Overview

overview

10

Static

static

3

tmpt8rxc9zx.msi

windows10-ltsc_2021-x64

10

tmpt8rxc9zx.msi

windows10-2004-x64

10

tmpt8rxc9zx.msi

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    09/06/2026, 00:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tmpt8rxc9zx.msi
  • Size 85.7MB
  • Sample260609-a9faksh17x
  • SHA256 f82d15eed385a7a913b98a28bce9b27a7e3611e1c0c4d9fa65741d3fdd76d23c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adware2defense_evasiondiscoverybumblebeeloaderpersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Extracted

Family

  • bumblebee

Botnet

  • 2

Attributes
  • dga

    45urhm0ldgxb.live

    gx6xly9rp6vl.live

    zv46ga4ntybq.live

    7n1hfolmrnbl.live

    vivh2xlt9i6q.live

    97t3nh4kk510.live

    kbkdtwucfl40.live

    qk6a1ahb63uz.live

    whko7loy7h5z.live

    dad1zg44n0bn.live

    7xwz4hw8dts9.live

    ovekd5n3gklq.live

    amwnef8mjo4v.live

    e7ivqfhnss0x.live

    rjql4nicl6bg.live

    4mo318kk29i4.live

    zpo18lm8vg1x.live

    jc51pt290y0n.live

    rg26t2dc4hf4.live

    qw9a58vunuja.live

    ugm94zjzl5nl.live

    mckag832orba.live

    pdw0v9voxlxr.live

    m4tx2apfmoxo.live

    n2uc737ef71m.live

    hkk3112645hz.live

    ugko9g5ipa4o.live

    8wgq2x4dybx9.live

    h81fx7sj8srr.live

    a4tgoqi1cm8x.live

  • dga_seed

    7834006444057268685

  • domain_length

    12

  • num_dga_domains

    300

  • port

    443

  • tld

    .live

rc4.plain

Signatures

  • Family: BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 18 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 14 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Badlisted process makes network request 64 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Checks system information in the registry 2 TTPs 28 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmpt8rxc9zx.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1684
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3804
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 17EF36796C2F369F0E5F1C672F36BF0A C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3944
      • C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe"
        3⤵
        • Executes dropped EXE
        • Checks system information in the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2272
        • C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe" C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe /permachine /childprocess /silent /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /cusid:S-1-5-21-1679180529-4058988202-686829476-1000
          4⤵
          • Executes dropped EXE
          • Checks system information in the registry
          PID:1876
        • C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\prerequisites\Microsoft OneDrive\OneDriveSetup.exe /peruser /childprocess /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix /RegisterOneDriveLauncherAutoStartTask
          4⤵
          • Executes dropped EXE
          • Modifies system executable filetype association
          • Checks system information in the registry
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4128
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncConfig.exe
            "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncConfig.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops desktop.ini file(s)
            PID:3832
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
            /updateInstalled /background
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies system executable filetype association
            • Checks system information in the registry
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4460
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
              "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart /updateSource:ODU
              6⤵
              • Executes dropped EXE
              • Checks system information in the registry
              • Suspicious behavior: EnumeratesProcesses
              PID:648
              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /updateSource:ODU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix /RegisterOneDriveLauncherAutoStartTask /EnableOneDriveLauncherRampDownloads /EnableDeltaBuildToTelemetryFeatureSet /ArgPerformNucleusLocalAccessRepair /PerformEdgeNucleusRepair /PerformChromeNucleusRepair /NucleusLNARepairVersion:1 /DisableRedirectionForShortCuts
                7⤵
                • Executes dropped EXE
                • Modifies system executable filetype association
                • Adds Run key to start application
                • Checks system information in the registry
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1584
                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\FileSyncConfig.exe
                  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\FileSyncConfig.exe"
                  8⤵
                  • Executes dropped EXE
                  PID:5432
                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                  /updateInstalled /background
                  8⤵
                  • Executes dropped EXE
                  • Modifies system executable filetype association
                  • Checks system information in the registry
                  • Modifies Control Panel
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Modifies system certificate store
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:5568
                  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                    "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /client=Personal /background
                    9⤵
                    • Executes dropped EXE
                    • Modifies system executable filetype association
                    • Checks whether UAC is enabled
                    • Checks system information in the registry
                    • Modifies Control Panel
                    • Modifies Internet Explorer settings
                    • Modifies registry class
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:5172
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=OneDrive.exe --webview-exe-version=26.088.0510.0004 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-features=msEnhancedTrackingPreventionEnabled --mojo-named-platform-channel-pipe=5172.5484.8330998143937777431
                      10⤵
                      • Drops file in Windows directory
                      • Checks SCSI registry key(s)
                      • Enumerates system info in registry
                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                      • Suspicious use of WriteProcessMemory
                      PID:1528
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x174,0x178,0x17c,0x150,0x184,0x7ffc0fbab078,0x7ffc0fbab084,0x7ffc0fbab090
                        11⤵
                          PID:572
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView" --webview-exe-name=OneDrive.exe --webview-exe-version=26.088.0510.0004 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1664,i,17669820244837802160,14485634205404487287,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=1616 /prefetch:2
                          11⤵
                            PID:2980
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView" --webview-exe-name=OneDrive.exe --webview-exe-version=26.088.0510.0004 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2000,i,17669820244837802160,14485634205404487287,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:11
                            11⤵
                              PID:4996
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView" --webview-exe-name=OneDrive.exe --webview-exe-version=26.088.0510.0004 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2280,i,17669820244837802160,14485634205404487287,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:13
                              11⤵
                                PID:240
                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView" --webview-exe-name=OneDrive.exe --webview-exe-version=26.088.0510.0004 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3588,i,17669820244837802160,14485634205404487287,262144 --disable-features=msEnhancedTrackingPreventionEnabled --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
                                11⤵
                                  PID:556
                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                                "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /client=Personal /background
                                10⤵
                                • Executes dropped EXE
                                • Modifies system executable filetype association
                                • Checks system information in the registry
                                • Modifies Control Panel
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:5432
                          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\OneDrive.Sync.Service.exe
                            /silentConfig
                            8⤵
                            • Executes dropped EXE
                            • Checks system information in the registry
                            • Modifies registry class
                            PID:3128
                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\Microsoft.SharePoint.exe
                      /silentConfig
                      5⤵
                      • Executes dropped EXE
                      • Checks system information in the registry
                      PID:2956
              • C:\Windows\system32\srtasks.exe
                C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                2⤵
                  PID:1644
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding 7AA5A4CC711BEFD972C62891EC348296
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:4708
                • C:\Windows\System32\MsiExec.exe
                  "C:\Windows\System32\MsiExec.exe" /Y "C:\Users\Admin\AppData\Roaming\HFvlKgDlGU.dll"
                  2⤵
                  • Badlisted process makes network request
                  PID:1032
              • C:\Windows\system32\msiexec.exe
                C:\Windows\system32\msiexec.exe
                1⤵
                  PID:424
                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
                  C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:3628
                  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\Microsoft.SharePoint.exe
                    "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\Microsoft.SharePoint.exe" /silentConfig
                    2⤵
                    • Executes dropped EXE
                    • Checks system information in the registry
                    PID:4492
                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\OneDriveLauncher.exe
                  C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\OneDriveLauncher.exe
                  1⤵
                  • Executes dropped EXE
                  • Checks system information in the registry
                  PID:3464
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                  • Checks SCSI registry key(s)
                  PID:4084
                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\OneDriveLauncher.exe
                  C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\OneDriveLauncher.exe
                  1⤵
                  • Executes dropped EXE
                  • Checks system information in the registry
                  PID:5592
                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\FileCoAuth.exe
                  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\FileCoAuth.exe" -Embedding
                  1⤵
                  • Executes dropped EXE
                  PID:5904

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Event Triggered Execution

                      3
                      T1546

                      Change Default File Association

                      1
                      T1546.001

                      Component Object Model Hijacking

                      1
                      T1546.015

                      Installer Packages

                      1
                      T1546.016

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Event Triggered Execution

                      3
                      T1546

                      Change Default File Association

                      1
                      T1546.001

                      Component Object Model Hijacking

                      1
                      T1546.015

                      Installer Packages

                      1
                      T1546.016

                      Defense Evasion

                      Modify Registry

                      5
                      T1112

                      Subvert Trust Controls

                      1
                      T1553

                      Install Root Certificate

                      1
                      T1553.004

                      System Binary Proxy Execution

                      1
                      T1218

                      Msiexec

                      1
                      T1218.007

                      Credential Access

                      Discovery

                      Network Share Discovery

                      1
                      T1135

                      Peripheral Device Discovery

                      2
                      T1120

                      Query Registry

                      6
                      T1012

                      System Information Discovery

                      6
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      Lateral Movement

                      Collection

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      FileSyncClient.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncClient.dll
                      • Size 10.6MB
                      • SHA256 0216d51e7f157ac698185e2083150a1a622dd21f7466806663aaea0c14c87457
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      FileSyncConfig.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncConfig.exe
                      • Size 782KB
                      • SHA256 2807caabb50d6c404fd89ed55bbcef17cc7f097867d25c960883d67a6f347928
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      FileSyncEvents.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncEvents.dll
                      • Size 139KB
                      • SHA256 70e88f97b008eac45c45d41c699e421bb3cde5d6bf23c720270f7e8c92bfa4d8
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      FileSyncFS.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncFS.dll
                      • Size 886KB
                      • SHA256 0eb306e3e5ae724d747ee92ffb029ed6faafcf8b36684537e6976cf50b9a0a45
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      FileSyncHost.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncHost.dll
                      • Size 447KB
                      • SHA256 0a261a94cfc32a4fcb8cae9ea191d9bca40031f0d93822d639884ee0ec3bd135
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      FileSyncRNWin32Lib.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncRNWin32Lib.dll
                      • Size 329KB
                      • SHA256 0183d2065e0b6148697968b73f2abd100a0e30f0d280d74299cdab69321439ed
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      FileSyncTelemetryExtensions.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\FileSyncTelemetryExtensions.dll
                      • Size 472KB
                      • SHA256 16ecdba01cb869e4db022a27097f6ab9aace7590aa0d9ac4a8c10ddae7683d3d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      LoggingPlatform.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LoggingPlatform.dll
                      • Size 646KB
                      • SHA256 194f07c167910fba8b999edbe7209d133282f8230b59484bbd0377f68a68eb06
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.contrast-black_scale-100.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-black_scale-100.png
                      • Size 1KB
                      • SHA256 6f028542f6faeaaf1f564eab2605bedb20a2ee72cdd9930bde1a3539344d721b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-black_scale-125.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-black_scale-125.png
                      • Size 1KB
                      • SHA256 cbdcf248f8a0fcd583b475562a7cdcb58f8d01236c7d06e4cdbfe28e08b2a185
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-black_scale-150.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-black_scale-150.png
                      • Size 2KB
                      • SHA256 36a6aad9a9947ab3f6ac6af900192f5a55870d798bca70c46770ccf2108fd62d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-black_scale-200.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-black_scale-200.png
                      • Size 2KB
                      • SHA256 67d1bb54fcb19c174de1936d08b5dbdb31b98cfdd280bcc5122fb0693675e4f2
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-black_scale-400.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-black_scale-400.png
                      • Size 6KB
                      • SHA256 5cb8fd670585de8a7fc0ceede164847522d287ef17cd48806831ea18a0ceac1f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-100.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-white_scale-100.png
                      • Size 2KB
                      • SHA256 a024fc5dbe0973fd9267229da4ebfd8fc41d73ca27a2055715aafe0efb4f3425
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-125.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-white_scale-125.png
                      • Size 3KB
                      • SHA256 e8b30bfcee8041f1a70e61ca46764416fd1df2e6086ba4c280bfa2220c226750
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-150.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-white_scale-150.png
                      • Size 3KB
                      • SHA256 a0bbe33b798c3adac36396e877908874cffaadb240244095c68dff840dcbbf73
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-200.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-white_scale-200.png
                      • Size 4KB
                      • SHA256 fba9104432cbb8ebbd45c18ef1ba46a45dd374773e5aa37d411bb023ded8efd6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-400.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.contrast-white_scale-400.png
                      • Size 8KB
                      • SHA256 9250ef25efc2a9765cf1126524256fdfc963c8687edfdc4a2ecde50d748ada85
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.scale-100.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.scale-100.png
                      • Size 2KB
                      • SHA256 8acbdd41252595b7410ca2ed438d6d8ede10bd17fe3a18705eedc65f46e4c1c4
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.scale-125.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.scale-125.png
                      • Size 4KB
                      • SHA256 a5294e3c7cd855815f8d916849d87bd2357f5165eb4372f248fdf8b988601665
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.scale-150.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.scale-150.png
                      • Size 5KB
                      • SHA256 3df4590386671e0d6fee7108e457eb805370a189f5fdfeaf2f2c32d5adc76abd
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.scale-200.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.scale-200.png
                      • Size 6KB
                      • SHA256 3384357b6110f418b175e2f0910cffe588c847c8e55f2fe3572d82999a62c18e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.scale-400.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveMedTile.scale-400.png
                      • Size 15KB
                      • SHA256 deb0ec0ee8f1c4f7ea4de2c28ff85087ee5ff8c7e3036c3b0a66d84bae32b6bb
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveSmallTile.contrast-black_scale-100.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png
                      • Size 783B
                      • SHA256 292cac291af7b45f12404f968759afc7145b2189e778b14d681449132b14f06b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.contrast-black_scale-125.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png
                      • Size 1018B
                      • SHA256 8efeacefb92d64dfb1c4df2568165df6436777f176accfd24f4f7970605d16c2
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.contrast-black_scale-150.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png
                      • Size 1KB
                      • SHA256 262b9a30bb8db4fc59b5bc348aa3813c75e113066a087135d0946ad916f72535
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.contrast-black_scale-200.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png
                      • Size 1KB
                      • SHA256 9833b80def72b73fca150af17d4b98c8cd484401f0e2d44320ecd75b5bb57c42
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.contrast-black_scale-400.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png
                      • Size 3KB
                      • SHA256 3a7ef7c0bda402fdaff19a479d6c18577c436a5f4e188da4c058a42ef09a7633
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.scale-100.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.scale-100.png
                      • Size 1KB
                      • SHA256 4e11167708801727891e8dd9257152b7391fc483d46688d61f44b96360f76816
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.scale-125.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.scale-125.png
                      • Size 2KB
                      • SHA256 69e432d1eec44bed4aad35f72a912e1f0036a4b501a50aec401c9fa260a523e3
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.scale-150.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.scale-150.png
                      • Size 3KB
                      • SHA256 7e3f35d5eb05435be8d104a2eacf5bace8301853104a4ea4768601c607ddf301
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.scale-200.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.scale-200.png
                      • Size 4KB
                      • SHA256 85823f7a5a4ebf8274f790a88b981e92ede57bde0ba804f00b03416ee4feda89
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveSmallTile.scale-400.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\OneDriveSmallTile.scale-400.png
                      • Size 11KB
                      • SHA256 9a0b901e97abe02036c782eb6a2471e18160b89fd5141a5a9909f0baab67b1ef
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Resources.pri
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\LogoImages\Resources.pri
                      • Size 18.1MB
                      • SHA256 2d9961faa1b5b8018f803a74c8e83c0036eed830fbe70fc9c57320bd8cddf1cf
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDrive.VisualElementsManifest.xml
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\OneDrive.VisualElementsManifest.xml
                      • Size 344B
                      • SHA256 d21077ad0c29a4c939b8c25f1186e2b542d054bb787b1d3210e9cab48ec3080c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveStandaloneUpdater.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\OneDriveStandaloneUpdater.exe
                      • Size 4.0MB
                      • SHA256 bf861f5bd384707e23148716240822208ceeba50c132fb172b784a6575e5e555
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveTelemetryStable.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\OneDriveTelemetryStable.dll
                      • Size 2.2MB
                      • SHA256 8954efe40c929c33741ce211bb14511d4dd47e0caf9813aed3746645bdb184f0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Telemetry.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\Telemetry.dll
                      • Size 996KB
                      • SHA256 44618801ef0d15721d3c2e87edb1dd2136971b84f811c43e90402fd3238c0251
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      UpdateRingSettings.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\UpdateRingSettings.dll
                      • Size 629KB
                      • SHA256 029fe60df36b90aa300770218302fcffd8ce1bda4b43d1c8c4a734d14e0cfc85
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      msvcp140.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\msvcp140.dll
                      • Size 557KB
                      • SHA256 e70a816aac7a38fd02f60e8b2d7d737f0ed43f059abfaa5788ed2943003239e1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      localizable.json
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\pa-Arab-PK\localizable.json
                      • Size 4B
                      • SHA256 e3566b3a06430868d71e9287dfd6c6c520a3da027aabea01951d407ee131dc2f
                      • MD5 SHA1 SHA512
                      Submit Download

                      ucrtbase.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\ucrtbase.dll
                      • Size 1.1MB
                      • SHA256 4d147c809638b6af98bbada8d9f8e9d36091259b418ac65dd5b92a404b746ac3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      vcruntime140.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\vcruntime140.dll
                      • Size 96KB
                      • SHA256 91068e7b5e708f871cc0e0b85ef4132d6b24c39c9ff4efcae7613f3a5d1e9342
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      vcruntime140_1.dll
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\24.211.1020.0001\vcruntime140_1.dll
                      • Size 37KB
                      • SHA256 6c45d5948249dc2a46e2d40f9213f5a8ec3d5fb4c8ccaa96d380c0e50357ab8d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Square44x44Logo.targetsize-256.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\Assets\Square44x44Logo.targetsize-256.png
                      • Size 38KB
                      • SHA256 f21d962c5327933d43c887e1d0531a116fb71cf0075126d9fd5eaa58447a055c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Resources.resw
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\Copilot\Strings\LO-LA\Resources.resw
                      • Size 221B
                      • SHA256 1f762fa2d859cab49e93ca9ce8ef24edc4409ac75de77dc8781cb06ae4ee7f3f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      FileSyncConfig.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\FileSyncConfig.exe
                      • Size 866KB
                      • SHA256 00ca02cc03a2fcaab2569313b181e34fa1875de74521d26a5f22f0b036fdd5a2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.contrast-black_scale-100.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveMedTile.contrast-black_scale-100.png
                      • Size 965B
                      • SHA256 3910d0976a41bc9802e6c1460c441f0ce5bf6520b47e2e7f1237eea0342553cf
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-black_scale-125.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveMedTile.contrast-black_scale-125.png
                      • Size 1KB
                      • SHA256 7876f97812c78b2a6a6857b748cfcb083654b0df7a9968d28a337f553c9bb740
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-black_scale-150.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveMedTile.contrast-black_scale-150.png
                      • Size 1KB
                      • SHA256 49bac30adc5e19520c9aef662bf6ab7f825d17de893f49f935f52bb58231d912
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-black_scale-200.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveMedTile.contrast-black_scale-200.png
                      • Size 1KB
                      • SHA256 06c80abf5996c0f80d90db0335ec7d77e756fbbea33e97b399e58eda97be5f77
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-black_scale-400.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveMedTile.contrast-black_scale-400.png
                      • Size 4KB
                      • SHA256 0048c2fbe78c434315a40c489a6233de3eaac4877d3ab3b87f233de97ef45760
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-100.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveMedTile.contrast-white_scale-100.png
                      • Size 898B
                      • SHA256 d66500db2be2a08e1fbe3c25bfb3f8f92af7c1222ae01d983ff01f28e161a173
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-125.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveMedTile.contrast-white_scale-125.png
                      • Size 1KB
                      • SHA256 684f98e53e6508ade14997324ed729b2dbd54fc95ff0d0cf242a0af2ff87b296
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-150.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveMedTile.contrast-white_scale-150.png
                      • Size 1KB
                      • SHA256 f1758274ecb3b62b6324055d6ebfe894fb022af30d646c26ff75245ffe07e97a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-200.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveMedTile.contrast-white_scale-200.png
                      • Size 1KB
                      • SHA256 969e3c485b450ad929616ae0f64408afb25098a8e32993d92e84a6558d3ad8a3
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveMedTile.contrast-white_scale-400.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveMedTile.contrast-white_scale-400.png
                      • Size 4KB
                      • SHA256 2167f453dec79f0f053913908fb0eb74b54342f9f298dffeee339712bae851e4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.scale-100.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveMedTile.scale-100.png
                      • Size 5KB
                      • SHA256 ee57225deb5b003c11d84f099a3cfe378ada230aaa89c6d7fc6334a21ce7dc06
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.scale-125.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveMedTile.scale-125.png
                      • Size 8KB
                      • SHA256 b3ce4ca2c3598012a7815108f0480bfb3b71b834995993a4160752a2577a3b6d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.scale-150.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveMedTile.scale-150.png
                      • Size 10KB
                      • SHA256 a285df7d2be2aad1ff4053c3a95ff0016e23051c48bb17bad83c9fb59d8f41d0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.scale-200.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveMedTile.scale-200.png
                      • Size 14KB
                      • SHA256 c655edecb76d1f95fc64c2742869e54d80f9102a0e0fb8f5824912b7a1f1d6af
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveMedTile.scale-400.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveMedTile.scale-400.png
                      • Size 48KB
                      • SHA256 e472291a236bfad76c209b5785c329dbc094fbd70194c21cffd20fe32ab59a12
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveSmallTile.contrast-black_scale-100.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png
                      • Size 563B
                      • SHA256 5b9b49b6af48eb7551c3dd2a62a6a49ae6740b2b49010bb5b006cf85b4e54f44
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.contrast-black_scale-125.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png
                      • Size 874B
                      • SHA256 37a6ca2212efeb34d8905ea08c81bd6f4cf884e4d009c245927618dd61e50537
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.contrast-black_scale-150.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png
                      • Size 962B
                      • SHA256 c191a3138fdc51ccc4eaf8979f44fc4cff3ab96593e21371845cd7967971efbc
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.contrast-black_scale-200.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png
                      • Size 1KB
                      • SHA256 ee2b6b8103ac0dd5ad593e6b5106df0e8e5f1459682cfc6349d803c5802c2dd7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.contrast-black_scale-400.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png
                      • Size 2KB
                      • SHA256 82d5e6a7643d34d618c7fd2cd38c63a360230a72211619c2ca8d70514b6eff6b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.scale-100.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveSmallTile.scale-100.png
                      • Size 1KB
                      • SHA256 1c1975f56416589fd0aa9add4c44a87c5dfd71ca365630e40e9f64bde6f0e49c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      OneDriveSmallTile.scale-125.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveSmallTile.scale-125.png
                      • Size 5KB
                      • SHA256 46a6e452b5bf41b9ae867aec03f38bc5970b6c8a3128387b0b4c75cc203db9f9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveSmallTile.scale-150.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveSmallTile.scale-150.png
                      • Size 6KB
                      • SHA256 4e80205d7bff5c25be88be6f21ea5e32a2edbf115cdf4f26751f2a24a3d5c3d2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveSmallTile.scale-200.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveSmallTile.scale-200.png
                      • Size 9KB
                      • SHA256 19d6b52f75aca670c722499bf04a6de7eb9eb6cccdc78f489a73d72417fcf478
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveSmallTile.scale-400.png
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\LogoImages\OneDriveSmallTile.scale-400.png
                      • Size 22KB
                      • SHA256 ce53878af8d98b9e2e94374841d4be37c6942e6bccde660d05b86d051ef5f078
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDrive.App.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\OneDrive.App.exe
                      • Size 930KB
                      • SHA256 d5fd492235dc5da8a09d691ea7c4b05011b8fbee6bb84f1f7b2dac0a943cb0d4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDrive.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\OneDrive.exe
                      • Size 4.5MB
                      • SHA256 6ed291c37743430c42cf4fe53e753fc894e77a9eb9c258b400b7de3ba82c9407
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDriveStandaloneUpdater.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\OneDriveStandaloneUpdater.exe
                      • Size 4.2MB
                      • SHA256 bd15a3e7d15413bc07fdc0c6524c86ba08cecc9e6a06e04e536738815f068df6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      pa-Arab-PK.json
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.088.0510.0004\WebAssets\static\strings\pa-Arab-PK.json
                      • Size 32KB
                      • SHA256 ac02449325dfabb908b7bd1c9014f4889df002baaa6179fb15ade3b5d426fb3a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      settings.dat
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Crashpad\settings.dat
                      • Size 280B
                      • SHA256 fab60412d917a650b76ff6b3805c0ba71bfc3190d4e2270ada2bff0233d3d808
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      the-real-index
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                      • Size 48B
                      • SHA256 d779a9ad897bbbd4a32da3453663d2013c1c78449691237764e8a69414aa205e
                      • MD5 SHA1 SHA512
                      Submit Download

                      the-real-index
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                      • Size 120B
                      • SHA256 ab5986561b19b557beb03c1a7bafa74b27df44bf6aae88e4c976dfa111465664
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      data_0
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\DawnWebGPUCache\data_0
                      • Size 8KB
                      • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data_1
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\DawnWebGPUCache\data_1
                      • Size 264KB
                      • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data_2
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\DawnWebGPUCache\data_2
                      • Size 8KB
                      • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data_3
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\DawnWebGPUCache\data_3
                      • Size 8KB
                      • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      MANIFEST-000001
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\Extension Rules\MANIFEST-000001
                      • Size 41B
                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                      • MD5 SHA1 SHA512
                      Submit Download

                      SCT Auditing Pending Reports
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\Network\SCT Auditing Pending Reports
                      • Size 2B
                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                      • MD5 SHA1 SHA512
                      Submit Download

                      CURRENT
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Default\Site Characteristics Database\CURRENT
                      • Size 16B
                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                      • MD5 SHA1 SHA512
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Local State
                      • Size 1KB
                      • SHA256 c5d5a26f0ece18b1998c3172aa5a021244f443543d2d5c1385d3c525ca1b587f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Local State
                      • Size 2KB
                      • SHA256 33ef61d89db2517e013da5b1c822c5840a0492c6e10f3c231a2ba4a1f45f3f71
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Local State
                      • Size 3KB
                      • SHA256 56e552ede768e8ddaebe27d8e0c594c0074f13595498ff8c6ec22e4a095d1f8e
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Local State
                      • Size 4KB
                      • SHA256 1957d9500556ee306d9a18fe0f02fdd0b71bd3991481fa2fc7a93fbd2f0335ca
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Local State~RFe5961ec.TMP
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\EBWebView\Local State~RFe5961ec.TMP
                      • Size 1KB
                      • SHA256 aa0f04b47de6f139a5c521e4385e337217027470a246dc8812876ae4de5bf04d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Microsoft.ListSync.Settings.db
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Business1\settings\Microsoft.ListSync.Settings.db
                      • Size 16KB
                      • SHA256 e1b72fdb6fb9da58322f43b4ac4d23a84be5800fefd87fea07b6895ce091fea6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Microsoft.ListSync.Settings.db
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Business1\settings\Microsoft.ListSync.Settings.db
                      • Size 16KB
                      • SHA256 c5739925dc1bcc45ecefe321dc16f7952bacea0473c70101032266d164642484
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Microsoft.ListSync.Settings.db
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Business1\settings\Microsoft.ListSync.Settings.db
                      • Size 16KB
                      • SHA256 09bd28b1d44ad98bb4edfab622319ff3dde120b52933d07453fd8b7cb2de8400
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      OneDrive.exe
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                      • Size 4.7MB
                      • SHA256 d63d180f84c8fc7b34fed95e838c025bba44a0cac18777b5582c01f4ae356207
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      global.ini
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\global.ini
                      • Size 3KB
                      • SHA256 a88c5c52f8581d283ba7af1c937b4b9adffeb157dbe3f573fdd30234919370b4
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      global.ini
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\global.ini
                      • Size 3KB
                      • SHA256 57ae56f5389d71192e9d22bb4f9a9170bfe25ec147078e90b61ce485dc5b1bf3
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      logUploaderSettings_temp.ini
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini
                      • Size 108B
                      • SHA256 c30c4fe3a7846edc95f4ebccb8d49d24046d4e0b74b11363e92442e6ebf320df
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      PreSignInSettingsConfig.json
                      • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.json
                      • Size 101KB
                      • SHA256 5b2e0306da2d65d5146630bb408ba9800996aed7c84863537ef22608514eb867
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      85a63d6114e3ac7ea111830a02b581204ce7a032[1].xml
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8C0HVC1O\85a63d6114e3ac7ea111830a02b581204ce7a032[1].xml
                      • Size 27KB
                      • SHA256 5b2146f8d48c0fd0bf2fb1fa9c4d778f02c0d6d22d1b819d00ad7b4847b6b52e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSI3851.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\MSI3851.tmp
                      • Size 816KB
                      • SHA256 8d633efeda1249356b11bf8f46583242356e4f903056b53bd25a99511d1790a1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSI39EC.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\MSI39EC.tmp
                      • Size 877KB
                      • SHA256 7118cd0d6956c84dc8ede10db84491d7884bfb0baa4a0ab96afc7eea47f46dd0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      wct5663.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\wct5663.tmp
                      • Size 2KB
                      • SHA256 2b014b6a81a0e75453370e779eaac5cce15ca3d17fbe0c75afd81d9932c84e82
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      wct5D0A.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\wct5D0A.tmp
                      • Size 2KB
                      • SHA256 8a9cd45212fb5c7cfe8e4bbfec93fb5b4bd97742d491721ad26c4d35c8de97bb
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      wct6E32.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\wct6E32.tmp
                      • Size 2KB
                      • SHA256 1120ffa7caaf53d1d595bbceeb5dc76326d554e8caa98792ece3c62f783fb862
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      wct6F5A.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\wct6F5A.tmp
                      • Size 2KB
                      • SHA256 09fe2147eb1d49f1a3403087068f22f449aa8ee811a3959bb228acc3146e0844
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      wctBFC1.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\wctBFC1.tmp
                      • Size 2KB
                      • SHA256 e547695f8e97933b408494d0fc77acc0f8758face23c45712ced96ffdad2435f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      desktop.ini
                      • Path C:\Users\Admin\OneDrive\desktop.ini
                      • Size 96B
                      • SHA256 f625a1050e8ba6df4de974c2acc572e1e637a3429bf2ee1449c552999a6c7268
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/556-3983-0x00007FFC3A740000-0x00007FFC3A741000-memory.dmp
                      Download

                      memory/1032-1449-0x0000017110620000-0x0000017110839000-memory.dmp
                      Download

                      memory/1032-1445-0x0000017110620000-0x0000017110839000-memory.dmp
                      Download

                      memory/1032-1446-0x0000017110620000-0x0000017110839000-memory.dmp
                      Download

                      memory/1032-1447-0x0000017110620000-0x0000017110839000-memory.dmp
                      Download

                      memory/1032-1448-0x0000017110620000-0x0000017110839000-memory.dmp
                      Download

                      memory/2980-4184-0x000001A185E10000-0x000001A185E39000-memory.dmp
                      Download

                      memory/2980-3873-0x00007FFC3A740000-0x00007FFC3A741000-memory.dmp
                      Download

                      memory/4460-1404-0x0000022855550000-0x0000022855B20000-memory.dmp
                      Download

                      memory/5172-4188-0x000002DB5B610000-0x000002DB5BBE1000-memory.dmp
                      Download

                      memory/5172-3789-0x00007FFC18040000-0x00007FFC1843F000-memory.dmp
                      Download

                      memory/5172-3790-0x00007FFC17460000-0x00007FFC179A8000-memory.dmp
                      Download

                      memory/5432-4190-0x00007FFC16610000-0x00007FFC16A0F000-memory.dmp
                      Download

                      memory/5432-4189-0x00007FFC17DB0000-0x00007FFC182F8000-memory.dmp
                      Download

                      memory/5432-4235-0x00000224AB970000-0x00000224ABCDA000-memory.dmp
                      Download

                      memory/5568-3684-0x00007FFC17860000-0x00007FFC17DA8000-memory.dmp
                      Download

                      memory/5568-3685-0x00007FFC17460000-0x00007FFC1785F000-memory.dmp
                      Download

                      memory/5568-3756-0x00000150D7860000-0x00000150D7E90000-memory.dmp
                      Download

                      memory/5568-3760-0x00000150D8AF0000-0x00000150D90C1000-memory.dmp
                      Download

                      memory/5904-4231-0x000001B4292D0000-0x000001B429900000-memory.dmp
                      Download

                      memory/5904-4234-0x000001B4292D0000-0x000001B429900000-memory.dmp
                      Download