Overview

overview

10

Static

static

3

tmpt8rxc9zx.msi

windows10-ltsc_2021-x64

10

tmpt8rxc9zx.msi

windows10-2004-x64

10

tmpt8rxc9zx.msi

windows11-21h2-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/06/2026, 00:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tmpt8rxc9zx.msi
  • Size 85.7MB
  • Sample260609-a9faksh17x
  • SHA256 f82d15eed385a7a913b98a28bce9b27a7e3611e1c0c4d9fa65741d3fdd76d23c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adware2defense_evasiondiscoverybumblebeeloaderpersistenceprivilege_escalationransomwarespyware

Malware Config

Extracted

Family

  • bumblebee

Botnet

  • 2

Attributes
  • dga

    45urhm0ldgxb.live

    gx6xly9rp6vl.live

    zv46ga4ntybq.live

    7n1hfolmrnbl.live

    vivh2xlt9i6q.live

    97t3nh4kk510.live

    kbkdtwucfl40.live

    qk6a1ahb63uz.live

    whko7loy7h5z.live

    dad1zg44n0bn.live

    7xwz4hw8dts9.live

    ovekd5n3gklq.live

    amwnef8mjo4v.live

    e7ivqfhnss0x.live

    rjql4nicl6bg.live

    4mo318kk29i4.live

    zpo18lm8vg1x.live

    jc51pt290y0n.live

    rg26t2dc4hf4.live

    qw9a58vunuja.live

    ugm94zjzl5nl.live

    mckag832orba.live

    pdw0v9voxlxr.live

    m4tx2apfmoxo.live

    n2uc737ef71m.live

    hkk3112645hz.live

    ugko9g5ipa4o.live

    8wgq2x4dybx9.live

    h81fx7sj8srr.live

    a4tgoqi1cm8x.live

  • dga_seed

    7834006444057268685

  • domain_length

    12

  • num_dga_domains

    300

  • port

    443

  • tld

    .live

rc4.plain

Signatures

  • Family: BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
    persistence
  • Badlisted process makes network request 62 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks system information in the registry 2 TTPs 10 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmpt8rxc9zx.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1692
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3244
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 654F539EFCF626F23F06A181979C0CEA C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5004
      • C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Checks system information in the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1500
        • C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe" C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe /permachine /childprocess /silent /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /cusid:S-1-5-21-540052884-2969440504-464782435-1000
          4⤵
          • Executes dropped EXE
          • Checks system information in the registry
          PID:3048
        • C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe /peruser /childprocess /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Modifies system executable filetype association
          • Checks system information in the registry
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5012
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncConfig.exe
            "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncConfig.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4748
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
            /updateInstalled /background
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies system executable filetype association
            • Checks system information in the registry
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:2924
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\Microsoft.SharePoint.exe
            /silentConfig
            5⤵
            • Executes dropped EXE
            • Checks system information in the registry
            PID:472
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3516
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 35F4E0ECBD539FA4D9DC85AC70775BEB
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4716
      • C:\Windows\System32\MsiExec.exe
        "C:\Windows\System32\MsiExec.exe" /Y "C:\Users\Admin\AppData\Roaming\HFvlKgDlGU.dll"
        2⤵
        • Badlisted process makes network request
        PID:4156
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe
      1⤵
        PID:2008
      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
        C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
        1⤵
        • Executes dropped EXE
        PID:3744
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:3204

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            FileSyncClient.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncClient.dll
            • Size 10.6MB
            • SHA256 0216d51e7f157ac698185e2083150a1a622dd21f7466806663aaea0c14c87457
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FileSyncConfig.exe
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncConfig.exe
            • Size 782KB
            • SHA256 2807caabb50d6c404fd89ed55bbcef17cc7f097867d25c960883d67a6f347928
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FileSyncEvents.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncEvents.dll
            • Size 139KB
            • SHA256 70e88f97b008eac45c45d41c699e421bb3cde5d6bf23c720270f7e8c92bfa4d8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FileSyncFS.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncFS.dll
            • Size 886KB
            • SHA256 0eb306e3e5ae724d747ee92ffb029ed6faafcf8b36684537e6976cf50b9a0a45
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FileSyncHost.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncHost.dll
            • Size 447KB
            • SHA256 0a261a94cfc32a4fcb8cae9ea191d9bca40031f0d93822d639884ee0ec3bd135
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FileSyncRNWin32Lib.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncRNWin32Lib.dll
            • Size 329KB
            • SHA256 0183d2065e0b6148697968b73f2abd100a0e30f0d280d74299cdab69321439ed
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FileSyncTelemetryExtensions.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncTelemetryExtensions.dll
            • Size 472KB
            • SHA256 16ecdba01cb869e4db022a27097f6ab9aace7590aa0d9ac4a8c10ddae7683d3d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LoggingPlatform.DLL
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LoggingPlatform.DLL
            • Size 646KB
            • SHA256 194f07c167910fba8b999edbe7209d133282f8230b59484bbd0377f68a68eb06
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.contrast-black_scale-100.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-black_scale-100.png
            • Size 1KB
            • SHA256 6f028542f6faeaaf1f564eab2605bedb20a2ee72cdd9930bde1a3539344d721b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-black_scale-125.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-black_scale-125.png
            • Size 1KB
            • SHA256 cbdcf248f8a0fcd583b475562a7cdcb58f8d01236c7d06e4cdbfe28e08b2a185
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-black_scale-150.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-black_scale-150.png
            • Size 2KB
            • SHA256 36a6aad9a9947ab3f6ac6af900192f5a55870d798bca70c46770ccf2108fd62d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-black_scale-200.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-black_scale-200.png
            • Size 2KB
            • SHA256 67d1bb54fcb19c174de1936d08b5dbdb31b98cfdd280bcc5122fb0693675e4f2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-black_scale-400.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-black_scale-400.png
            • Size 6KB
            • SHA256 5cb8fd670585de8a7fc0ceede164847522d287ef17cd48806831ea18a0ceac1f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.contrast-white_scale-100.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-white_scale-100.png
            • Size 2KB
            • SHA256 a024fc5dbe0973fd9267229da4ebfd8fc41d73ca27a2055715aafe0efb4f3425
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-white_scale-125.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-white_scale-125.png
            • Size 3KB
            • SHA256 e8b30bfcee8041f1a70e61ca46764416fd1df2e6086ba4c280bfa2220c226750
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-white_scale-150.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-white_scale-150.png
            • Size 3KB
            • SHA256 a0bbe33b798c3adac36396e877908874cffaadb240244095c68dff840dcbbf73
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-white_scale-200.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-white_scale-200.png
            • Size 4KB
            • SHA256 fba9104432cbb8ebbd45c18ef1ba46a45dd374773e5aa37d411bb023ded8efd6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.contrast-white_scale-400.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-white_scale-400.png
            • Size 8KB
            • SHA256 9250ef25efc2a9765cf1126524256fdfc963c8687edfdc4a2ecde50d748ada85
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.scale-100.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.scale-100.png
            • Size 2KB
            • SHA256 8acbdd41252595b7410ca2ed438d6d8ede10bd17fe3a18705eedc65f46e4c1c4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.scale-125.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.scale-125.png
            • Size 4KB
            • SHA256 a5294e3c7cd855815f8d916849d87bd2357f5165eb4372f248fdf8b988601665
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.scale-150.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.scale-150.png
            • Size 5KB
            • SHA256 3df4590386671e0d6fee7108e457eb805370a189f5fdfeaf2f2c32d5adc76abd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.scale-200.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.scale-200.png
            • Size 6KB
            • SHA256 3384357b6110f418b175e2f0910cffe588c847c8e55f2fe3572d82999a62c18e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.scale-400.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.scale-400.png
            • Size 15KB
            • SHA256 deb0ec0ee8f1c4f7ea4de2c28ff85087ee5ff8c7e3036c3b0a66d84bae32b6bb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveSmallTile.contrast-black_scale-100.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png
            • Size 783B
            • SHA256 292cac291af7b45f12404f968759afc7145b2189e778b14d681449132b14f06b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.contrast-black_scale-125.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png
            • Size 1018B
            • SHA256 8efeacefb92d64dfb1c4df2568165df6436777f176accfd24f4f7970605d16c2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.contrast-black_scale-150.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png
            • Size 1KB
            • SHA256 262b9a30bb8db4fc59b5bc348aa3813c75e113066a087135d0946ad916f72535
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.contrast-black_scale-200.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png
            • Size 1KB
            • SHA256 9833b80def72b73fca150af17d4b98c8cd484401f0e2d44320ecd75b5bb57c42
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.contrast-black_scale-400.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png
            • Size 3KB
            • SHA256 3a7ef7c0bda402fdaff19a479d6c18577c436a5f4e188da4c058a42ef09a7633
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.scale-100.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.scale-100.png
            • Size 1KB
            • SHA256 4e11167708801727891e8dd9257152b7391fc483d46688d61f44b96360f76816
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.scale-125.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.scale-125.png
            • Size 2KB
            • SHA256 69e432d1eec44bed4aad35f72a912e1f0036a4b501a50aec401c9fa260a523e3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.scale-150.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.scale-150.png
            • Size 3KB
            • SHA256 7e3f35d5eb05435be8d104a2eacf5bace8301853104a4ea4768601c607ddf301
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.scale-200.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.scale-200.png
            • Size 4KB
            • SHA256 85823f7a5a4ebf8274f790a88b981e92ede57bde0ba804f00b03416ee4feda89
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveSmallTile.scale-400.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.scale-400.png
            • Size 11KB
            • SHA256 9a0b901e97abe02036c782eb6a2471e18160b89fd5141a5a9909f0baab67b1ef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Resources.pri
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\Resources.pri
            • Size 18.1MB
            • SHA256 2d9961faa1b5b8018f803a74c8e83c0036eed830fbe70fc9c57320bd8cddf1cf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDrive.VisualElementsManifest.xml
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\OneDrive.VisualElementsManifest.xml
            • Size 344B
            • SHA256 d21077ad0c29a4c939b8c25f1186e2b542d054bb787b1d3210e9cab48ec3080c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDrive.exe
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\OneDrive.exe
            • Size 4.7MB
            • SHA256 d63d180f84c8fc7b34fed95e838c025bba44a0cac18777b5582c01f4ae356207
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveStandaloneUpdater.exe
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\OneDriveStandaloneUpdater.exe
            • Size 4.0MB
            • SHA256 bf861f5bd384707e23148716240822208ceeba50c132fb172b784a6575e5e555
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveTelemetryStable.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\OneDriveTelemetryStable.dll
            • Size 2.2MB
            • SHA256 8954efe40c929c33741ce211bb14511d4dd47e0caf9813aed3746645bdb184f0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Telemetry.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\Telemetry.dll
            • Size 996KB
            • SHA256 44618801ef0d15721d3c2e87edb1dd2136971b84f811c43e90402fd3238c0251
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UpdateRingSettings.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\UpdateRingSettings.dll
            • Size 629KB
            • SHA256 029fe60df36b90aa300770218302fcffd8ce1bda4b43d1c8c4a734d14e0cfc85
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msvcp140.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\msvcp140.dll
            • Size 557KB
            • SHA256 e70a816aac7a38fd02f60e8b2d7d737f0ed43f059abfaa5788ed2943003239e1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            localizable.json
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\pa-Arab-PK\localizable.json
            • Size 4B
            • SHA256 e3566b3a06430868d71e9287dfd6c6c520a3da027aabea01951d407ee131dc2f
            • MD5 SHA1 SHA512
            Submit Download

            ucrtbase.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\ucrtbase.dll
            • Size 1.1MB
            • SHA256 4d147c809638b6af98bbada8d9f8e9d36091259b418ac65dd5b92a404b746ac3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcruntime140.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\vcruntime140.dll
            • Size 96KB
            • SHA256 91068e7b5e708f871cc0e0b85ef4132d6b24c39c9ff4efcae7613f3a5d1e9342
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcruntime140_1.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\vcruntime140_1.dll
            • Size 37KB
            • SHA256 6c45d5948249dc2a46e2d40f9213f5a8ec3d5fb4c8ccaa96d380c0e50357ab8d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.ListSync.Settings.db
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Business1\settings\Microsoft.ListSync.Settings.db
            • Size 16KB
            • SHA256 e1b72fdb6fb9da58322f43b4ac4d23a84be5800fefd87fea07b6895ce091fea6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PreSignInSettingsConfig.json
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.json
            • Size 101KB
            • SHA256 5b2e0306da2d65d5146630bb408ba9800996aed7c84863537ef22608514eb867
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            1521f696d8626c8e8127c0284ab987ff1974f39a.tbres
            • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\1521f696d8626c8e8127c0284ab987ff1974f39a.tbres
            • Size 2KB
            • SHA256 f6311555ce8886eebab1fbe013bb31d9ded7c2e33e5d3d762bd18f90afae0620
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            4e7a3602a6530194fc2a9d803f78656054f42b7e.tbres
            • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\4e7a3602a6530194fc2a9d803f78656054f42b7e.tbres
            • Size 2KB
            • SHA256 b3d49bc2c228923ba85b99927259296dd0bd0b661c19282567281397e65b2ef9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            78c091ac6d34daa9d603629dd088840de549030f.tbres
            • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\78c091ac6d34daa9d603629dd088840de549030f.tbres
            • Size 2KB
            • SHA256 f58bb1c6205290362f1a1e7054087f7cc2a13c92f9b39f401f230b2b97c12b0b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MSI211F.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI211F.tmp
            • Size 816KB
            • SHA256 8d633efeda1249356b11bf8f46583242356e4f903056b53bd25a99511d1790a1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI2461.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI2461.tmp
            • Size 877KB
            • SHA256 7118cd0d6956c84dc8ede10db84491d7884bfb0baa4a0ab96afc7eea47f46dd0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wctDC61.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\wctDC61.tmp
            • Size 2KB
            • SHA256 dee9c59ac375eb8165b59398008724a1f167062fb5ce746dfe5e1e05c15a95b9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/2924-1381-0x000001E3903C0000-0x000001E390E72000-memory.dmp
            Download

            memory/4156-1435-0x000001FD2A5B0000-0x000001FD2A7C9000-memory.dmp
            Download

            memory/4156-1436-0x000001FD2A5B0000-0x000001FD2A7C9000-memory.dmp
            Download

            memory/4156-1437-0x000001FD2A5B0000-0x000001FD2A7C9000-memory.dmp
            Download

            memory/4156-1434-0x000001FD2A5B0000-0x000001FD2A7C9000-memory.dmp
            Download

            memory/4156-1438-0x000001FD2A5B0000-0x000001FD2A7C9000-memory.dmp
            Download