Analysis
- max time kernel
150s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 12:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 4.6MB
- Sample260802-pflb3asfkf
- SHA256 92d5b93db3177c33b0490331cc63d08410642264868c5bf67aee608441d0c9c8
- MD5 076eb4ca42d3689ddf82c76b36a42bdf
- SHA1 4f80f7dea8d1a47c99978b5478a29da90b01a5a3
- SHA512 91c9098641046ad2dbde459b41584f70fde0d3427abf698fe29c95a07aeb57468e7838a44b98ec5988f5b6a4451c46d65332701f109320bee7aab2f3d337d32b
- SSDEEP 49152:G7vRdzL73k0UziLUBimCbPw/aRGVoA+965Kc+UnT6yTITcZK7IF9YbgHbA:CH7AzIg5As7S
- TLSH T100265A0AA2B520F6C0B6D13B8A669517FA727815873197DF02D147AA4F23FE49D7E330
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Disables taskbar notifications via registry modification
- Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation OneDriveSetup.exe Key value queried \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation OneDrive.Sync.Service.exe Key value queried \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation OneDriveStandaloneUpdater.exe Key value queried \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation OneDriveSetup.exe Key value queried \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation OneDrive.Sync.Service.exe Key value queried \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 17 IoCs
pid Process 4536 alg.exe 4304 DiagnosticsHub.StandardCollector.Service.exe 1820 fxssvc.exe 3492 elevation_service.exe 2464 elevation_service.exe 384 OneDriveSetup.exe 988 OneDriveSetup.exe 4168 FileSyncConfig.exe 4068 OneDrive.Sync.Service.exe 1704 OneDriveStandaloneUpdater.exe 756 OneDriveLauncher.exe 4088 TrustedInstaller.exe 3344 OneDriveSetup.exe 4992 OneDriveSetup.exe 5316 FileSyncConfig.exe 5236 OneDrive.Sync.Service.exe 176 OneDriveLauncher.exe - Loads dropped DLL 64 IoCs
pid Process 4168 FileSyncConfig.exe 4168 FileSyncConfig.exe 4168 FileSyncConfig.exe 4168 FileSyncConfig.exe 4168 FileSyncConfig.exe 4168 FileSyncConfig.exe 4168 FileSyncConfig.exe 4168 FileSyncConfig.exe 4168 FileSyncConfig.exe 4168 FileSyncConfig.exe 4168 FileSyncConfig.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 756 OneDriveLauncher.exe 756 OneDriveLauncher.exe 756 OneDriveLauncher.exe 756 OneDriveLauncher.exe 756 OneDriveLauncher.exe 756 OneDriveLauncher.exe 756 OneDriveLauncher.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 4068 OneDrive.Sync.Service.exe 5316 FileSyncConfig.exe 5316 FileSyncConfig.exe 5316 FileSyncConfig.exe 5316 FileSyncConfig.exe 5316 FileSyncConfig.exe 5316 FileSyncConfig.exe 5316 FileSyncConfig.exe 5316 FileSyncConfig.exe 5316 FileSyncConfig.exe 5316 FileSyncConfig.exe 5316 FileSyncConfig.exe 5236 OneDrive.Sync.Service.exe 5236 OneDrive.Sync.Service.exe 5236 OneDrive.Sync.Service.exe - Modifies system executable filetype association 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe - Windows security modification 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-2370214745-1838013427-2987045292-1000 alg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-2370214745-1838013427-2987045292-1000\EnableNotifications = "0" alg.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\"" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\"" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\"" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\"" OneDriveSetup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: alg.exe File opened (read-only) \??\D: OneDrive.Sync.Service.exe File opened (read-only) \??\E: alg.exe File opened (read-only) \??\I: alg.exe File opened (read-only) \??\J: alg.exe File opened (read-only) \??\M: alg.exe File opened (read-only) \??\S: alg.exe File opened (read-only) \??\T: alg.exe File opened (read-only) \??\W: alg.exe File opened (read-only) \??\Y: alg.exe File opened (read-only) \??\G: alg.exe File opened (read-only) \??\O: alg.exe File opened (read-only) \??\P: alg.exe File opened (read-only) \??\Q: alg.exe File opened (read-only) \??\F: OneDrive.Sync.Service.exe File opened (read-only) \??\H: alg.exe File opened (read-only) \??\K: alg.exe File opened (read-only) \??\L: alg.exe File opened (read-only) \??\N: alg.exe File opened (read-only) \??\R: alg.exe File opened (read-only) \??\V: alg.exe File opened (read-only) \??\Z: alg.exe File opened (read-only) \??\U: alg.exe - Checks system information in the registry 2 TTPs 18 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OneDriveLauncher.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OneDriveLauncher.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OneDriveSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OneDrive.Sync.Service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OneDriveStandaloneUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OneDriveSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OneDrive.Sync.Service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OneDriveStandaloneUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OneDriveSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OneDriveSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OneDriveSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OneDrive.Sync.Service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OneDriveLauncher.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OneDriveLauncher.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OneDriveSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OneDrive.Sync.Service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OneDriveSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OneDriveSetup.exe - Drops file in System32 directory 58 IoCs
description ioc Process File opened for modification \??\c:\windows\system32\searchindexer.exe alg.exe File opened for modification \??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File created \??\c:\windows\system32\pcmflleh.tmp 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\svchost.exe alg.exe File opened for modification \??\c:\windows\system32\fxssvc.exe alg.exe File opened for modification \??\c:\windows\system32\msiexec.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\dllhost.exe alg.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe alg.exe File opened for modification \??\c:\windows\system32\Agentservice.exe alg.exe File opened for modification \??\c:\windows\system32\sensordataservice.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\alg.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\msdtc.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\sgrmbroker.exe alg.exe File opened for modification \??\c:\windows\system32\Agentservice.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\vds.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\Appvclient.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\msdtc.exe alg.exe File opened for modification \??\c:\windows\system32\tieringengineservice.exe alg.exe File opened for modification \??\c:\windows\system32\vssvc.exe alg.exe File opened for modification \??\c:\windows\system32\wbengine.exe alg.exe File opened for modification \??\c:\windows\system32\spectrum.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File created \??\c:\windows\system32\diagsvcs\ckgfnpeq.tmp 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File created \??\c:\windows\system32\adqoabnm.tmp 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File created \??\c:\windows\system32\nfblnqlb.tmp 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File created \??\c:\windows\system32\knaeladp.tmp 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File created \??\c:\windows\system32\coefjhll.tmp 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\openssh\ssh-agent.exe alg.exe File opened for modification \??\c:\windows\system32\vds.exe alg.exe File opened for modification \??\c:\windows\system32\svchost.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File created \??\c:\windows\system32\odgfmied.tmp 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\spectrum.exe alg.exe File opened for modification \??\c:\windows\system32\locator.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File created \??\c:\windows\system32\gcnmpgbe.tmp 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File created \??\c:\windows\system32\ibdjgjlg.tmp 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\dllhost.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\lsass.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\lsass.exe alg.exe File created \??\c:\windows\system32\cfpcnjjk.tmp 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\tieringengineservice.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File created \??\c:\windows\system32\iefockfm.tmp 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File created \??\c:\windows\system32\lplphjga.tmp 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\snmptrap.exe alg.exe File created \??\c:\windows\system32\perceptionsimulation\khpdhamh.tmp 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\snmptrap.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\fxssvc.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\msiexec.exe alg.exe File opened for modification \??\c:\windows\system32\sensordataservice.exe alg.exe File opened for modification \??\c:\windows\system32\Appvclient.exe alg.exe File opened for modification \??\c:\windows\system32\locator.exe alg.exe File opened for modification \??\c:\windows\system32\sgrmbroker.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File created \??\c:\windows\system32\openssh\jqkiibhq.tmp 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe alg.exe File created \??\c:\windows\system32\lmgdaqfi.tmp 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\system32\wbem\wmiApsrv.exe alg.exe File opened for modification \??\c:\windows\system32\openssh\ssh-agent.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File created \??\c:\windows\syswow64\lakenjkj.tmp 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe - Drops file in Program Files directory 36 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification \??\c:\program files (x86)\google\googleupdater\141.0.7340.0\updater.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File created \??\c:\program files (x86)\microsoft\edge\Application\139.0.3405.125\lcjapkjj.tmp 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\mnmjadqg.tmp alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File created C:\Program Files\7-Zip\lncjookl.tmp alg.exe File opened for modification \??\c:\program files\common files\microsoft shared\source engine\ose.exe alg.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\occlljkq.tmp alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification \??\c:\program files (x86)\google\googleupdater\141.0.7340.0\updater.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\hlepeenn.tmp alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File created \??\c:\program files\common files\microsoft shared\source engine\bacfjfjk.tmp alg.exe File opened for modification \??\c:\program files\google\chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File created \??\c:\program files\google\chrome\Application\140.0.7339.81\nagegdqe.tmp 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\program files (x86)\microsoft\edge\Application\139.0.3405.125\elevation_service.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\program files (x86)\microsoft\edge\Application\139.0.3405.125\elevation_service.exe alg.exe File created C:\Program Files\7-Zip\gkooamha.tmp alg.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\mgecidfd.tmp alg.exe File opened for modification \??\c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe alg.exe File created C:\Program Files\7-Zip\jgpijieg.tmp alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\cedpmnkl.tmp alg.exe File created \??\c:\program files (x86)\mozilla maintenance service\enpckoaj.tmp 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\program files\common files\microsoft shared\source engine\ose.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File created C:\Program Files\7-Zip\nccafaqk.tmp alg.exe - Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\Logs\CBS\CBS.log TrustedInstaller.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe alg.exe File opened for modification \??\c:\windows\servicing\trustedinstaller.exe alg.exe File opened for modification \??\c:\windows\servicing\trustedinstaller.exe 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File created \??\c:\windows\servicing\cajdkghd.tmp 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe File created C:\Windows\Logs\CBS\CBS.log TrustedInstaller.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000" OneDriveSetup.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Interface\{9D613F8A-B30E-4938-8490-CB5677701EBF}\ProxyStubClsid32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\Interface\{e9de26a1-51b2-47b4-b1bf-c87059cc02a7}\TypeLib\Version = "1.0" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\Interface\{390AF5A7-1390-4255-9BC9-935BFCFA5D57}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Interface\{31508CC7-9BC7-494B-9D0F-7B1C7F144182}\TypeLib OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Interface\{EE15BBBB-9E60-4C52-ABCB-7540FF3DF6B3}\TypeLib\Version = "1.0" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\ProgID OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}\TypeLib\Version = "1.0" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\Interface\{679EC955-75AA-4FB2-A7ED-8C0152ECF409}\TypeLib\Version = "1.0" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\Interface\{D32F7B3A-DEC8-4F44-AF28-E9B7FEB62118} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\Interface\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{544c4c52-de0b-4d14-9510-21745381d5ca} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\Interface\{0299ECA9-80B6-43C8-A79A-FB1C5F19E7D8} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_CLASSES\WOW6432NODE\INTERFACE\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\TYPELIB OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Interface\{AB0CD980-906C-4FBB-9A5D-9E32A3C0CB37}\ProxyStubClsid32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Interface\{2B865677-AC3A-43BD-B9E7-BF6FCD3F0596} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\26.123.0628.0001\\OneDrive.Sync.Service.exe\"" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\SyncEngineEnumeratorProvider.SyncEngineEnumeratorProvider.1\CLSID OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\Interface\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\ProxyStubClsid32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\.copilot\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\26.106.0603.0003\\OneDriveFileLauncher.exe\" \"%1\"" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_CLASSES\WOW6432NODE\INTERFACE\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\TYPELIB OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_CLASSES\CLSID\{9BE266B4-A97C-486E-B993-EAEBAA798D69}\LOCALSERVER32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}\ProxyStubClsid32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\ = "OOBERequestHandler Class" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\ProgID\ = "FileSyncOutOfProcServices.FileSyncOutOfProcServices.1" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_CLASSES\INTERFACE\{5D5DD08F-A10E-4FEF-BCA7-E73E666FC66C}\TYPELIB OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{3A308EFE-656D-46BB-9963-0A41C0D6BCA2}\ = "SyncEngineEnumeratorProvider Class" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{7AE67172-9863-42B1-8750-2B85084FD8E8} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\TypeLib OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_CLASSES\TYPELIB\{638805C3-4BA3-4AC8-8AAC-71A0BA2BC284}\1.0\HELPDIR OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_CLASSES\FILESYNCCLIENT.FILESYNCCLIENT\CLSID OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}\ = "IFileSyncClient10" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{7AE67172-9863-42B1-8750-2B85084FD8E8}\LocalServer32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_CLASSES\WOW6432NODE\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\TYPELIB OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_CLASSES\INTERFACE\{B05D37A9-03A2-45CF-8850-F660DF0CBF07}\PROXYSTUBCLSID32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\VersionIndependentProgID OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\LocalServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\Interface\{54034913-37F9-4E26-8646-3D2EF536C786}\ = "IKFMEventHandler" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_CLASSES\INTERFACE\{1B7AED4F-FCAF-4DA4-8795-C03E635D8EDC}\PROXYSTUBCLSID32 OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\TypeLib\Version = "1.0" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Interface\{0299ECA9-80B6-43C8-A79A-FB1C5F19E7D8}\ProxyStubClsid32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\ProxyStubClsid32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\Interface\{8B9F14F4-9559-4A3F-B7D0-312E992B6D98} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Interface\{1EDD003E-C446-43C5-8BA0-3778CC4792CC}\ = "ISyncClientState" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Interface\{2692D1F2-2C7C-4AE0-8E73-8F37736C912D}\TypeLib\Version = "1.0" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\TypeLib\{F904F88C-E60D-4327-9FA2-865AD075B400}\1.0\0\win32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\NucleusNativeMessaging.NucleusNativeMessaging\CurVer OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Interface\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\ProxyStubClsid32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Interface\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}\TypeLib OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Interface\{EA23A664-A558-4548-A8FE-A6B94D37C3CF}\TypeLib\Version = "1.0" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Interface\{AEEBAD4E-3E0A-415B-9B94-19C499CD7B6A}\TypeLib OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Interface\{466F31F7-9892-477E-B189-FA5C59DE3603}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_CLASSES\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\VERSIONINDEPENDENTPROGID OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\TypeLib\{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_CLASSES\WOW6432NODE\INTERFACE\{EE6A6D4E-1A56-48E1-8AFF-268072B66738}\PROXYSTUBCLSID32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}\TypeLib\Version = "1.0" OneDriveSetup.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4116 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe 4116 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe 4536 alg.exe 4536 alg.exe 4116 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe 4116 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe 4536 alg.exe 4536 alg.exe 4536 alg.exe 4536 alg.exe 4536 alg.exe 4536 alg.exe 384 OneDriveSetup.exe 384 OneDriveSetup.exe 384 OneDriveSetup.exe 384 OneDriveSetup.exe 4536 alg.exe 4536 alg.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe 988 OneDriveSetup.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4116 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe Token: SeAuditPrivilege 1820 fxssvc.exe Token: SeTakeOwnershipPrivilege 4536 alg.exe Token: SeIncreaseQuotaPrivilege 384 OneDriveSetup.exe Token: SeIncreaseQuotaPrivilege 988 OneDriveSetup.exe Token: SeIncreaseQuotaPrivilege 3344 OneDriveSetup.exe Token: SeAssignPrimaryTokenPrivilege 4992 OneDriveSetup.exe Token: SeIncreaseQuotaPrivilege 4992 OneDriveSetup.exe Token: SeIncreaseQuotaPrivilege 4992 OneDriveSetup.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4116 wrote to memory of 384 4116 2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe 94 PID 988 wrote to memory of 4168 988 OneDriveSetup.exe 98 PID 1704 wrote to memory of 3344 1704 OneDriveStandaloneUpdater.exe 115 PID 4992 wrote to memory of 5316 4992 OneDriveSetup.exe 119 - System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer alg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" alg.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection OneDrive.Sync.Service.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_076eb4ca42d3689ddf82c76b36a42bdf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update /updateSource:ODSU2⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:384 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /updateSource:ODSU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix /RegisterOneDriveLauncherAutoStartTask /EnableOneDriveLauncherRampDownloads /EnableDeltaBuildToTelemetryFeatureSet /ArgPerformNucleusLocalAccessRepair /PerformEdgeNucleusRepair /PerformChromeNucleusRepair /NucleusLNARepairVersion:1 /DisableRedirectionForShortCuts3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks system information in the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\FileSyncConfig.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4168
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\OneDrive.Sync.Service.exe/silentConfig4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:4068
-
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4536
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:4304
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2068
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1820
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3492
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2464
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks system information in the registry
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update /updateSource:ODSU2⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious use of AdjustPrivilegeToken
PID:3344 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /updateSource:ODSU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix /RegisterOneDriveLauncherAutoStartTask /EnableOneDriveLauncherRampDownloads /EnableDeltaBuildToTelemetryFeatureSet /ArgPerformNucleusLocalAccessRepair /PerformEdgeNucleusRepair /PerformChromeNucleusRepair /NucleusLNARepairVersion:1 /AddOD4PhotosShortcu /DisableRedirectionForShortCuts3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks system information in the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5316
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe/silentConfig4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Checks system information in the registry
- System policy modification
PID:5236
-
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\OneDriveLauncher.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\OneDriveLauncher.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:756
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4088
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe1⤵
- Executes dropped EXE
- Checks system information in the registry
PID:176
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.6MB
- SHA256 7e5cf61863f858663fcde43959485f323eeb7dbef72964499a833c3124d8a278
- MD5 74065ed96f0a3ec052b922267dccec79
- SHA1 136c10e6fe172c1bd3620ed8cdb9c8bd95996fa5
- SHA512 1419d59afe1309d864a71405e52cfb49a47de65e1abc3113637efed1baa6269190f0e5f0c235546583f3ec29028c1749f1d52d65a35c1387959e463970885778
- SSDEEP 49152:yb+632BuPkFKRrdE6ohVstBhuXjfS4LWxn2HFVBYn6:U3q6OjBplzY6
- TLSH T1C4C56A03F29900D8E0F9D17897469122E9E1BC890B24A6DF0FB0B6553A7BEE45BFD711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\bacfjfjk.tmp
- Size 637KB
- SHA256 48cc3d82e6cf40ff2ec359e9da857f36c7e08abe39042e0bbdd6a5e66af990f7
- MD5 93ea0cfe93adf7c4ad39dcee6b4a49a3
- SHA1 d18047a88915fd9b1483ae732bd1cc3ad82ea940
- SHA512 33b43e7069ad6309254f8ff818153de17cdef9adeb3b18982234628d07ca816603803af3e5543ff852c43e153b50a9ea167c0f34a1a85e76c62c9a83fc780253
- SSDEEP 12288:Bmw5HEjsChNvBFgl0WDm+CBSwsoPgl2zU8rgYPYDQ2nt6vM4UQy/S:cwuKOWaSIw2zU8OnIE4Ry/
- TLSH T1D9D4CF0222DDC8E4D6A6643985ABAB35F7B13401DA11EACB4674F56F0F27350AC1FB63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.6MB
- SHA256 c0c8758f99e32b70cd3ef1a3cbc77880b3a3e0f1116bd871edae7c4e3969bd3f
- MD5 f9112fff0245ee3849a8f9adff974492
- SHA1 04e06170e66c505f23c64ced30d417b5224c19ac
- SHA512 aff28a140e892c4d3afa7af8c174c796fb5653f6799ef20dc4559a711ac96b2d3eeda8810f4c42d05b68073bf2d94691f116513592db57a4589763bc386776e8
- SSDEEP 49152:qB+taZ3usBWOBr4tEGy0bqx0z+n217aau1gl7DWDf:4u6Jmcxd2d7DW
- TLSH T1D6D58C13F399C0D8D05AD57B574A9D22EA61BC090F24B2DF0A90B2562AF7EE75B3C710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\Assets\Square44x44Logo.targetsize-256.png
- Size 38KB
- SHA256 f21d962c5327933d43c887e1d0531a116fb71cf0075126d9fd5eaa58447a055c
- MD5 2e5aa4725dfa1dd1b830850a67e91de3
- SHA1 f95890d18ba8f2553150b65d08df0d5a62685d48
- SHA512 9b7aadc90730c839c1a33ef15f9e87f69f57d0fe68f8e618269517ad9fd43d81d4f661a7bc17f3fccb174b6a15aa1265633e98a666ad9321572c76c0661db6da
- SSDEEP 768:1TybQFwVa0EWHLrrow7oZk0aQDTHYNbE52IFKRQHsaexuDDp+6WFt:V6Ha0tProw7Wk0acHdiQHmuDDp+t
- TLSH T1F603E1109E8ECB2B2B069EE295C24D120FD9B79D7CB6503D90D9CD669484AD03F327BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\Copilot\Strings\LO-LA\Resources.resw
- Size 221B
- SHA256 1f762fa2d859cab49e93ca9ce8ef24edc4409ac75de77dc8781cb06ae4ee7f3f
- MD5 19638dd07d7bb7e3429874af1375ecf9
- SHA1 17843afc8c73bdf38c81e86f86c01323010690c5
- SHA512 f2548e201d60cd175b5545607417716e3626f243f11ceb4e93770e07f291072a6e8a18f376e3d34d99eeb8fb135cd68d16fd37a3c3c1bf43d208be6f7da2e847
- TLSH T1EED0A710B9D4EC551476021B5C37504D99B0A7B41260B0193DE5DA473D51DD8A8E3284
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\FileSyncConfig.exe
- Size 864KB
- SHA256 d372971f48c04a4847f965799a863b7c11bacbdfd9731db3bc1047b0d5f6a294
- MD5 953076965707e0b71b26ec3fc8bf542c
- SHA1 97aa15ebc264ae30942a7feee2dd06651918f542
- SHA512 df48bf6ed0148d310348221504ee7f3c01002f7222057df29f629e690e05ed7e509b774c201cf33b21a3cc4cd5b480b0c3f33fec7d51287c84d09e580fccce95
- SSDEEP 12288:jlMjL1VQDCIbw87cNcu1tyAyqFtrvljBVdyMbvv7Cuj0hpO:QL1VYCW7cNcDqHrvpBVd3bvz70hpO
- TLSH T1E4154C1AA2A802F5D4FAD5B9CE974417F772BC060732D6CF02A1455E6F376E08E3B660
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\FileSyncEvents.dll
- Size 133KB
- SHA256 6e1bcf18ba82ac1fbf0c12953303c2ac8982c320ae2c33c9f0bec13b6ed9a1d6
- MD5 8773ac1a31159eae15b6a8bd77675a8d
- SHA1 16ff5181145fe94cc8dc1670833affe8a324446f
- SHA512 2165c8e4cd366602f39c3e967366e8411190be77f6be4badeb364c2f6fad394f6e403392476bbbf63f78c0c570bfac280645e5b3dba8a44155c679550d1eb243
- SSDEEP 3072:N2MxC/VIwgXGDww5fHJe8O6MFn02JsJyeH4w:rwGifyDsR
- TLSH T1CAD3395B736C008AE519C1BA8A97C947FB33BCA7076297CF13A4D71A0FA36E05D79214
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\FileSyncFS.dll
- Size 1.1MB
- SHA256 2ff676d95dc8b57ced8d66fa8dcda294160f85abecfa7544fc8adff97281d868
- MD5 5973a45ddd9265c3c524160b613c2dcb
- SHA1 653062811ba944b38d20b4891c1d1b737ad0cb25
- SHA512 551e163ad2ff2f41fbb656cda19219eb9daaec85d91617f0e6fdae983801b7cd3c13b97e26bd12e07a3d47e1b09e6d65de7d166c1b6eb04ca735b9f57c6461c4
- SSDEEP 24576:z6JqJXUUYTpLmFXyz1IXGr9QXh9UxauWu:uJ07YoFXyz1IXGr9Mh9U6u
- TLSH T118358D0BAA9D016AD4EDE2F9CEA78907F7B2B84A43329ACB03A5514D1F577D0463F710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\FileSyncHost.dll
- Size 522KB
- SHA256 152b0f0e85b5269a32e7b914e90fae95f01766542cc3e07e4925c27e08dc6230
- MD5 261df30630db60d55d7e4f195da407ca
- SHA1 8b110b5276d341d49f7d27cc7b3acae424bc366c
- SHA512 ba181f60527e42a847ed23b759f2b9400729cc1a9467d7d23b891074941324caeb6756e21d3e419dc8726059a00babc5111f93f91a6eb0781a8bdbd1fb42de0e
- SSDEEP 6144:gnQdaSyplxQ/RVCDwU/mL4mEDAZnbfirv5cvNMlRLfkmdAo4t37w76B6bT2nW8RW:gnQdaxpvm8mEDAZnOVMOAJc6B632ZL0
- TLSH T155B43A2AA2A803B5D1AAD2B88E674407E673BC194772D6CF03E1D55D1F37BD0993B720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\FileSyncSessions.dll
- Size 6.2MB
- SHA256 1a2f4ffed9e38bacb3446f4415788ad0e33a8cc2b1a73dc5f7823d9a1a92d985
- MD5 c86a71c691a4c74b25172fa8707ebd87
- SHA1 c1e77a7da728af68811b8036a1ba1b3d7cec792c
- SHA512 97ac193de57aa043b2e7c3fa07fff538491aff3ac1f8f11f967ed4baba68605d72ea1c0d66758c488f28c890ef676df9d15f817add3ea97fd3e2509c246b29c5
- SSDEEP 98304:+YAOs5kNrLw3K/XphAxGTqeW2TW8SDSFa:vIa/1qeW2TW8SDSFa
- TLSH T132668E55A2DC12A5C0FAD1F9CF07C417E672785B4332A6DB07A4EA5B0F677A08B3E610
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\FileSyncSqlite3.dll
- Size 676KB
- SHA256 35cb5b2d1adfe4cf0f75802585ab3cd4388b9f15431436e74ec3b68d542dc098
- MD5 3d00fb55d2551def7b768e1482d979e3
- SHA1 7a5d962ce4018062d6149c6f1c3e1ffe5bcf3413
- SHA512 f9e7b1125486c40c7bca6a741142aa654797c1a2d4e34403d3bd0fb204799e3a3eb9ff4ecf8b02364ac22143f0eb05f427f59805ab06a744b36896fc67a0702d
- SSDEEP 12288:Sxyj1AE3Kprite48VLZ2PjIMHeq/uM09CT71:S4j1AEaQ8VdIjIceq/usV
- TLSH T157E47D56A3A801BCE4679279CA574627DFF2F4053331ABCB91908A496F27BF11B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\FileSyncTelemetryExtensions.dll
- Size 1.0MB
- SHA256 585eb7c84f907b644879cf41e71b60e0513c04023dd835bf590b38ae80262f8c
- MD5 94e405fd50787ae025abab716773af58
- SHA1 65b7308c6e6db1592b26b699296a11100e6f1930
- SHA512 557e40ed451fc3e46f2093764f77023247e5c09cddbac370b23d77c21b2d8610c884c934ba61ceaad82050f1853ef80e2c83a5b98ab0bd5400b17d03cd0571fa
- SSDEEP 6144:KGstAb6HR3bp5BY1f0xvUgusoYmBdZHeJWcxrb9jZ02FXchXoblc+xjpOiUos2nQ:Kpx3bp/yfEvUgusNWgDZlc+xjpYY9h6V
- TLSH T14335842B99D7B7A4C5C88173E6B45E8378EC60E873B96072D66440208EDC5F192FED63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogUploader.dll
- Size 1.1MB
- SHA256 528989c07a4cb2df98c810a575a7b2d557c68b709572597dd12616d0fd73e819
- MD5 cea6a14b330d2f36202018af5e4151e4
- SHA1 3af204310a106f65bcddb3458c628c92af9a8751
- SHA512 4875eab7e6c453fbe0171ede560afeb1e5017f1cd344b0568484285ba928f71e2a42748c3e88df0e25f7531c16892a076b2348ff419073c42736ca856b24a1e7
- SSDEEP 24576:Y/9Vpap1qiEMyMsny4jtdi8/Ct5ICWQC/N/JN:M9utEMyMsnywtg8qtyNTN
- TLSH T168455D1A62E842B5C4FBD1B9CEA74417E773B81947329ADF02E1965D0F337D08A3AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LoggingPlatform.dll
- Size 698KB
- SHA256 28c6f76fcf2295b99d6656a138da2d642d3d56f2c87a6b884f0e0102fc20ad68
- MD5 bfca38a8bbef7ee899025a37b6e014e7
- SHA1 1ba300cd7c617f5d56993dd43150973989491452
- SHA512 cf66d8b636a97d7a52ffe4dd3b24ffa10c5639e49c6aaf9a56b0165dde9d981c10cefb8f5e167405593a4bf8e45591b553476af4735c48c1be8038b07b2c5eab
- SSDEEP 12288:JLGZKuHfxU1euInV2Ufa+JKnmg8KR3VBfWK/NfRJcnp6Iq:JLGJHfxUEtKnmzKRzO0JJcpk
- TLSH T1D3E45C2AA6A801A9D1FAD1B9CE934427EB73BC155732D3CB0391866D4F277D05B3B720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveMedTile.contrast-black_scale-125.png
- Size 1KB
- SHA256 7876f97812c78b2a6a6857b748cfcb083654b0df7a9968d28a337f553c9bb740
- MD5 37d99de37e5e0a880b1e7e92af4f2414
- SHA1 2f4383a6c27d03e37c27d55bf18c81f7e448df88
- SHA512 435584c224d442eedd0a2d92bdcf11a8263950e04f50d4b6e5df16cb96ff44447de8cca56de09cca163355c63d5695de72c4508496c534be2309dd9cdde47090
- TLSH T17521C6EF7AEAA97FE02B303A5A5111E2411F8027C8003D096EB866B16A7936092667D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveMedTile.contrast-black_scale-150.png
- Size 1KB
- SHA256 49bac30adc5e19520c9aef662bf6ab7f825d17de893f49f935f52bb58231d912
- MD5 f0a8471454b9457e787c5107a669704e
- SHA1 d6296385e16bf20cffa7abe0b626ef650474b869
- SHA512 1e81ad245b17b9f0a51cbc882f61fe852ef86b11af67fab70c21d248f1c6fae83bcf52ed9d5ddf19979d6917aab99bf5111807c028c5baec6b9b1f29f6a8713a
- TLSH T18431D8129635897FCF8D8771957D8D0562C3AD3CE75432DD1AE01A250A3A974059E0F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveMedTile.contrast-black_scale-200.png
- Size 1KB
- SHA256 06c80abf5996c0f80d90db0335ec7d77e756fbbea33e97b399e58eda97be5f77
- MD5 dd05cf58f3f493f7eb04faf889232e3f
- SHA1 8e03035ab0fce9dd0f18b3c61b43e612e393292d
- SHA512 e48727ac4185c289b572f729d0f86e51d5a56e504bc89a548f80337b417741e6c0a7cb1e3aa9ff0c784482b2dc034bd0eb4bbf08c8f5707c758f3ac70fa0bdb9
- TLSH T16241E9BC99CEC426D9A24EB2839C082274A63FC744A067941AD085820E48EB48FEC596
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveMedTile.contrast-black_scale-400.png
- Size 4KB
- SHA256 0048c2fbe78c434315a40c489a6233de3eaac4877d3ab3b87f233de97ef45760
- MD5 6cee6177303ddc4dc6ff243c4e066537
- SHA1 c35e27cbef07f2c29e95e677e637adb2a70e4b7a
- SHA512 0cada45d061bfa990265e3dbbabdb902cb2a3364564310bb611e6e4da2ab2b80910f8bdff21240c8fedd8e8acfcffa457d8aab19e443951d8a81c7dda8c19b00
- SSDEEP 96:9SNbFu3l/nCJnfP8ut2UriYSdAzVGh7AX5sg6:9SxFu3pCFHnlrieVcx
- TLSH T17EA15CC7249DF17BD46BA133026C86E8B8F7399487AC36A5967132CD4B135E5CE4D102
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveMedTile.contrast-white_scale-100.png
- Size 898B
- SHA256 d66500db2be2a08e1fbe3c25bfb3f8f92af7c1222ae01d983ff01f28e161a173
- MD5 9fd897bb6d2d83c0c2874f0bd977532a
- SHA1 d45a0a45487a3875b2ec53d5949089269f5a42c5
- SHA512 99a1dcc62612b7491b275158d98074a26ff5a04b685a76ce6d810fa3c184b940922b0012d6aacc271bb67e86670cc4ca51a2c2bcda41eb9871bb2b16f5904a11
- TLSH T1C4112FC4EE8514F9CA8A8EF754976B9112322B0DAB94661BB74869B855004CC090A2FC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveMedTile.contrast-white_scale-125.png
- Size 1KB
- SHA256 684f98e53e6508ade14997324ed729b2dbd54fc95ff0d0cf242a0af2ff87b296
- MD5 8e64cb13b83fdc456f799a8d468cd4ff
- SHA1 e781ed50c2247bd78f1f5c3aa1663b5e256d716d
- SHA512 d4c4a7a174c8d18b4803312f6506e80d3ea23643af7cf6a28e3f374aa29668bd17b6694637a891c2c9b6353dc4378fecda80344edba4844140fbfa4a0ce4dfd8
- TLSH T1A62118E5AE5AA118D8578138C55FFCF190272807A85FFC302F8030E81600B497E36FE2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveMedTile.contrast-white_scale-150.png
- Size 1KB
- SHA256 f1758274ecb3b62b6324055d6ebfe894fb022af30d646c26ff75245ffe07e97a
- MD5 fdd4e3bb210ea902687788de2582946e
- SHA1 3f54d394be273f8f7d179cff1b7238a454c561db
- SHA512 a3d564f0eb98ae266752148ff78bd8438f03f78002057baf1929349e833212ac82d73a99fa2d273ca3325e95d5a9be16f5c230373684782461074a3d76536d99
- TLSH T13A2187EF17D97C14C95B4FB9E67A7AB0891F2F0424114780481901E29E3D4414AD4AD5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveMedTile.contrast-white_scale-200.png
- Size 1KB
- SHA256 969e3c485b450ad929616ae0f64408afb25098a8e32993d92e84a6558d3ad8a3
- MD5 d9a0baf2ad9f556e02055b5df310bad5
- SHA1 89fd7ea535ddd01f332848e11db835be0acf31b2
- SHA512 4493b500563af82b955694793a19d0e1821162f6ae6abb8fbaa4f455a41b122db753696ae357c2dae81ab0018d432b791724847946feae4a612dc647acbb3741
- TLSH T108312AC61DA939F8D918CB32C8310D58B8C22B12453357C01A2D1DDFD9B0E8C47D64E0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveMedTile.contrast-white_scale-400.png
- Size 4KB
- SHA256 2167f453dec79f0f053913908fb0eb74b54342f9f298dffeee339712bae851e4
- MD5 387e0eaae22c86ef0f9086703675f546
- SHA1 0b216d6f6c570fd2ee7e214af38671fb3e9dc7d6
- SHA512 7620f497f4935317ef01cbc1e93f8396f7684f0a13d5fe08ef2f1c69450e8fe9fe9d26a0d0da2c42b685ad2293a84918a49a9e1af6c1438eea7d3d5f507ec863
- SSDEEP 96:9Sj1yh70iOWgmvD5xDUQX02WIZHt9cR5CX:9Sjkh7bpvfgU0cHtU5A
- TLSH T152914C9D079CD179CE662235D98A06A92C3F3CBD268A9052950BB0B305A379167264DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveMedTile.scale-100.png
- Size 5KB
- SHA256 ee57225deb5b003c11d84f099a3cfe378ada230aaa89c6d7fc6334a21ce7dc06
- MD5 ff1bcb9da494dc82c33d72d254e685f0
- SHA1 a53c1067d1c62d5af3fa940bcc10db919ac0cbab
- SHA512 891d8dabc1edc132a8e559e635a24f9b978462a43aa5b722b58a6b0fdc1ddf00b49de29c4dd00a42d7c0597a5c1765958844b80e013712da4dbc36414429b5b6
- SSDEEP 96:5SZElqpLKR080FknPAC4G08hfQu2gib3HatOB1ihWscAgd/M2veRUufqI:5SZ580FknPRt9xQww6ABsEs1gdM5Uufr
- TLSH T1F3C16D48822CDA4C96CD583CD792523D9B66FC27CA20409D6B709C636D42D8EDE4DD7F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveMedTile.scale-125.png
- Size 8KB
- SHA256 b3ce4ca2c3598012a7815108f0480bfb3b71b834995993a4160752a2577a3b6d
- MD5 be9a752781ffaeff9d8bbeed90d45b91
- SHA1 2c4e6f18b75d7dccd36a4e79003dfd75b79a2cff
- SHA512 1c75d936032ce23acb4bdd8ed215c07bb7763585447443d45f760a59bd961032df9adac11b13b91140e953bea72304020cb3a65862b90fb1873dd03c63127a75
- SSDEEP 192:9S3ifaS/VXPAXOS3SjNTZrqjQIbDBGSzx24piRvU3YkKvP94zbh+yc:83e/ReIroGCp2pvl4zl+yc
- TLSH T1B9029E14FBC10757C4FB767724C574B7A79BD80E6876AE2D7812E43ED089442090EBE6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveMedTile.scale-150.png
- Size 10KB
- SHA256 a285df7d2be2aad1ff4053c3a95ff0016e23051c48bb17bad83c9fb59d8f41d0
- MD5 2b84c5e76851a95e98b474aba8152fc9
- SHA1 6b3017777397b7157c27b8a4e1f8328c73f8bc05
- SHA512 e7e3594f2728d9960cdd020c69b0016a7adcc2fae76cae6ad27ff10d3708f8293c7a048af3b803fac7db25e32d81be4be36364b87c72611ba56842ee7eac509a
- SSDEEP 192:iaOS5WquttsnUxgluNgERWuqnpJ8knWFeTWM6r6FpKD9faobQqaI4C:io5WqfUxgcgeyJDn7TeUuao0qF4C
- TLSH T15322A0D998FDFA21DF57A17020B2CF8BDB5386480AEE96E8DF14369CA811CC86444E49
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveMedTile.scale-200.png
- Size 14KB
- SHA256 c655edecb76d1f95fc64c2742869e54d80f9102a0e0fb8f5824912b7a1f1d6af
- MD5 908859e57528f8057da25c5b2154f065
- SHA1 3d4c6cf6b05f267ea9aa43ba4a0c47464ca69d8e
- SHA512 fc2671d553e28d95e34bcef7ba3eaefb8796402c322d540c05be049ab5b45d5a42e021146535172cfbbe7b90e9205a7a149aebcc5616e70313a9fe10b9de77f7
- SSDEEP 384:bvfUYwHWjJy2c1DiaAeJyrliP23MIczfbTzofYR:rjNJlc1nyq2cdfbfoQR
- TLSH T18462BE80E2BDF934BCC75878E6A64F5B45034944CDC11B0AF964BF8EB289D9DA048AD8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveMedTile.scale-400.png
- Size 48KB
- SHA256 e472291a236bfad76c209b5785c329dbc094fbd70194c21cffd20fe32ab59a12
- MD5 0969de469e60a500eb13864d1edfc318
- SHA1 4d45041beca4202ad12bb660025d9b0883aba910
- SHA512 631df4c5b7f9356c2f57330cb62f2605b74cb22d470792c6653ef933c7603d89ce525c03f63ac69309209b1fa565befd60873f01668afc095918733722c0f550
- SSDEEP 1536:nLNY+lbWM/kXLLnecjWPSnK3q8dcUoqejbwJ0isZRN9/18:LNHlbWM/Kuz+4qUcUo1c0rZRbm
- TLSH T16A23F1E3547D873ACB60A9779ABDA0C77CB619971F71680D7A1238506B540B8FBC7023
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png
- Size 563B
- SHA256 5b9b49b6af48eb7551c3dd2a62a6a49ae6740b2b49010bb5b006cf85b4e54f44
- MD5 5b30085b5e50938bf98cb35640fb1c6f
- SHA1 a6f4ddb0368b532341e5046a1bbe0a4007f3f393
- SHA512 b75226fa58382975a52e556de1ed34e84a834d47a9048d1e6f4855702730a9ee78cf3d05b9e8f90ea18b81a57ab1763b15649d92da36626f5a803fa509f2412a
- TLSH T19CF096F002035D1CCF9FC2B71AFF53D7B25D52C400212C0C34923039982C0CAB10A550
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png
- Size 874B
- SHA256 37a6ca2212efeb34d8905ea08c81bd6f4cf884e4d009c245927618dd61e50537
- MD5 40060690ed4e89bfaa4cdf6b62bf10c1
- SHA1 8a501642ae3ca2fca8b5a9fbeb09642faf64d920
- SHA512 b1bcf0ad4c5db86479c6933fdc877df6291908677d1fff58c07d09b3afdc762f1ec42e34f5f3fffb2b42cdd79204a702d5abf97f9373b8a5f55c3f99283b621e
- TLSH T1D71186F39E6CF34DE96E68B7A486C095BBBD5B1761140105C8622E3D9051CCDCC42E6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png
- Size 962B
- SHA256 c191a3138fdc51ccc4eaf8979f44fc4cff3ab96593e21371845cd7967971efbc
- MD5 b5c1fe27b4496370dd116258600d79d3
- SHA1 a0e4573c1e8dd3b9c711e2ef60ce8fb90c2c51b0
- SHA512 4b649ca9557a66a1e2a859b7ef2eaca770004d5f2a030228c1579339dbaac7c23b23537c0dae04b2c7736c6a1f7bcb0b4ccaaa2e83ed2ad3c3e4bf2b73d6f446
- TLSH T1201184CDDB06B8D5C1059F7A50232DB2F1270F9D2F479AA37BC608005B6989996B1E24
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png
- Size 1KB
- SHA256 ee2b6b8103ac0dd5ad593e6b5106df0e8e5f1459682cfc6349d803c5802c2dd7
- MD5 94f7df106a5a9d491c28101f5b729e70
- SHA1 0ae47dbafacff9b6fd0119cb30d5d32236894bef
- SHA512 2922593a29f11675d4d3ee0d78ca3e5fea92b8a151090afef293f2139f39c8fffe0a585f83ccf7a5800ff5cfabcefe834e4ead37b511746c52a729544e59c170
- TLSH T16A211A9BBC583EB0C57EDFB60B99FC7103030AC4018868880D0BB4AA1272426AB43701
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png
- Size 2KB
- SHA256 82d5e6a7643d34d618c7fd2cd38c63a360230a72211619c2ca8d70514b6eff6b
- MD5 70bd5f9c5c78011d2a39d358911909e3
- SHA1 ec4da9b9eac67be2483558114fb768b68f6b1a08
- SHA512 015aeb96f0e8e09208d71e35fe2ff487ab5c583d0d9810012a3380b88eab1a549faa63b5a14cdc1397caa63a72edf3bdcad78b1db5594f3e293011d37b1ddfb8
- TLSH T122512CDC5D2321F6ECE188B8842EBD40BE5358F48E271401A4819832D579E51DF95C07
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveSmallTile.scale-100.png
- Size 1KB
- SHA256 1c1975f56416589fd0aa9add4c44a87c5dfd71ca365630e40e9f64bde6f0e49c
- MD5 635c7e6f9c9a77202ca96e8c68899321
- SHA1 0dbc327ae14c76fafe2d5fc860eec45a7414c974
- SHA512 cc7a8175fce47f3db218a9279d244d7f1391d56fc2d7e3603a558baaa555ec7d84ce27dfc5e581952a7f76d65c2ac4c4bf2b1b28c8c41cf84db84e0e4ee691c5
- TLSH T14531089FC22D50E5730F6E8F8C7F8A411897E3740287B10AB5280A30283BD294837ADB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveSmallTile.scale-125.png
- Size 5KB
- SHA256 46a6e452b5bf41b9ae867aec03f38bc5970b6c8a3128387b0b4c75cc203db9f9
- MD5 3c81de4ef5b1d3aeffc440404858dcb9
- SHA1 90486aeb79d47cae3d2c143b7436a6b1844d8f91
- SHA512 001f9e29105e6730ca04d2ab198456a59cb3c47f83b3fc408c804789801d4760869331b63365c2357fc5e8540f79c18481c4e6696dcc4716d9fe50406eab686a
- SSDEEP 96:bSB/bHKj+BNstFqpL3V8voyrt5N+q7SNvhvhqkpX+kes5YoXD9Oc/:bS5Kj+BN37Sr77SrpqO+kesvXhOc/
- TLSH T1F4B17DD230610ECA83CA9570B16B7421EFE62EC90152C1D18EB36311DF67695CFF5766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveSmallTile.scale-150.png
- Size 6KB
- SHA256 4e80205d7bff5c25be88be6f21ea5e32a2edbf115cdf4f26751f2a24a3d5c3d2
- MD5 14ec3144f6e63b10d1a5f84268c5e634
- SHA1 d0a2668cede02a7bb7e86ec081ee0730af01e98a
- SHA512 2f21b1387d5d33a0b42a2a793c432d24a17b6d39db98f6362da45885d38ce6c9a6af224d99725c1754534e950d05c56b5944b720dfa8ecf067d166605b23df25
- SSDEEP 192:tSSYIgYD/JzlAbIvvfIhEWuLuAM9dzOrowSKwe:srYDJibGfp/rok
- TLSH T1DBD1AE909D4838D87BA669928237676354C83CC635A34FD8D04CF3C51E9D299FE91E71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveSmallTile.scale-200.png
- Size 9KB
- SHA256 19d6b52f75aca670c722499bf04a6de7eb9eb6cccdc78f489a73d72417fcf478
- MD5 1499cf8f813f3c22dd0764ef4a695367
- SHA1 2ea9b463553c5d97a33832ee46b600f6d3640620
- SHA512 0fc4d5f1b21b608205f082a19aabf816cf503df1b8650fcc83a3d0d208b4651bf999afb0927b4d3a248e501aa656495108c646bdc073839d88ea1554e70d3c88
- SSDEEP 192:OSJRFyoZ4ZzqBpnJa42GYFmk4iQ14eFFKOl082BYpKTK4odOHrEN06WPBS:xL31JKGOpnhebpl05BY4TVoW4WPk
- TLSH T1F122AD4653BB7182A092A4EF351385A504F10EDDCD8945B3DC8478E39D8E2CB25BA78A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\OneDriveSmallTile.scale-400.png
- Size 22KB
- SHA256 ce53878af8d98b9e2e94374841d4be37c6942e6bccde660d05b86d051ef5f078
- MD5 8fe69f9883b3959993c5069c8612ee57
- SHA1 9bb5a5d31cb99039e8671735ef6130dff7be9f02
- SHA512 e6348fc499af5a5aad8cfb2e1c0aed8644afbd91a19ac671819f4e8f060d33fef0153eb19ce773c979e15718c8a3e857922163ada71324496fdcd88558548d85
- SSDEEP 384:w07l8gzGyVUmGiQKyz0uPLXt5mQUl2gEIusi10jTnanX3Ucym1pHs:NewG4BQKI0yqZ2IuHMsTU
- TLSH T1B9A2D0A969E4D89F1D05721F0737997EE13764C860317809EDD8D7D91632A2BDE10BC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\LogoImages\Resources.pri
- Size 18.1MB
- SHA256 2d9961faa1b5b8018f803a74c8e83c0036eed830fbe70fc9c57320bd8cddf1cf
- MD5 4fbd1578d8beef2787c69a650c6e18a9
- SHA1 51c7bfd3d23b7aaef7f6f9fa16f816714900c7e9
- SHA512 ab82c867dad53c2c839c16f031d97ebe9ba691be9ae0d9aed6370d34cd43594330f8167bc1e1a2dbfc99848a30aea5f6d3532590a263d4248db72319a26a3f00
- SSDEEP 49152:8a9zdQxa21dr0LOCd74LBd/HEw4EHrEe+fr6ykfrZpTXj2qOkIqcj5g:8wsjX
- TLSH T13F175301E3FB0248F2F36B717EBA496598B7BE525930C07E42049A4E1B72B855BE5373
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\Microsoft.SharePoint.Calc.dll
- Size 913KB
- SHA256 294611ba42ace2c9127df073ea66630095cb8ad93f621f5e5476368e53e24595
- MD5 29537bad43217a2d7d3fdbad0492c4be
- SHA1 06ff5fa0122aa26c7706c24a31d387308af65674
- SHA512 a2a43edd8d03985829434b221ebdf79e9906b5768459663493cc4b34d901a39311c242aaf4c8684e8c73c5c61c1f42dbe481d1ba2bfac17706c4d0d95abbb6c9
- SSDEEP 12288:p8WCtV5SsZ1cVbjOURbvJ4J+uDvRGeo+BlSglLKhJkHgZBe0I7mqZM:pUrSsrKbjOUwzR1tlSgEJkHgZCY
- TLSH T11415AF0EA2AA49EEDC26D13C8557850BFBB17411971087CF06A4BA9B7F2B3F01D39719
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\OneDrive.App.exe
- Size 932KB
- SHA256 a537a3097357b19c33826ec2ee01b352bffdbf3a30ee20e17fa9cd69f9dac1eb
- MD5 002ac1c8f5415c84a6c5899f8b4e8aca
- SHA1 3f214e945de55dc0223ac4332977493683a82731
- SHA512 cc1836bea2da4a25932cdc42d1a5154df5916d5359d3783df8e3cff94f7f5ac51b99eac76f3dabae35b7d336cc88c16dd39876abfbb63002656ebafb61cdce2b
- SSDEEP 12288:MdhUuAKmZHkx3lkynnjKUZS4UoMs2Jsbb1nTLgoA:MdhUNkxVlnnjKUY4UogubFgoA
- TLSH T182158D1AA6AC02F5D0B6D278CD925117E7B2BC164732D2CF03E1665D7F276E08E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\OneDrive.Sync.Service.WebSocketClient.dll
- Size 1.2MB
- SHA256 d3dc819b57ec5822ef012575ccea9c5204bd5d28c4b0a2421558bd536a54742a
- MD5 6e4931ad5bb0a0fd34ffa1e0bf7a907c
- SHA1 cc9020b9c95adebfb59cb96804f67c047c0b1620
- SHA512 d54e3eb1f0001b5a1454c710662d3ef2461b193989fd9ef3d5b8f7a8679118898547e307e07d49e9833c6f31cd6c958cb4f348acf61478d143ad5e5541a70c0b
- SSDEEP 24576:IzFEfIV1mMzhy1qU/sMbyNhqiXf4uQW1i2srOxm3+kq9WHETwpJWk5r7tmCjRagC:EeMzhy1qU/sMbyNhqiXf4u91i2srOxmo
- TLSH T18F553B09E1B851A8C0B9F1F9C643DA8BF6727C56C32993A312C9D3552F57778A63E302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\OneDrive.Sync.Service.exe
- Size 936KB
- SHA256 ca064a480cffa3455cd745c87d57480b0663b902b2906be16a6a2b00c974c37b
- MD5 b1ec7e79004d39ccdaa2731d726e2455
- SHA1 c7baf899fe65ac756c316c7d34223b8b6601066e
- SHA512 31b79e45fadf54fe67162cf4033bf7bf919dfeb6e6b69cb440b8c02712fc165bed965c0cc47f064482fe730f2e566e75cb41f588a0bb89995e280b1b99f93a48
- SSDEEP 12288:f0PMpwtZIFTirAKaTto10+UZ7g3KOMkpn/aWxlL3vgotM:f0KpFT4A7TteUZ7QKOTyWbgoK
- TLSH T14F157D1A66AC02F9D1B6D278CD965117E7B2BC064732C6CF03A1569E3F376E08E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\OneDrive.VisualElementsManifest.xml
- Size 344B
- SHA256 d21077ad0c29a4c939b8c25f1186e2b542d054bb787b1d3210e9cab48ec3080c
- MD5 5ae2d05d894d1a55d9a1e4f593c68969
- SHA1 a983584f58d68552e639601538af960a34fa1da7
- SHA512 152949f5b661980f33608a0804dd8c43d70e056ae0336e409006e764664496fef6e60daa09fecb8d74523d3e7928c0dbd5d8272d8be1cf276852d88370954adc
- TLSH T13EE02688B16841C263D369B5643399CD329D329FC3C905C296A145B62154CCC4D8B18E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\OneDrive.exe
- Size 4.5MB
- SHA256 28cfb75a00bcb7f15d3b946d2f0551dab7cff6cfda02ef6eea217002c4668998
- MD5 77582fb8b9811edf996fa0a3df74db9b
- SHA1 3308a8b905610bbf6ee7bb477081f96597d36a1d
- SHA512 04b95b6210b2b323448f3da0ed16c686b3b6b67ac384eea8de6b1f07b8c9f213ff77aa20230cded0f7e407af466429772ed37363d776ec3df7d4afde66415f4a
- SSDEEP 98304:5thpwBP/OlsLzFmNfW6FJKxxfZA4AnyxpELRSKE+R1M:zGpELcoR1M
- TLSH T1F3268DC6BE88F5E4C0A48834B906D57DD673BC7A8E11468732D7FB1F2A37180552B92B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\OneDriveStandaloneUpdater.exe
- Size 4.2MB
- SHA256 1ca02de474bedd28c00d6329206d4d88796087c35dd1f5e55064058ddfd6843e
- MD5 12e6c1d319af0fe20dc57fe0ceaa530d
- SHA1 f610b1109e1b54d6282e66c1aa65a7b9f007955b
- SHA512 beb2e2afd624a25e5a8ac047736d2bca3f60619d1cc6988edf6192049b6cc47c0bde862dafcb01d0316cd48ffecb4127cb6e477e780d96ecd5eadda1ea4dcb0d
- SSDEEP 49152:1W4auHCFJxXD3fc+Qsa6wVl2/MfwTK637+72cfp8VRs9iT3ama:UkJOy7dwima
- TLSH T149165B4AA6F900F8D0B7D27A8A679517FAB27819873197DF0751471A4F23BE09E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\OneDriveTelemetryStable.dll
- Size 2.3MB
- SHA256 5d100b75719ee43da355b0cbb70ba775894cf722bf602152d46521f1a3c09ba1
- MD5 f2f81c526c8c703a29fe1d2f75c3dc57
- SHA1 00c65e2e5454ac6dbb28f0fdf6e44c45bac16e07
- SHA512 32ccdd29346a99a2a72750968a942570bb1c98fcd40a79a1a9275561126164469cdc79c4357f31b50099123c862d556d2c1e48480d4618f0232a3afb9db27951
- SSDEEP 49152:P3R+A/D7kMFXnGaXrcFuVQd7Uvck7tTrT4GtU2F:9k7k7
- TLSH T1D6B5495BE7B941E4C5BBD13C8A53A617FAB2785A433097DB4690564B1F23BF09A3E300
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\Telemetry.dll
- Size 1.0MB
- SHA256 f52b160593f92f166c0831f681e182c82dd849e11047d03a07e83dcd593780a8
- MD5 88babac07509220229206a6a1fafefeb
- SHA1 f4272ed9c92372b717fafba735f90fd6ffff2925
- SHA512 02431caa2cf4c76c7f92a57b35d09eb0ed3c18ef2f48e7f110a7a48a608fb2cd96751517b6bcc5e25c4f957ce172148216a3090a51cc24ae9e2e299db599c2a9
- SSDEEP 12288:v2zuK0qz8rqGFRvHyJ6kAtZ1b+0Eiqif7nTxNReyqgzWH3nOOY:v2zCqQrqAvHPZ1bE4DnTxNIFfXOOY
- TLSH T1EE355A0677A47FB5E19BE0B9E6720007E1F1F4385322A6FF45DA59280D27AC05E35BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\UpdateRingSettings.dll
- Size 716KB
- SHA256 8b9e473cd8214b8a9065b86bcd8402b2bf701f7ab97a3522e49c322aea155050
- MD5 911689f722314d85c8314d38cedf8900
- SHA1 9e0974ba63ec16990e2df315cfa560997afb679d
- SHA512 80f9c8fb45906cf571e3b53536166a74b51d4110ffe7d72e138044ca35c6901494f4d88b1a926a524657ee902ab6749750d7a8b8aa276f72aef1fe743eea7db4
- SSDEEP 12288:5OuIqlyBmMYdn9CgjzDDTUyH7OCmCwXcbguLvD17cp6j1ET2Bu:5pLlyBmMAnbf9OCmCwXcbgaJcp6j1ESg
- TLSH T19AF44B1AA7E802A9D0FBD1BD8EE74417E772BC255732D6CF0290966D0F277D0893A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\WebAssets\static\strings\nso-ZA.json
- Size 54KB
- SHA256 d68088896003085a06f3080e2408b86055fc487adb29b2212263cc9c7046cb87
- MD5 5b5a423b9d52113f453fe2f2688be2fd
- SHA1 eede553d073f718a429dc6f1d5f5d5059625e855
- SHA512 91dceccc519b412aaa93aacb4da15edba34ca7a6eaca0ff0c437d4c566429da08c6bf03f480cabc9a1a8d94e12dcfde8b0414c47e2d71d2a4a204f77cf4abf8b
- SSDEEP 768:H1+oJ0pnI7d+hjIPt3ByUsMmaFyBTt+vF9KEhxY:Hb0pnI7Ih0/yUrIJF
- TLSH T1FB43623A9600497B00E5A443F99554B235110F2F6380706D3FEB722E63DEA9B71F7A9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\exif.dll
- Size 255KB
- SHA256 b413413a561bfe3f5c98f66996284503e9d75195b016522dba8542bc32d08e05
- MD5 523feac9e1ddc693bb11dccfb17bd260
- SHA1 9a7487542dbe966d6e03b93d211d2352861c5310
- SHA512 7a50200b0be3abee4d96441e1c1666f2f88bd1f83f15b9c119a091a9cb68d85b03de3d22b6cdd17bc9567e16c4de10c0229bfdb064919b9c2dc8662d046b04a4
- SSDEEP 3072:QYexp8QhUhUpmU/4D7bJCOPvLCKkoOrzmVxGpx:QYKp8QmhSmU/4dCOHLCfmVC
- TLSH T17D441847B7801D73D94245388A9B4302A3B0F966C3B2D3DB569841B8AF077E69F772C9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\msvcp140.dll
- Size 530KB
- SHA256 90e6319e6f0c09dc1d740bf9a0904c6267e6be17b48c5758d1d17d00bd334ea4
- MD5 d178f95eed5a685ae81be0dec819e77b
- SHA1 8885a63bf78ff5f59fdc1eaf094d2dfa87b2448f
- SHA512 31e4cbd9d234bb5e563188933eafb27d76cdf09b59cfc8bfc4e4c9636fbc1aac4ded28d6561109d52c2e61ce446142eec56ae1757713bccb6d66c0c3c0e75866
- SSDEEP 12288:a0MrE03u1mHWV/I3HVbQEKZm+jWodEEV72:a0p1F/IpQEKZm+jWodEEN2
- TLSH T168C41A23F75906A0E195E3B8A1838702D7F1BC598323E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\msvcp140_atomic_wait.dll
- Size 37KB
- SHA256 26cab0a68ddf1b39dca5db73041f82b0964086638908393c0fa4139f78121216
- MD5 699fa8eeca79b1f23378d1a4135450ff
- SHA1 61c4254a4870b3a5a773edf7b1f4c2ac5b8364af
- SHA512 21744e77c88812d38690e7efadbaec37621fa1d73ff53e68c469f374a18ced11af894e7f9aba470a25ff1387bcd25105326dc868c2e03147678a769858b10a1d
- SSDEEP 768:3PMo5RIqKYwIYPhpLSQl4wFhGbHQD9s9zoX:EOR+lPhQQl4wTGsD2zoX
- TLSH T1D5038C45A7681082F5AB8735C596A61BE6B6B7E14B10CBDF1361E24D0FA3BC0BA34B14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\pa-Arab-PK\localizable.json
- Size 4B
- SHA256 e3566b3a06430868d71e9287dfd6c6c520a3da027aabea01951d407ee131dc2f
- MD5 c443b04d0fc26b0a5a4573a78e0082a1
- SHA1 3c957535345645dce7190b85eb10b39da96b2518
- SHA512 7bbf6dac485c9e59d02edabc91ff5b15bc1319cef6905c0077ee16e3b1f572b61bff85f2400bc0f5b4aeab0260bd5d68787d72c7a688d79192952f7957a44de3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\vcruntime140.dll
- Size 110KB
- SHA256 9a5cb8451091f9709b312ca913f9304055420639d24b38c3be505e43ecda2856
- MD5 56d1f2f6aaf1a17b3c8b7829746fc3cb
- SHA1 86b6e572eae7703fd12f6b079fdf3327611d31d3
- SHA512 dbb9260e3a48f48d0f1c6888514f7eb033c6c6eee8d9579a675dc14f9ac3c888da529cf9e56f89b8c3fc9945302a55c37920cafde93fc15f43f336ea5ec3f052
- SSDEEP 1536:U9pCUgtBAVcxStMXcfG8VwfmpcGLOI5EvMvecbeQ6N7vCVBzo:kyA+3EOfmpcGSL8ecbeQ6NTC3E
- TLSH T1E5B36A0272B802FBD16ED278C2929E67E7B6F40587609BDB07EA46660F63BD05D3D341
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.106.0603.0003\vcruntime140_1.dll
- Size 36KB
- SHA256 1e0956501bd4f45f000664986d491beba2484450bb2cb71a3ef59b91e741d7f1
- MD5 3f8f18f131ff711b6bc98405f1228061
- SHA1 e810a87904dc51c9cb62829befbb3ba7cdb37968
- SHA512 03d7a3791a2093ef7288320910459897d04543ad354aefd01da6a5158b8c3a65f9ab3e97eea6e505568686bc228fd564c9d3824a5ce204c3666247e48c541216
- SSDEEP 768:/ezSkbhNfI4fWLZySXdPWDcbqrW0J9zwkLFF:sYZyqPWDcerhzw6FF
- TLSH T1AAF27D52A3BC4082E8AB89B0C4A75F17FE39F69157B093CB1BA4850C1E577E0A73D316
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Assets\Square44x44Logo.altform-unplated_targetsize-16.png
- Size 621B
- SHA256 80dfe845592c4c792bb736a7b9380d54ad6292fae1308875d070e6dc6e20a668
- MD5 64860c5876510cf734893713bcacf50b
- SHA1 23b3759144bdb4f84aef7bb0331db6d868f802fc
- SHA512 579c5fd6f07055d44a4e253cc444a3cdc5831e9a2457bb7951d025cdf30902e4adc94b9bfd6f59552a9a4ad256d73eb181a87c0a5f695b09702f5ef45cc54c67
- TLSH T1FCF0B7C33B1E4E3D112662BD2522F0203A053145D8C3981D2DF0193C21ABDD8333C136
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Assets\Square44x44Logo.altform-unplated_targetsize-24.png
- Size 850B
- SHA256 9e3dae2b04102df484196b643481e56f3161738abd07704d78645a66c95dcf51
- MD5 50ebea0afe3465b042ac11fffd81659b
- SHA1 acf210201441151486c527f78723b6d0515303ba
- SHA512 2fdb2c6e04afde0f305ab52ef5305ece4e25a80d7efabba2f1b545ca136765b1a348a99c53fd2607f45e03d074e0829a64fcb372c65e63a83928ef1f79776219
- TLSH T1C501D60B73FC0B3CF82B951B046E033F84393F6411007E0EC83888A52A893CC4894551
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Assets\Square44x44Logo.altform-unplated_targetsize-32.png
- Size 1KB
- SHA256 eae215018ba49f49e415687d5c6d9e5f007b048c52580e3bd53ca09526cf2130
- MD5 0913b5ad0ca9d2a6283407ec3b524efd
- SHA1 0aabf4fa8eefaf5a1cebee656d5a5fdbc7f18ab3
- SHA512 1c5995156cd02479e04c0963ccc55ee343ad9e67c7a9f10730feaff6ec89e6e1eaa1c94274d34286356cc510b2b54a63322355ce65a851413c9f6be23a5210cc
- TLSH T1AD310CFB619C7E140E3AAF7F011D74705A573CEED92D1058A381558984B268C3CAF25E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Assets\Square44x44Logo.altform-unplated_targetsize-48.png
- Size 1KB
- SHA256 dc641d18ef29b8b2b04f77db9d33d7d34262007b59a744cd4f3ab56cea5db90d
- MD5 cd8874063fc8e040cc2be1006c4445f7
- SHA1 0c89a75881cd436c09d5a3badc9fe7f3eb2bba79
- SHA512 c7dcef9c112e193657776cae70b20220a22cd038784482abebb69fc208735224c2f48e3de65849b4e7add8b42eedb2e98b74a95fc91fcb4df611aa8e15692565
- TLSH T107311DF28A527F7815F3EFA721CBDF4C8425AD5426723834A44B6CDA107254F88EC191
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe
- Size 875KB
- SHA256 dde22427a05c07a0d55087c7df6ad53c8ff7415259b0ab448b82cd9f4add4d25
- MD5 831fc57ab926b794b64cc05bcd75ba20
- SHA1 3e537b04e2731aa4ed8a88c318ff1f0f08d19337
- SHA512 03319f820ee5b3b795e9a980e5f389abef941f741051378a26a2df5e36c2badafe61e05f0c4b6501c0e199d96ea32c35813aa0c8ba09c64da2b4c75c3b5efdf6
- SSDEEP 12288:HTfaTdMeNH4ZQT8jdJ+JnpVqqJHtx/T4QlD7uTPvaR5JN:mTdMeNHM0sJiJHtx/T4Ql3yaR5JN
- TLSH T115154C2EA2A802F5D4FAD2B8DD975413F673BC164732D6CF0291455A2F376E08E3B660
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.App.exe
- Size 936KB
- SHA256 1609cfd28f2109ef916df91bd1b3c66ab0bd9410fd78378d3369f3d7e14fecdd
- MD5 546c82b87750c8ebb4e815304f1eaeaf
- SHA1 675c4501f46c78468243e4bf0a7171963b0280e7
- SHA512 c4c18263771eceb06656389692cb9b36737f4f0e731a433b75ff8ec00fe415b699bd093a59b339df9d21a8b9f1b18b6691828f5ce74828f830b768d0e1f81d1a
- SSDEEP 12288:WTF9o2gRFYrKzpVhUgE7ChuFsW+cXBLheV4xuzjTQcQNsgo3:WTF9oB5zpnVECImW+aBFee+jTvgo3
- TLSH T161157D5EA6AC01F9D1B6D178CD925013E7B2BC165732C2CF03A1665E7F276E08E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.exe
- Size 4.5MB
- SHA256 7c463800bc649ace581d6e212c3b0d5a0e06a0bbd178380dbe0bcdffc0ff4f69
- MD5 17849c13d0f0dd0fb6091734dca92bbd
- SHA1 4f83cefa67b7a496251ef2531e970f3d8e065431
- SHA512 db6c4597288ac61767b16c91dd7b6839dd7e51674ab9c45915d291d063eadeb0315db815baed789a116a2212ec5f7c26075d800441bb5c9c1164ec03c28026b5
- SSDEEP 98304:A1zhpwBP/OlsLzFmNfW6FJKxxfZA4AnyxpELRSKE+R1U:IGpELcoR1U
- TLSH T15A268CC6BE88F5E4C0A48834B916D57DD673BC7A8A11468732D7FB1F2A37180453B92B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveStandaloneUpdater.exe
- Size 4.2MB
- SHA256 e147a6284cc158ffcee9f473ace8645c03edea779df49cfcf3c7353783f53f70
- MD5 13cc6a05bbf6439da45411defeaffa47
- SHA1 37d0ab300eb137e6eb344571611f000932bc6497
- SHA512 ce0b39eea88e2a0cd59eabc8faf58678aea7d43e5f37e5653000db719e578000c392372d55e7c5f6a51f923a5556af4a0bc4bc429279a79ea396ba79a3108177
- SSDEEP 49152:C72RdzL73k0UziLUBimCbPw/aRGVoA+965Kc+UnT6yTITCHKjIFi:uq7AzIg5AslYT
- TLSH T131165A4BA6B900F4D0B7D17A8AA79517FAB278198731D7DF0251471A4F23BE09E3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\WebAssets\static\strings\pa-Arab-PK.json
- Size 69KB
- SHA256 883935f86ba5bf1c093b97d2258d4717d71a29198aea0ebb24ad5e2a4131e71a
- MD5 2e28faa92e09657dfafb5c3643cfa34e
- SHA1 2a5504a927ccbfd9e90ddfd60c8e342b0fe461ba
- SHA512 f2237a4341deeba66507bcd0f9325f42b63226b9530866db659b517b48f6af7ce967a7e14835e81965bfc0aea2ab57bce28fae4d8d8be95b9bf71e0af5771116
- SSDEEP 768:zjQw4Yuoo06n/N0QjT5RXVnvP3Bq1scmwyoN0Eyc3cdEwlvFIDEhxDy:zD806n/NFjTXXxBq1P8pc3dwBy
- TLSH T1A163A32E9600097B00D5A543BD9554A235100F2F5380745D3FEBB22E73EEAAB71FB66E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\pa-Arab-PK\od4-localizable.json
- Size 179KB
- SHA256 ad8093883c02f6cc218bef464ae500cc44490212511884336964c8d67fca7365
- MD5 ee62f84aacdfd1c172e3b948f16ab356
- SHA1 14683dde72e5fae1cd63d5e37b9b3fc05a6fc45a
- SHA512 9914a5ba0031a7eef00d163e157bfbf52472fbd00ca2fa564231e192e8d3cc38289a7ccac858b339e072a7819fab5986cac1ab62d4f678017cc6ddb2b3c39756
- SSDEEP 1536:fmsUN+1P0I4NkZ8mDo8EL/BX000pvjWLXVZJ9kxlu3v:+F6Z8mHEL/BXsYYE
- TLSH T12D04917BA1808B7304316253BD4D19E277120B5F42B28D9F34BF614D9286E6BB3A77E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Business1\settings\Microsoft.ListSync.Settings.db
- Size 16KB
- SHA256 8534b5bcf3b4b5daf38364eb173ad1b2196c44529d9636685341a7a6b536ff0e
- MD5 1b14d25db915f18decaba10e453bbe85
- SHA1 e7e0f98bcd5c702e531d2082c177c5a48f8c5e77
- SHA512 86b7ae787027d6524bcb4a849bf9e5243ee9a359b8c8d7d058ae4a958fcd2b122577a56edaad16b591fcb55ea17b2b076a6825540989584d035a158c258378e7
- SSDEEP 12:TL6bLwMGdymz3biyyZO22abBX1tyubJQVrCblq:TLRpRSL2osu9lq
- TLSH T1DA7224A3421489BBC125077ED46343550735160E6325CAF7B96D101B9F029C85D272EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Business1\settings\Microsoft.ListSync.Settings.db
- Size 16KB
- SHA256 209a634cfb7fc0cada81b0f8e1336012bb72effcb16baa74dd094981dce6063d
- MD5 e6fd1dedffedeab59c178c8acf0dc9a5
- SHA1 ca8670f57e44a0f3e0350d0ffee0d7f7be224bc2
- SHA512 ca5b9c83d16ed923baac57c606ed73685b9dde7be7c1054caab70730ae165dd3921d6ddec7101095e3a5c4ea1c733c766b93afd3f5b0a0c5cd65e40ec35a6dd3
- SSDEEP 24:TLhpRSL2o9tcypEYjAd6hpdXYQwdMFudMAuXY7XVXlKlq:TkT9trK4AAXdXYzdMFudMAuXY7XVXlEq
- TLSH T1A472DA539316A8B6C5490A3DB4FD62804FB3060B5358C5B77AAD445EBF01BCF8E2709E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Business1\settings\Microsoft.ListSync.Settings.db
- Size 16KB
- SHA256 e687d2d8c4ca5a31d59b37a8c55897e73dbb58bcc37416a3bf32a8026c073343
- MD5 73755f8ce153a0fdd512b5e56d6c0fba
- SHA1 2c11e4ce5a772187b4fcd5b1f0f882d9aebc63c4
- SHA512 c5c03bc28da6918149487c7ce26810b3fd8dcbe7a3f3d0b624b17aa80681bcee7f098b39167f1a67a87608ad148692cac1f6ccd20ee65c8b59b77de211f59098
- SSDEEP 48:TETH5XYzdM26ZTzGUP4mCwXYq20n80VuAFXpqlpN3X7uq:E5XKdJ6ZTp4m1XZZluCXpqlpN3X7uq
- TLSH T15E72F093A753B4A6C1694A3EF0DD26809F3311492358C8A37ADD040DBB007CF5C632DE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.ListSync.Thumbnails.db
- Size 800KB
- SHA256 2a99415a0b8def9a1b31b3cb56a4cb0d0c107959b79e7123e133a5e3636c2b40
- MD5 85e47dc2aa42ea0ffe7c938c91319c35
- SHA1 f0884fc4a53914f1694ae2533035617510a06f91
- SHA512 6e3ed109a9fa49dcf0469dacf8b426db2698ec2591c9e40be6e3f56a9b821babec8d0bf3a2f8c78b296e4ca0edfc54fbf545d73d73d9a749aa0ef0fced7bab49
- SSDEEP 96:DcVm5non0Ia2ln3n20nunnZQns1n7VHRfOJJnGnGnnWnOa4Arzo3CnzEd1n7zz:3VsdJ
- TLSH T17F05EECD2E006B01C1A25170DDD35A1A7B39A76F0752AD9A3DBC1031CF6929CF8B17A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.LocalContent.db
- Size 336KB
- SHA256 f8c160aa32e9a85bb1cf4ec46ab4191ed34b255833404de1c2a537ef561bc5c0
- MD5 b6971680489c8815700ef129d73861a7
- SHA1 fd6cab15b80fee1e7a187d7498abd9ad93049a6d
- SHA512 bb8efc904f8526f13722fae27b808960db67925fe25dd8c94746dbc5b30eb745f7b75d21eb960892acc5671b446fa3080e915aed384931bbf6b505e3de340e1b
- SSDEEP 1536:sRNKaWfGAkqYBOrUB6hqkvVf3Oo9OORO8tuqTmRVrkECvQwVkDmUkDm6kDmbrJY1:+NKaWSlHoR0S8f
- TLSH T17C7440A93641F23AE8C977B1ACE2C8913133B11F4D62CA51B8DD15049F476CE9E7E6C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.LocalContent.db-wal
- Size 28KB
- SHA256 ddd5e98800c52973be2f5a566d25c9e56ae2399be07612e40d470e870be2b240
- MD5 31117b527a8e18719a09178b4db45eef
- SHA1 bcb4ff9caf28866a2d2d5cc04fb5e18b927f6526
- SHA512 62c3961ea973b80d9424863ffbcbd7a950b89fbe41f64830ca97315fc0cd9e74d7e058ae761a8960d83efa7f8bcbd307ebdefc0ea4f934f53be3de88e0038adc
- SSDEEP 6:Kj4rtmY4fGmY4ggJ1AvhSKofWYTkllr2EVl/zu+hjeB+ajr4FXx+aB:KjgtmY4/Y4R8hWW+kdVlLu4g3UPl
- TLSH T175D292D0D874ADC3D09C2739E2D5F1B9D4F08E7E340D486205C3522429181D1232F2CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\NucleusUpdateRingConfig.json
- Size 102KB
- SHA256 7baec18df46d351b6ae859d57e738f7fe1c32fa334b136e199c05432c18dafae
- MD5 9b2c69081006371c6d1fc0b50317d9fe
- SHA1 4bc72e81e16a9c56c0376800e09068fff66ee173
- SHA512 1c3d864e93137cd634ed7b1ba6f624ac8956b19f880a558aa53ade755b268244a11ac099d1d0ce635d411193c710e9351598654ccff3225fe295f73bfc2a1cb1
- SSDEEP 768:WEeIBl+XaPNGZwXJuWU9mLzo92kM3+18JDcq4rRBFkUPGNbqLxStzJ8RW/E/+5wi:WhGzJuWUQYA0qGPGns8vcFEdF8Ab
- TLSH T160A3DA4E2008B7AFE316AD5A7D6B69861C21746E3852CFCEE0CDC26C6E44DC4734A5B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png
- Size 965B
- SHA256 3910d0976a41bc9802e6c1460c441f0ce5bf6520b47e2e7f1237eea0342553cf
- MD5 d635128a586a11b8bc6643ca430da338
- SHA1 dce9874bbc095f922fb117ca0eb4633c263d3876
- SHA512 45732a40485708da65970119ad31289cb7a36bc43254370effc2c1c1bec27a8932aa378aaeee4bbc6e2ee45424abf3a5dc1c457588b99df863f6dff886df6ad5
- TLSH T1521188F5477DA71EF4DC86F7206930EC455F83E6067E460D4D5035205892A0C20A07D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wct6190.tmp
- Size 3KB
- SHA256 c17f1877dc8836a7f4ba825fd694f842c0b1498949eecbc9322c106a31e4b5d7
- MD5 642535eb3dfb3dbd7e9695a2e45faa5b
- SHA1 837f830d20f3659c86888ce8b1cdc5ecda004c7a
- SHA512 45ad8abc72d3012e02809f0554fb9c6cb820692502aea22fcc857302470314fee99f81ec3f7e28b25553104f46d50a84d6a2a45bf4473b21d8132b13321811c9
- TLSH T1E76195D8369856FA9591C1098F68FF583CFF18BB64AB5958B4EC42083079BA7630385B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\nflorbaa\cgkmbloj.tmp
- Size 678KB
- SHA256 ea77e54f01e2865e61c824c6d2cbb72937bb7a423e3f47f1496ab0827eafbd66
- MD5 cc5702c3d39b940030edbb4415a647da
- SHA1 acee4e67fd435d11e2d2d7474198d292dcdbd0cf
- SHA512 f9b6b075d400839603b5f33ffe56373413babbfd306945879e66d213a5417dc23e35bee70de62ba95bb13b40e26af5f79267d32aff2cb275c27516eca6e691c2
- SSDEEP 12288:f1BhqWvSqY4zvmjOwJIT+7QB3T0MzD8J7gIfR35UOApDK:NPq0hmOhT+7svzD8J7Nx
- TLSH T1C4E4BE4E338868D0D82271389512E325D6733D706B209BDB1DC0DC7F2E676D5AAFBA46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 487KB
- SHA256 fd88ad5db96abff1caf6d83964c07d46fbba0eecde24d68711482b0733958eb7
- MD5 9a82ceccb3d7ed68edcf9dec0afc8950
- SHA1 4ec7f49e785e416571f982d1c77d3f0653fe5c39
- SHA512 d4f0cb2ca72b3774b935183ea3afa46db18554467e179c8a8971fa39e6c82a78641d0f7f7e4ba6da5954a818c233f4d9453e96765167f56db9c3ea5dbb1e6149
- SSDEEP 6144:fzkCSPNo03faEdLbHjvXdVST7FrKKO3L8MzjuCd9J31QPN72Mh8oz4WAkg4etcZv:2hbHjfXyI8MzjLbJeN6MAWAkF
- TLSH T11AB4AE69634CD0CBDDE57639C825BA85D27078168F21E7CF6AF1703A0A7AED84C34B94
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.0MB
- SHA256 a25dd69cfe0f25af7ac216e02404d5d7f37f3288831acf1ca9f82e659b576e7b
- MD5 8955724bb11312d329d63036e011a2d4
- SHA1 09163e7cffe84c19fe2dad1cdf7603e3742c97f7
- SHA512 b9d6f45fde54ae3a8612a51c424f1a1592c233f1fffe62d851d65e64df3dba16c4b4336521216d31c2fa4a9e6718a3cf72bb2751f5577f239770fdcc337620d9
- SSDEEP 12288:k/jWhF0YgnJdCFaUKUiWLk49cti+R8tYnHiyXMzn4i/uV5lZM/HBb0orCE8KR:O3YgnJcRTk4yti+R5dcR//
- TLSH T1C935492DE3A83CA8D8F991F247415365AA7334291F21BAC7016085385F1BADBDE37F49
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 489KB
- SHA256 344032266e8bbf3a26b86e198782a71a5d8f9672bb17d27e0a8de36c391f4124
- MD5 d743c572dd40bd8a7112851596d4fb87
- SHA1 748a371a79295f0470c81c3c6ed521eed1de1cde
- SHA512 2c19c232ac510bdcd1851ff616bce85250c31904499ed820c194c967ad0646168066f31560c4c6078c9c635a8081e3f778bb77dd4443ecd2a05dcad8d3b109ad
- SSDEEP 12288:4EP3RlEwNPkb6myfnmL4JwMS43duL9Hrpi8lbGCId2jo:TlEwNsbAfnmsJwMS4w9VBBIuo
- TLSH T11CB4CE4A336BB0ECCA6D11798EA6DB88E37473BE9B0787CB56C190394E356D43E34641
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe
- Size 658KB
- SHA256 ecb79b0d6a18d8cc7618bf6d7e7cceb601fff01acb2731c6528c0e13881f3720
- MD5 0d32f0011554a7de78de2ccf211903a0
- SHA1 8250da6f01f0d42cb13f115025d1099e7b871288
- SHA512 f645eddb1f2265fd8cc1448880aad88aab13849f15d0c942272a79249bbfb74c9d10a4a7caa6d1db85d2a734aa34a7f6f505971db6c22a20cc987c763384494a
- SSDEEP 12288:d1XLsswWkxy2lRq2czAxE30RczEV/I4zs:TXYfDtczAxEI4wQ
- TLSH T1B7E4D074A3A358FCDC3B9A3B98A69040DA727C157365F59707EDA5710F23B880A7C782
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\windows\system32\Appvclient.exe
- Size 1.1MB
- SHA256 33aad3b6e3ef55042b58a07352609819d17fc88a8607e829d8ddc2331db1e3e6
- MD5 2c1ef9b13b919e4f7ff761eda56ab70b
- SHA1 711c43f3b79481fd53ccc4bc7192d939b0ade3b4
- SHA512 4127d6c215bbc0dfc0c112e957ea9fd2f837ca6b969051b7ed1187b8c573f281262c8ca2e6bc044559c24ad7297a956a38550eb9f2024abb04ffce20cd69f21d
- SSDEEP 24576:l1QT7EcpfxR+N5AWAz3ooiYnjMqbaZv8QJZ+L1oYqT9:ATDxR+N5YzThjM/87GYq
- TLSH T162457D2EBFB915D8D17FCA785A328512EE723411173192CB42E0C13E1E6B9D85EFAB11
- MD5 SHA1 SHA512 SSDEEP TLSH