded8efd6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-400.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-white_scale-400.png
                      • Size 8KB
                      • SHA256 9250ef25efc2a9765cf1126524256fdfc963c8687edfdc4a2ecde50d748ada85
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.scale-100.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.scale-100.png
                      • Size 2KB
                      • SHA256 8acbdd41252595b7410ca2ed438d6d8ede10bd17fe3a18705eedc65f46e4c1c4
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.scale-125.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.scale-125.png
                      • Size 4KB
                      • SHA256 a5294e3c7cd855815f8d916849d87bd2357f5165eb4372f248fdf8b988601665
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.scale-150.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.scale-150.png
                      • Size 5KB
                      • SHA256 3df4590386671e0d6fee7108e457eb805370a189f5fdfeaf2f2c32d5adc76abd
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.scale-200.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.scale-200.png
                      • Size 6KB
                      • SHA256 3384357b6110f418b175e2f0910cffe588c847c8e55f2fe3572d82999a62c18e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.scale-400.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.scale-400.png
                      • Size 15KB
                      • SHA256 deb0ec0ee8f1c4f7ea4de2c28ff85087ee5ff8c7e3036c3b0a66d84bae32b6bb
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveSmallTile.contrast-black_scale-100.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png
                      • Size 783B
                      • SHA256 292cac291af7b45f12404f968759afc7145b2189e778b14d681449132b14f06b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.contrast-black_scale-125.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png
                      • Size 1018B
                      • SHA256 8efeacefb92d64dfb1c4df2568165df6436777f176accfd24f4f7970605d16c2
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.contrast-black_scale-150.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png
                      • Size 1KB
                      • SHA256 262b9a30bb8db4fc59b5bc348aa3813c75e113066a087135d0946ad916f72535
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.contrast-black_scale-200.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png
                      • Size 1KB
                      • SHA256 9833b80def72b73fca150af17d4b98c8cd484401f0e2d44320ecd75b5bb57c42
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.contrast-black_scale-400.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png
                      • Size 3KB
                      • SHA256 3a7ef7c0bda402fdaff19a479d6c18577c436a5f4e188da4c058a42ef09a7633
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.scale-100.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.scale-100.png
                      • Size 1KB
                      • SHA256 4e11167708801727891e8dd9257152b7391fc483d46688d61f44b96360f76816
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.scale-125.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.scale-125.png
                      • Size 2KB
                      • SHA256 69e432d1eec44bed4aad35f72a912e1f0036a4b501a50aec401c9fa260a523e3
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.scale-150.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.scale-150.png
                      • Size 3KB
                      • SHA256 7e3f35d5eb05435be8d104a2eacf5bace8301853104a4ea4768601c607ddf301
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.scale-200.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.scale-200.png
                      • Size 4KB
                      • SHA256 85823f7a5a4ebf8274f790a88b981e92ede57bde0ba804f00b03416ee4feda89
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveSmallTile.scale-400.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.scale-400.png
                      • Size 11KB
                      • SHA256 9a0b901e97abe02036c782eb6a2471e18160b89fd5141a5a9909f0baab67b1ef
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Resources.pri
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\Resources.pri
                      • Size 18.1MB
                      • SHA256 2d9961faa1b5b8018f803a74c8e83c0036eed830fbe70fc9c57320bd8cddf1cf
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDrive.VisualElementsManifest.xml
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\OneDrive.VisualElementsManifest.xml
                      • Size 344B
                      • SHA256 d21077ad0c29a4c939b8c25f1186e2b542d054bb787b1d3210e9cab48ec3080c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDrive.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\OneDrive.exe
                      • Size 4.7MB
                      • SHA256 d63d180f84c8fc7b34fed95e838c025bba44a0cac18777b5582c01f4ae356207
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveStandaloneUpdater.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\OneDriveStandaloneUpdater.exe
                      • Size 4.0MB
                      • SHA256 bf861f5bd384707e23148716240822208ceeba50c132fb172b784a6575e5e555
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveTelemetryStable.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\OneDriveTelemetryStable.dll
                      • Size 2.2MB
                      • SHA256 8954efe40c929c33741ce211bb14511d4dd47e0caf9813aed3746645bdb184f0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Telemetry.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\Telemetry.dll
                      • Size 996KB
                      • SHA256 44618801ef0d15721d3c2e87edb1dd2136971b84f811c43e90402fd3238c0251
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      UpdateRingSettings.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\UpdateRingSettings.dll
                      • Size 629KB
                      • SHA256 029fe60df36b90aa300770218302fcffd8ce1bda4b43d1c8c4a734d14e0cfc85
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      msvcp140.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\msvcp140.dll
                      • Size 557KB
                      • SHA256 e70a816aac7a38fd02f60e8b2d7d737f0ed43f059abfaa5788ed2943003239e1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      localizable.json
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\pa-Arab-PK\localizable.json
                      • Size 4B
                      • SHA256 e3566b3a06430868d71e9287dfd6c6c520a3da027aabea01951d407ee131dc2f
                      • MD5 SHA1 SHA512
                      Submit Download

                      ucrtbase.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\ucrtbase.dll
                      • Size 1.1MB
                      • SHA256 4d147c809638b6af98bbada8d9f8e9d36091259b418ac65dd5b92a404b746ac3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      vcruntime140.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\vcruntime140.dll
                      • Size 96KB
                      • SHA256 91068e7b5e708f871cc0e0b85ef4132d6b24c39c9ff4efcae7613f3a5d1e9342
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      vcruntime140_1.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\vcruntime140_1.dll
                      • Size 37KB
                      • SHA256 6c45d5948249dc2a46e2d40f9213f5a8ec3d5fb4c8ccaa96d380c0e50357ab8d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Square44x44Logo.targetsize-256.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\Assets\Square44x44Logo.targetsize-256.png
                      • Size 38KB
                      • SHA256 f21d962c5327933d43c887e1d0531a116fb71cf0075126d9fd5eaa58447a055c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Resources.resw
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\Copilot\Strings\LO-LA\Resources.resw
                      • Size 221B
                      • SHA256 1f762fa2d859cab49e93ca9ce8ef24edc4409ac75de77dc8781cb06ae4ee7f3f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      FileSyncConfig.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\FileSyncConfig.exe
                      • Size 866KB
                      • SHA256 77c24b5d647ec71bad12106a5ab620baae621cacfdb5379c0c7d35f83fc837f3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.contrast-black_scale-100.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveMedTile.contrast-black_scale-100.png
                      • Size 965B
                      • SHA256 3910d0976a41bc9802e6c1460c441f0ce5bf6520b47e2e7f1237eea0342553cf
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-black_scale-125.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveMedTile.contrast-black_scale-125.png
                      • Size 1KB
                      • SHA256 7876f97812c78b2a6a6857b748cfcb083654b0df7a9968d28a337f553c9bb740
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-black_scale-150.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveMedTile.contrast-black_scale-150.png
                      • Size 1KB
                      • SHA256 49bac30adc5e19520c9aef662bf6ab7f825d17de893f49f935f52bb58231d912
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-black_scale-200.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveMedTile.contrast-black_scale-200.png
                      • Size 1KB
                      • SHA256 06c80abf5996c0f80d90db0335ec7d77e756fbbea33e97b399e58eda97be5f77
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-black_scale-400.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveMedTile.contrast-black_scale-400.png
                      • Size 4KB
                      • SHA256 0048c2fbe78c434315a40c489a6233de3eaac4877d3ab3b87f233de97ef45760
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-100.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveMedTile.contrast-white_scale-100.png
                      • Size 898B
                      • SHA256 d66500db2be2a08e1fbe3c25bfb3f8f92af7c1222ae01d983ff01f28e161a173
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-125.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveMedTile.contrast-white_scale-125.png
                      • Size 1KB
                      • SHA256 684f98e53e6508ade14997324ed729b2dbd54fc95ff0d0cf242a0af2ff87b296
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-150.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveMedTile.contrast-white_scale-150.png
                      • Size 1KB
                      • SHA256 f1758274ecb3b62b6324055d6ebfe894fb022af30d646c26ff75245ffe07e97a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-200.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveMedTile.contrast-white_scale-200.png
                      • Size 1KB
                      • SHA256 969e3c485b450ad929616ae0f64408afb25098a8e32993d92e84a6558d3ad8a3
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-400.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveMedTile.contrast-white_scale-400.png
                      • Size 4KB
                      • SHA256 2167f453dec79f0f053913908fb0eb74b54342f9f298dffeee339712bae851e4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.scale-100.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveMedTile.scale-100.png
                      • Size 5KB
                      • SHA256 ee57225deb5b003c11d84f099a3cfe378ada230aaa89c6d7fc6334a21ce7dc06
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.scale-125.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveMedTile.scale-125.png
                      • Size 8KB
                      • SHA256 b3ce4ca2c3598012a7815108f0480bfb3b71b834995993a4160752a2577a3b6d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.scale-150.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveMedTile.scale-150.png
                      • Size 10KB
                      • SHA256 a285df7d2be2aad1ff4053c3a95ff0016e23051c48bb17bad83c9fb59d8f41d0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.scale-200.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveMedTile.scale-200.png
                      • Size 14KB
                      • SHA256 c655edecb76d1f95fc64c2742869e54d80f9102a0e0fb8f5824912b7a1f1d6af
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.scale-400.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveMedTile.scale-400.png
                      • Size 48KB
                      • SHA256 e472291a236bfad76c209b5785c329dbc094fbd70194c21cffd20fe32ab59a12
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveSmallTile.contrast-black_scale-100.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png
                      • Size 563B
                      • SHA256 5b9b49b6af48eb7551c3dd2a62a6a49ae6740b2b49010bb5b006cf85b4e54f44
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.contrast-black_scale-125.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png
                      • Size 874B
                      • SHA256 37a6ca2212efeb34d8905ea08c81bd6f4cf884e4d009c245927618dd61e50537
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.contrast-black_scale-150.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png
                      • Size 962B
                      • SHA256 c191a3138fdc51ccc4eaf8979f44fc4cff3ab96593e21371845cd7967971efbc
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.contrast-black_scale-200.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png
                      • Size 1KB
                      • SHA256 ee2b6b8103ac0dd5ad593e6b5106df0e8e5f1459682cfc6349d803c5802c2dd7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.contrast-black_scale-400.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png
                      • Size 2KB
                      • SHA256 82d5e6a7643d34d618c7fd2cd38c63a360230a72211619c2ca8d70514b6eff6b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.scale-100.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveSmallTile.scale-100.png
                      • Size 1KB
                      • SHA256 1c1975f56416589fd0aa9add4c44a87c5dfd71ca365630e40e9f64bde6f0e49c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.scale-125.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveSmallTile.scale-125.png
                      • Size 5KB
                      • SHA256 46a6e452b5bf41b9ae867aec03f38bc5970b6c8a3128387b0b4c75cc203db9f9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveSmallTile.scale-150.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveSmallTile.scale-150.png
                      • Size 6KB
                      • SHA256 4e80205d7bff5c25be88be6f21ea5e32a2edbf115cdf4f26751f2a24a3d5c3d2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveSmallTile.scale-200.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveSmallTile.scale-200.png
                      • Size 9KB
                      • SHA256 19d6b52f75aca670c722499bf04a6de7eb9eb6cccdc78f489a73d72417fcf478
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveSmallTile.scale-400.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\LogoImages\OneDriveSmallTile.scale-400.png
                      • Size 22KB
                      • SHA256 ce53878af8d98b9e2e94374841d4be37c6942e6bccde660d05b86d051ef5f078
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDrive.App.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\OneDrive.App.exe
                      • Size 930KB
                      • SHA256 6df3fbcdff496425813fbdd33d1368c7a04d86a2d523006e957259aa1bf449d8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDrive.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\OneDrive.exe
                      • Size 4.5MB
                      • SHA256 d2d792f02a9dfeaedd0ce7ab5d8011a32691ae4a2b14867f65421f587f223167
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveStandaloneUpdater.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\OneDriveStandaloneUpdater.exe
                      • Size 4.2MB
                      • SHA256 4984da23ef18dc27706e0226e24672f212799b9c0cc69bf1dc07dd77834e59d0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      pa-Arab-PK.json
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.084.0504.0007\WebAssets\static\strings\pa-Arab-PK.json
                      • Size 31KB
                      • SHA256 43ca73a8fddff3f36e7618465eff4395a326396585f8844b76565ec775eb125a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      settings.dat
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Crashpad\settings.dat
                      • Size 280B
                      • SHA256 84dd7dbf1fe7b1516a6941c7717deca56a4076e9eeb28f64ec507fcc4674cdb3
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      the-real-index
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                      • Size 48B
                      • SHA256 0f9a33f9f15e0d3fef30c3a0906c3948f4c62385bd0200a3d168decee069f60b
                      • MD5 SHA1 SHA512
                      Submit Download

                      the-real-index
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                      • Size 96B
                      • SHA256 c807f220f4b20490fe6d126d1ea4a0e829939b5f741846f0d04e301b11cb4f89
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      data_0
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\DawnWebGPUCache\data_0
                      • Size 8KB
                      • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data_1
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\DawnWebGPUCache\data_1
                      • Size 264KB
                      • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data_2
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\DawnWebGPUCache\data_2
                      • Size 8KB
                      • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data_3
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\DawnWebGPUCache\data_3
                      • Size 8KB
                      • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      MANIFEST-000001
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\Extension Rules\MANIFEST-000001
                      • Size 41B
                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                      • MD5 SHA1 SHA512
                      Submit Download

                      SCT Auditing Pending Reports
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\Network\SCT Auditing Pending Reports
                      • Size 2B
                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                      • MD5 SHA1 SHA512
                      Submit Download

                      CURRENT
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\Site Characteristics Database\CURRENT
                      • Size 16B
                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                      • MD5 SHA1 SHA512
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Local State
                      • Size 1KB
                      • SHA256 bbf563ac4a9865cd394138567c1bf931a3c210283c4963e95d42c28e1f75caa6
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Local State
                      • Size 1KB
                      • SHA256 55f5b150d6a5301041a0629ebde3de188e8291da480246f196073f8d592adf1e
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Local State
                      • Size 2KB
                      • SHA256 d61bf5065db3cc20228607ad67a8b926551b98e2347eac6b5f5e6f1f3d37d4f8
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Local State
                      • Size 3KB
                      • SHA256 f4eba9cdd1bf08cfa81c044f3eec608f16a6b6b144b52f0c5a06971e9814a60a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Local State
                      • Size 4KB
                      • SHA256 e7fc854b95e6c4a301fadae5374d2d9e4900dd729853a0f0bd697f250de886a6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Microsoft.ListSync.Settings.db
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Business1\settings\Microsoft.ListSync.Settings.db
                      • Size 16KB
                      • SHA256 e1b72fdb6fb9da58322f43b4ac4d23a84be5800fefd87fea07b6895ce091fea6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Microsoft.ListSync.Settings.db
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Business1\settings\Microsoft.ListSync.Settings.db
                      • Size 16KB
                      • SHA256 214f3e32806914639b7dea69ccf78acdba60d9d2687c8d03ad68db5b19d96c80
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Microsoft.ListSync.Settings.db
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Business1\settings\Microsoft.ListSync.Settings.db
                      • Size 16KB
                      • SHA256 c57943b7c91496d83c15d4a094083ca4c8e501c3fb4e63422cbd52cce68bd32f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      global.ini
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\global.ini
                      • Size 3KB
                      • SHA256 756906c1a3adf7cee7f551bc3d58e3f149115ce32f077591586cd7f5e169529f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      global.ini
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\global.ini
                      • Size 3KB
                      • SHA256 f868aa6328a690e480a1865b886e66e134f1ca783402f40dc98917fdef1f159c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      logUploaderSettings_temp.ini
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini
                      • Size 108B
                      • SHA256 74dca9f25b12d5a4de1a8128ad63c048af26ee652c2ff0304dd5e2229f0b2994
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      PreSignInSettingsConfig.json
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.json
                      • Size 101KB
                      • SHA256 4f33e81ccaff1c1e642045e324527c7e7cb276c23ad29a266a083e923de226d0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      22dd9b5510c5d7d1d9e1b5a7584e1307e3c14a98[1].xml
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\41JXS326\22dd9b5510c5d7d1d9e1b5a7584e1307e3c14a98[1].xml
                      • Size 27KB
                      • SHA256 4d23f19fe21a6c24ac1926b578033457a9d29d4d3169b9285415b76855c67752
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSI119F.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\MSI119F.tmp
                      • Size 816KB
                      • SHA256 8d633efeda1249356b11bf8f46583242356e4f903056b53bd25a99511d1790a1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSI14C1.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\MSI14C1.tmp
                      • Size 877KB
                      • SHA256 7118cd0d6956c84dc8ede10db84491d7884bfb0baa4a0ab96afc7eea47f46dd0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wct282F.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\wct282F.tmp
                      • Size 2KB
                      • SHA256 7cef59a6d733528bd2651c876a5c95630f86f4cf03156c9fdb5980e2cd1fae50
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      wct2E59.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\wct2E59.tmp
                      • Size 2KB
                      • SHA256 ac62853bcaca37a33adb3dd796b940f31b099909a6eb9cd3b8e5ea8c4e8d3e21
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      wct3F42.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\wct3F42.tmp
                      • Size 2KB
                      • SHA256 e8bf1acfd41e189ad01957eb72fc5c1019fae78cde7e0b37e0d94961bf787cdc
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      wct40C8.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\wct40C8.tmp
                      • Size 2KB
                      • SHA256 6ec3f95f62bf32bf6be3d23573d43e107a93c7a2858f2a4b5d382afb40cc8ee1
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      wctA7C4.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\wctA7C4.tmp
                      • Size 2KB
                      • SHA256 be086bed59fe797aed87f99739107ae3cf90a208836586638479a193370e9768
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      desktop.ini
                      • Path C:\Users\Admin\OneDrive\desktop.ini
                      • Size 96B
                      • SHA256 f625a1050e8ba6df4de974c2acc572e1e637a3429bf2ee1449c552999a6c7268
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/432-1540-0x000001CFF99E0000-0x000001CFFA492000-memory.dmp
                      Download

                      memory/432-1410-0x000001CF802F0000-0x000001CF80327000-memory.dmp
                      Download

                      memory/432-1409-0x000001CFF99E0000-0x000001CFFA492000-memory.dmp
                      Download

                      memory/432-1411-0x000001CF802B0000-0x000001CF802EF000-memory.dmp
                      Download

                      memory/432-3412-0x000001CFF99E0000-0x000001CFFA492000-memory.dmp
                      Download

                      memory/2300-3577-0x00007FFB609E0000-0x00007FFB60F28000-memory.dmp
                      Download

                      memory/2300-3651-0x00000215D99C0000-0x00000215D9AD1000-memory.dmp
                      Download

                      memory/2300-3578-0x00007FFB60F30000-0x00007FFB6132F000-memory.dmp
                      Download

                      memory/3032-3570-0x0000028237410000-0x0000028237494000-memory.dmp
                      Download

                      memory/3400-1282-0x000001AA7EEC0000-0x000001AA7EF39000-memory.dmp
                      Download

                      memory/3468-1613-0x000002CF68460000-0x000002CF68679000-memory.dmp
                      Download

                      memory/3468-1611-0x000002CF68460000-0x000002CF68679000-memory.dmp
                      Download

                      memory/3468-1614-0x000002CF68460000-0x000002CF68679000-memory.dmp
                      Download

                      memory/3468-1612-0x000002CF68460000-0x000002CF68679000-memory.dmp
                      Download

                      memory/3468-1633-0x000002CF68460000-0x000002CF68679000-memory.dmp
                      Download

                      memory/4804-3684-0x00007FFB60F30000-0x00007FFB6132F000-memory.dmp
                      Download

                      memory/4804-4045-0x000001D7ABEA0000-0x000001D7ABFB1000-memory.dmp
                      Download

                      memory/4804-3683-0x00007FFB5AF50000-0x00007FFB5B498000-memory.dmp
                      Download

                      memory/5012-1412-0x0000021D4FFF0000-0x0000021D50093000-memory.dmp
                      Download

                      memory/5248-3769-0x00007FFB85B20000-0x00007FFB85B21000-memory.dmp
                      Download

                      memory/5868-3866-0x00007FFB85B20000-0x00007FFB85B21000-memory.dmp
                      Download

                      memory/6040-4080-0x00007FFB61260000-0x00007FFB6165F000-memory.dmp
                      Download

                      memory/6040-4081-0x00007FFB5B190000-0x00007FFB5B6D8000-memory.dmp
                      Download

                      memory/6040-4125-0x0000028B76630000-0x0000028B76741000-memory.dmp
                      Download

                      memory/6040-4126-0x0000028B7DC10000-0x0000028B7DF05000-memory.dmp
                      Download

                      memory/6040-4154-0x0000028B76630000-0x0000028B76741000-memory.dmp
                      Download

                      memory/6040-4156-0x0000028B76630000-0x0000028B76741000-memory.dmp
                      Download

                      memory/6040-4163-0x0000028B76630000-0x0000028B76741000-memory.dmp
                      Download