Overview

overview

8

Static

static

3

boykisser.exe

windows10-2004-x64

8

boykisser.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/07/2026, 04:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    boykisser.exe
  • Size 3.0MB
  • Sample260701-e2mf5sgs7x
  • SHA256 b4f66394b20e42b4dcf255aa8c820a9aa0b932cb923caf9346b971f340f9df63
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarebootkitdefense_evasiondiscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Disables Task Manager via registry modification
    defense_evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 43 IoCs
  • Modifies system executable filetype association 2 TTPs 7 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks system information in the registry 2 TTPs 6 IoCs

    System information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: LoadsDriver 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\boykisser.exe
    "C:\Users\Admin\AppData\Local\Temp\boykisser.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4312
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGIAbwB5AGsAaQBzAHMAZQByAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAC0ALQBlAGwAZQB2AGEAdABlAGQAJwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4748
      • C:\Users\Admin\AppData\Local\Temp\boykisser.exe
        "C:\Users\Admin\AppData\Local\Temp\boykisser.exe" --elevated
        3⤵
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of WriteProcessMemory
        PID:4692
        • C:\Windows\system32\reg.exe
          "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
          4⤵
          • Modifies registry key
          PID:2452
        • C:\Windows\system32\reg.exe
          "reg" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
          4⤵
          • Modifies registry key
          PID:3804
        • C:\Windows\system32\cmd.exe
          "cmd" /c reg delete HKLM\BCD00000000 /f
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1768
          • C:\Windows\system32\reg.exe
            reg delete HKLM\BCD00000000 /f
            5⤵
            • Modifies registry key
            PID:4764
        • C:\Windows\system32\netsh.exe
          "netsh" wlan show profiles
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Network Configuration Discovery: Wi-Fi Discovery
          PID:5068
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1996
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /7
      1⤵
        PID:2952
      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
        "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
        1⤵
        • Modifies system executable filetype association
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3492
        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
          "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart
          2⤵
          • Executes dropped EXE
          • Checks system information in the registry
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2952
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
            C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Checks system information in the registry
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2684
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
              "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1596
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
              /updateInstalled /background
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies system executable filetype association
              • Checks system information in the registry
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:2452
      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
        C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3612

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            3
            T1546

            Change Default File Association

            1
            T1546.001

            Component Object Model Hijacking

            1
            T1546.015

            Netsh Helper DLL

            1
            T1546.007

            Pre-OS Boot

            1
            T1542

            Bootkit

            1
            T1542.003

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            3
            T1546

            Change Default File Association

            1
            T1546.001

            Component Object Model Hijacking

            1
            T1546.015

            Netsh Helper DLL

            1
            T1546.007

            Defense Evasion

            Modify Registry

            4
            T1112

            Obfuscated Files or Information

            1
            T1027

            Command Obfuscation

            1
            T1027.010

            Pre-OS Boot

            1
            T1542

            Bootkit

            1
            T1542.003

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Query Registry

            4
            T1012

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Wi-Fi Discovery

            1
            T1016.002

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            FileSyncClient.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncClient.dll
            • Size 5.0MB
            • SHA256 3d0250f856970ff36862c99f3329a82be87b0de47923debefe21443c76cddf88
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FileSyncConfig.exe
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
            • Size 553KB
            • SHA256 a3a4b648e4dcf3a4e5f7d13cc3d21b0353e496da75f83246cc8a15fada463bdf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FileSyncSessions.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncSessions.dll
            • Size 3.7MB
            • SHA256 1e0c26ceecee602b5b4a25fb9b0433c26bac05bd1eee4a43b9aa75ae46ccf115
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FileSyncTelemetryExtensions.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncTelemetryExtensions.dll
            • Size 58KB
            • SHA256 a742c9e35d824b592b3d9daf15efb3d4a28b420533ddf35a1669a5b77a00bb75
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FileSyncViews.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncViews.dll
            • Size 2.4MB
            • SHA256 146740eddcb439b1222d545b4d32a1a905641d02b14e1da61832772ce32e76ba
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LogUploader.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogUploader.dll
            • Size 769KB
            • SHA256 fe49f22bb132fedf1412e99169d307fa715dbdd84fe71c3e3ff12300d30d4987
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LoggingPlatform.DLL
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LoggingPlatform.DLL
            • Size 504KB
            • SHA256 d5a538a0a036c602492f9b2b6f85de59924da9ec3ed7a7bbf6ecd0979bee54d3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.contrast-black_scale-100.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-100.png
            • Size 1KB
            • SHA256 6f028542f6faeaaf1f564eab2605bedb20a2ee72cdd9930bde1a3539344d721b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-black_scale-125.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-125.png
            • Size 1KB
            • SHA256 cbdcf248f8a0fcd583b475562a7cdcb58f8d01236c7d06e4cdbfe28e08b2a185
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-black_scale-150.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-150.png
            • Size 2KB
            • SHA256 36a6aad9a9947ab3f6ac6af900192f5a55870d798bca70c46770ccf2108fd62d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-black_scale-200.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-200.png
            • Size 2KB
            • SHA256 67d1bb54fcb19c174de1936d08b5dbdb31b98cfdd280bcc5122fb0693675e4f2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-black_scale-400.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-400.png
            • Size 6KB
            • SHA256 5cb8fd670585de8a7fc0ceede164847522d287ef17cd48806831ea18a0ceac1f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.contrast-white_scale-100.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-100.png
            • Size 2KB
            • SHA256 a024fc5dbe0973fd9267229da4ebfd8fc41d73ca27a2055715aafe0efb4f3425
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-white_scale-125.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-125.png
            • Size 3KB
            • SHA256 e8b30bfcee8041f1a70e61ca46764416fd1df2e6086ba4c280bfa2220c226750
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-white_scale-150.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-150.png
            • Size 3KB
            • SHA256 a0bbe33b798c3adac36396e877908874cffaadb240244095c68dff840dcbbf73
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-white_scale-200.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-200.png
            • Size 4KB
            • SHA256 fba9104432cbb8ebbd45c18ef1ba46a45dd374773e5aa37d411bb023ded8efd6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.contrast-white_scale-400.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-400.png
            • Size 8KB
            • SHA256 9250ef25efc2a9765cf1126524256fdfc963c8687edfdc4a2ecde50d748ada85
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.scale-100.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-100.png
            • Size 2KB
            • SHA256 8acbdd41252595b7410ca2ed438d6d8ede10bd17fe3a18705eedc65f46e4c1c4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.scale-125.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-125.png
            • Size 4KB
            • SHA256 a5294e3c7cd855815f8d916849d87bd2357f5165eb4372f248fdf8b988601665
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.scale-150.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-150.png
            • Size 5KB
            • SHA256 3df4590386671e0d6fee7108e457eb805370a189f5fdfeaf2f2c32d5adc76abd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.scale-200.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-200.png
            • Size 6KB
            • SHA256 3384357b6110f418b175e2f0910cffe588c847c8e55f2fe3572d82999a62c18e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.scale-400.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-400.png
            • Size 15KB
            • SHA256 deb0ec0ee8f1c4f7ea4de2c28ff85087ee5ff8c7e3036c3b0a66d84bae32b6bb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveSmallTile.contrast-black_scale-100.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png
            • Size 783B
            • SHA256 292cac291af7b45f12404f968759afc7145b2189e778b14d681449132b14f06b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.contrast-black_scale-125.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png
            • Size 1018B
            • SHA256 8efeacefb92d64dfb1c4df2568165df6436777f176accfd24f4f7970605d16c2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.contrast-black_scale-150.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png
            • Size 1KB
            • SHA256 262b9a30bb8db4fc59b5bc348aa3813c75e113066a087135d0946ad916f72535
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.contrast-black_scale-200.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png
            • Size 1KB
            • SHA256 9833b80def72b73fca150af17d4b98c8cd484401f0e2d44320ecd75b5bb57c42
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.contrast-black_scale-400.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png
            • Size 3KB
            • SHA256 3a7ef7c0bda402fdaff19a479d6c18577c436a5f4e188da4c058a42ef09a7633
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.scale-100.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-100.png
            • Size 1KB
            • SHA256 4e11167708801727891e8dd9257152b7391fc483d46688d61f44b96360f76816
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.scale-125.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-125.png
            • Size 2KB
            • SHA256 69e432d1eec44bed4aad35f72a912e1f0036a4b501a50aec401c9fa260a523e3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.scale-150.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-150.png
            • Size 3KB
            • SHA256 7e3f35d5eb05435be8d104a2eacf5bace8301853104a4ea4768601c607ddf301
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.scale-200.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-200.png
            • Size 4KB
            • SHA256 85823f7a5a4ebf8274f790a88b981e92ede57bde0ba804f00b03416ee4feda89
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveSmallTile.scale-400.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-400.png
            • Size 11KB
            • SHA256 9a0b901e97abe02036c782eb6a2471e18160b89fd5141a5a9909f0baab67b1ef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSVCP140.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\MSVCP140.dll
            • Size 425KB
            • SHA256 545bb4a00b29b4b5d25e16e1d0969e99b4011033ce3d1d7e827abef09dd317e7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDrive.VisualElementsManifest.xml
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDrive.VisualElementsManifest.xml
            • Size 344B
            • SHA256 d21077ad0c29a4c939b8c25f1186e2b542d054bb787b1d3210e9cab48ec3080c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDrive.exe
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDrive.exe
            • Size 2.3MB
            • SHA256 5d8273bf98397e4c5053f8f154e5f838c7e8a798b125fcad33cab16e2515b665
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveStandaloneUpdater.exe
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDriveStandaloneUpdater.exe
            • Size 2.9MB
            • SHA256 969fbb03015dd9f33baf45f2750e36b77003a7e18c3954fab890cddc94046673
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveTelemetryStable.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDriveTelemetryStable.dll
            • Size 1.6MB
            • SHA256 146811735589450058048408f05644a93786a293c09ccb8d74420fb87c0a4d56
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Core.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Qt5Core.dll
            • Size 5.1MB
            • SHA256 ad44dbb30520d85f055595f0bc734b16b9f2fb659f17198310c0557b55a76d70
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Gui.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Qt5Gui.dll
            • Size 5.3MB
            • SHA256 bcfe906135d759cca8c2c7e32679c85404a288d99f3d4da13d929e98f6e607d5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Network.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Qt5Network.dll
            • Size 983KB
            • SHA256 3d23eadcb60d469e974591e16d6e73f18e33939bbee1d27953e63df00e629c8f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Qml.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Qt5Qml.dll
            • Size 2.7MB
            • SHA256 bdadc298fda94a9ad1268128863276c7f898bef3ae79a3e6782cecf22f1294a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5QmlModels.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Qt5QmlModels.dll
            • Size 397KB
            • SHA256 4129b5228cd324103e2f35a07e718d03dfa814186126d7f4ed5a7e9d92306a56
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Quick.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Qt5Quick.dll
            • Size 3.3MB
            • SHA256 c0d9b9ecb002635f24dcaf53eb34f46c22bacf02afae768f2d0834656a5d581d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Widgets.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Qt5Widgets.dll
            • Size 4.2MB
            • SHA256 3705c8a18dd69f23f02a8a29b792e684a0dfcd360b8e7d71c2afe7e448044074
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5WinExtras.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Qt5WinExtras.dll
            • Size 199KB
            • SHA256 8bc10ab2b66a07632121deb93b3b8045b5029e918babc2ee2908a29decdab333
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Resources.pri
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Resources.pri
            • Size 4KB
            • SHA256 e1252527bc066da6838344d49660e4c6ff2d1ddfda036c5ec19b07fdfb90c8c3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SyncEngine.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\SyncEngine.dll
            • Size 8.3MB
            • SHA256 51b13dd5d598367fe202681dce761544ee3f7ec4f36d0c7c3c8a3fca32582f07
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Telemetry.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Telemetry.dll
            • Size 451KB
            • SHA256 414f6f64d463b3eb1e9eb21d9455837c99c7d9097f6bb61bd12c71e8dce62902
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UpdateRingSettings.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\UpdateRingSettings.dll
            • Size 432KB
            • SHA256 9fb3abcafd8e8b1deb13ec0f46c87b759a1cb610b2488052ba70e3363f1935ec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WebView2Loader.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\WebView2Loader.dll
            • Size 107KB
            • SHA256 41a13ba97534c7f321f3f29ef1650bd445bd3490153a2bb2d57e0fbc70d339c1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WnsClientApi.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\WnsClientApi.dll
            • Size 668KB
            • SHA256 114ea2a7872a991a00f2ffd907248cafe1f7475cd399982fd383488f6d7f4839
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            adal.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\adal.dll
            • Size 1.3MB
            • SHA256 55234df27deb004b09c18dc15ca46327e48b26b36dfb43a92741f86300bd8e9e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\libcrypto-1_1.dll
            • Size 2.4MB
            • SHA256 14c291c907296098c9d7859063333aff0a344471ddc69497bd1f8004641c11b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ucrtbase.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\ucrtbase.dll
            • Size 1.1MB
            • SHA256 5ade748445d8da8f22d46ad46f277e1e160f6e946fc51e5ac51b9401ce5daf46
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcruntime140.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\vcruntime140.dll
            • Size 73KB
            • SHA256 c79241aec5e35cba91563c3b33ed413ce42309f5145f25dc92caf9c82a753817
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveSetup.exe
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
            • Size 40.2MB
            • SHA256 e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            logUploaderSettings_temp.ini
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini
            • Size 38B
            • SHA256 884d272d16605590e511ae50c88842a8ce203a864f56061a3c554f8f8265866e
            • MD5 SHA1 SHA512
            Submit Download

            logUploaderSettings_temp.ini
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini
            • Size 108B
            • SHA256 0baa8aeac2b0f8dd8d75aced119a33a86f5328c5e4359f331bcbf877ca7a255f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            PreSignInSettingsConfig.json
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.json
            • Size 63KB
            • SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DeviceHealthSummaryConfiguration.ini
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.ini
            • Size 77B
            • SHA256 e48691e40beb9a43f80dacc1dc67d1f6e76b2bab3f264cca00d0b5dda808c329
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            update100[1].xml
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8TC3VSEU\update100[1].xml
            • Size 726B
            • SHA256 36a6bd38a8a6f5a75b73caffae5ae66dfabcaefd83da65b493fa881ea8a64e7d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_bsrxbh4y.03l.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bsrxbh4y.03l.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            aria-debug-3492.log
            • Path C:\Users\Admin\AppData\Local\Temp\aria-debug-3492.log
            • Size 470B
            • SHA256 d2d83281cd0fef3bfdce6ac4b2a6945cc340c01e6f295812ed1ab191d1bf5543
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tmp1B0B.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\tmp1B0B.tmp
            • Size 35.9MB
            • SHA256 bbc70091b3834af5413b9658b07269badd4cae8d96724bf1f7919f6aab595009
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/4312-2-0x00007FF7195D0000-0x00007FF719B3F000-memory.dmp
            Download

            memory/4312-0-0x00007FF7195D0000-0x00007FF719B3F000-memory.dmp
            Download

            memory/4692-17-0x00007FF7195D0000-0x00007FF719B3F000-memory.dmp
            Download

            memory/4692-18-0x00007FF7195D0000-0x00007FF719B3F000-memory.dmp
            Download

            memory/4692-16-0x00007FF7195D0000-0x00007FF719B3F000-memory.dmp
            Download

            memory/4692-13-0x00007FF7195D0000-0x00007FF719B3F000-memory.dmp
            Download

            memory/4748-4-0x000001EE6A340000-0x000001EE6A350000-memory.dmp
            Download

            memory/4748-5-0x000001EE6A2E0000-0x000001EE6A302000-memory.dmp
            Download

            memory/4748-3-0x000001EE6A340000-0x000001EE6A350000-memory.dmp
            Download