Overview

overview

6

Static

static

1

DS-Setup[g...o].exe

windows10-2004-x64

6

DS-Setup[g...o].exe

windows11-ltsc_2024-x64

5

Analysis

  • user interaction
    yes
  • max time kernel
    116s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    21/08/2026, 13:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DS-Setup[g1FZab4Ro].exe
  • Size 73.1MB
  • Sample260821-qlacesfj6s
  • SHA256 9a3f6e69c12cb814c45862219ecb17e9ab7744877c9da1c49f3ea046437f8fca
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 8 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 7 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DS-Setup[g1FZab4Ro].exe
    "C:\Users\Admin\AppData\Local\Temp\DS-Setup[g1FZab4Ro].exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3436
    • C:\Program Files (x86)\Download Studio\dstudio-gui.exe
      "C:\Program Files (x86)\Download Studio\dstudio-gui.exe" --open-hashid g1FZab4Ro --force-run
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies trusted root certificate store through registry
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3940
      • C:\Program Files (x86)\Download Studio\QtWebEngineProcess.exe
        "C:\Program Files (x86)\Download Studio\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,NetworkServiceInProcess,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,InstalledApp,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=2716 /prefetch:1
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3036
      • C:\Program Files (x86)\Download Studio\dstudio.exe
        "C:\Program Files (x86)\Download Studio\dstudio.exe" --quiet=true --event-poll=select --disable-ipv6=true --listen-port=59751 --enable-rpc=true --rpc-allow-origin-all=true --rpc-listen-port=17060 --rpc-secret=3fa146219c48a4393aace23e8f353125 --continue=true --check-certificate=false --allow-overwrite=true --allow-piece-length-change=true --content-disposition-default-utf8=true --disk-cache=32M --auto-save-interval=5 --file-allocation=trunc --max-connection-per-server=100 --min-split-size=1M --split=20 --referer=* --max-overall-upload-limit=5M --max-concurrent-downloads=5 --bt-enable-lpd=true --bt-piece-selector=default --bt-max-peers=150 --bt-max-open-files=250 --bt-save-metadata=true --bt-load-saved-metadata=true --bt-request-peer-speed-limit=100K --seed-time=0 --enable-peer-exchange=true --enable-dht=true --dht-listen-port=59751 --dht-entry-point=dht.dstudio.app:6881 --dht-file-path="C:\Users\Admin\AppData\Local\Download Studio\data\dht.dat" --save-session="C:\Users\Admin\AppData\Local\Download Studio\data\session.dat" --save-session-interval=2 --input-file="C:\Users\Admin\AppData\Local\Download Studio\data\session.dat" --user-agent=dstudio/1.22.1 --peer-agent=dstudio/1.22.1 --peer-id-prefix=-DS-1221- --stop-with-process=3940
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2380
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4596
    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
      "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
      1⤵
      • Modifies system executable filetype association
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3444
      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
        "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart
        2⤵
        • Checks system information in the registry
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4208
        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
          C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode
          3⤵
          • Adds Run key to start application
          • Checks computer location settings
          • Checks system information in the registry
          • Executes dropped EXE
          • Modifies system executable filetype association
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:944
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
            "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4504
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
            /updateInstalled /background
            4⤵
            • Checks system information in the registry
            • Executes dropped EXE
            • Modifies system executable filetype association
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:3324
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
      1⤵
        PID:3304
      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
        C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3416
        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Microsoft.SharePoint.exe
          "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Microsoft.SharePoint.exe" /silentConfig
          2⤵
          • Checks system information in the registry
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3780

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            2
            T1546

            Change Default File Association

            1
            T1546.001

            Component Object Model Hijacking

            1
            T1546.015

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            2
            T1546

            Change Default File Association

            1
            T1546.001

            Component Object Model Hijacking

            1
            T1546.015

            Defense Evasion

            Modify Registry

            4
            T1112

            Subvert Trust Controls

            2
            T1553

            Install Root Certificate

            2
            T1553.004

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Query Registry

            4
            T1012

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Qt5Core.dll
            • Path C:\Program Files (x86)\Download Studio\Qt5Core.dll
            • Size 5.4MB
            • SHA256 739aab223c25441204f4b2925a8b1af80ea6a4303ddb9d587bea1a2c8fafc2ab
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Gui.dll
            • Path C:\Program Files (x86)\Download Studio\Qt5Gui.dll
            • Size 6.1MB
            • SHA256 8919da9c553240805d03105b844ac97337d7089ba3002272b3f98860b4e1d361
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Network.dll
            • Path C:\Program Files (x86)\Download Studio\Qt5Network.dll
            • Size 1.0MB
            • SHA256 15901abe2b3a146e05a57b8bb7112c2a1c586f38cecd12f21151898c79d6a5b1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Positioning.dll
            • Path C:\Program Files (x86)\Download Studio\Qt5Positioning.dll
            • Size 266KB
            • SHA256 cc9563e933e31860a97b35d7cd3a85f93130fc0d5b58db2b4012f6a448b1c71e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5PrintSupport.dll
            • Path C:\Program Files (x86)\Download Studio\Qt5PrintSupport.dll
            • Size 256KB
            • SHA256 5ff88c6f22ec13e9a09bfd1ffed5532a0e72af996f864b5252af0db482555868
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Qml.dll
            • Path C:\Program Files (x86)\Download Studio\Qt5Qml.dll
            • Size 2.9MB
            • SHA256 5d39dec74bde22d5d91a108cfe5fedd59395bc19cbbe5ef16ff55b080db30e8c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5QmlModels.dll
            • Path C:\Program Files (x86)\Download Studio\Qt5QmlModels.dll
            • Size 340KB
            • SHA256 c087fd14fb3a4565fa500dedee14e9fcc3dd2f1fcf753825b588ac49c7f85077
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Quick.dll
            • Path C:\Program Files (x86)\Download Studio\Qt5Quick.dll
            • Size 3.4MB
            • SHA256 6a0394ee605734aa1efa6f0496152ab9246d7690e1eff5a3e6f7fb7071be3263
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5QuickWidgets.dll
            • Path C:\Program Files (x86)\Download Studio\Qt5QuickWidgets.dll
            • Size 61KB
            • SHA256 a63ef5ee27c32c30249c927325fa2ce622094d63df77861d09e7d3d54d989cbe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Sql.dll
            • Path C:\Program Files (x86)\Download Studio\Qt5Sql.dll
            • Size 164KB
            • SHA256 5b8fecb98a2691925d94cc983ac253cab86cd8dd4056e5d6525242dbb1bc7f52
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5WebChannel.dll
            • Path C:\Program Files (x86)\Download Studio\Qt5WebChannel.dll
            • Size 100KB
            • SHA256 8f0e6b0a1bd1a412460804b37f5555c199acbc04f331c05827b49f81e608d210
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5WebEngineWidgets.dll
            • Path C:\Program Files (x86)\Download Studio\Qt5WebEngineWidgets.dll
            • Size 195KB
            • SHA256 f17e0017255a7d83f539a3993038790dd67007eae2d49430127a393fccbda1be
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5WebSockets.dll
            • Path C:\Program Files (x86)\Download Studio\Qt5WebSockets.dll
            • Size 111KB
            • SHA256 1e68b5404f6dc3c3129c5f527f8601506cee09c72a49c5a81f688bfe45608ec6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Widgets.dll
            • Path C:\Program Files (x86)\Download Studio\Qt5Widgets.dll
            • Size 4.4MB
            • SHA256 fda376c36e40e4ef1fdb73229197f965a1f3bc98bedbf2c8c83513ff6a3800e6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dstudio-gui.exe
            • Path C:\Program Files (x86)\Download Studio\dstudio-gui.exe
            • Size 631KB
            • SHA256 0942666f4fd5eeff41f5655f10e144434d3618ace98281464e82b08949360392
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dstudio.exe
            • Path C:\Program Files (x86)\Download Studio\dstudio.exe
            • Size 2.0MB
            • SHA256 935a79d7a59da0a2d9f729d4c5cc03bff07856a67735f48ea710c8137dcfdf8f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libEGL.dll
            • Path C:\Program Files (x86)\Download Studio\libEGL.dll
            • Size 15KB
            • SHA256 d2f08d10938c5af19e034074df574b0a2aed892d58b5d3339d93680ff6b3baa5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libGLESv2.dll
            • Path C:\Program Files (x86)\Download Studio\libGLESv2.dll
            • Size 2.8MB
            • SHA256 3694b86a670585c86e8383a2f00217c9e0064690ce120ba8ea15e1f35fa5e5be
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libnatpmp.dll
            • Path C:\Program Files (x86)\Download Studio\libnatpmp.dll
            • Size 12KB
            • SHA256 558dadd9bb8809f1838e6b9ee0ed94c2b37f3f15d52c270cfd2f41ed13c35ba4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            miniupnpc.dll
            • Path C:\Program Files (x86)\Download Studio\miniupnpc.dll
            • Size 39KB
            • SHA256 f23ea1f6ff44ccd9ebda0c633bee25b320230aace561ca78de0f99a3ca1bb148
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msvcp140.dll
            • Path C:\Program Files (x86)\Download Studio\msvcp140.dll
            • Size 427KB
            • SHA256 8acd9e63a83f2facfc68b801f864f923eac5fb8c8a046a32fef8d622ba7d407f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msvcp140_1.dll
            • Path C:\Program Files (x86)\Download Studio\msvcp140_1.dll
            • Size 22KB
            • SHA256 f0fb70b0801432a89ebcc301f289c78ffb6d3f06bfb691a5782d7a309d1386c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            qwindows.dll
            • Path C:\Program Files (x86)\Download Studio\platforms\qwindows.dll
            • Size 1.2MB
            • SHA256 a2acbe1f4acad4ec6e51ee6af6cc15b2ff7c18e432958eddbb95b24e3206fad4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icudtl.dat
            • Path C:\Program Files (x86)\Download Studio\resources\icudtl.dat
            • Size 10.0MB
            • SHA256 8364e6c6bf5744357199de0de3f6ba30846ccda70288675b75059e6fd52241f3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            qtwebengine_devtools_resources.pak
            • Path C:\Program Files (x86)\Download Studio\resources\qtwebengine_devtools_resources.pak
            • Size 2.1MB
            • SHA256 35f9b6e623b10c1dd14b04d7684afaa9a9a1a1a9ebd23189dddc7fa14f95e7c0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            qtwebengine_resources.pak
            • Path C:\Program Files (x86)\Download Studio\resources\qtwebengine_resources.pak
            • Size 2.4MB
            • SHA256 f41d42b2447769ae2b72aa5cb2e30888b1314c491c53a6817e999a46b3da45e3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            qtwebengine_resources_100p.pak
            • Path C:\Program Files (x86)\Download Studio\resources\qtwebengine_resources_100p.pak
            • Size 191KB
            • SHA256 18e72ca3edea4c5caed15f5400d32c55d60ee5ecba4edbfb5195fdf256a4089f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            qtwebengine_resources_200p.pak
            • Path C:\Program Files (x86)\Download Studio\resources\qtwebengine_resources_200p.pak
            • Size 250KB
            • SHA256 e08ab578081a06bfec31d6a5ed9a737c65d6c19711d21fbf26ac16af0519a76c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            qwindowsvistastyle.dll
            • Path C:\Program Files (x86)\Download Studio\styles\qwindowsvistastyle.dll
            • Size 122KB
            • SHA256 59dbe14fdf903d2e6120a364ffe779db1f7d9ee47fee3eb033ef4ecf89015dfc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-US.pak
            • Path C:\Program Files (x86)\Download Studio\translations\qtwebengine_locales\en-US.pak
            • Size 242KB
            • SHA256 54818e99ad0ec4d984172b000fc461474f9c3d356e342c9898295683563f974f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ui.qrc
            • Path C:\Program Files (x86)\Download Studio\ui.qrc
            • Size 387KB
            • SHA256 4a96708f989995277627f1335a33fff719797c9844bd2710d8022ac7923b9b61
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcruntime140.dll
            • Path C:\Program Files (x86)\Download Studio\vcruntime140.dll
            • Size 75KB
            • SHA256 526d8774c67248aa62a5911acd7db667cc4bed5be2cd5dc139c6c4d5dfb9d57e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Local\Download Studio\QtWebEngine\Default\Local Storage\leveldb\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            FileSyncConfig.exe
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
            • Size 553KB
            • SHA256 a3a4b648e4dcf3a4e5f7d13cc3d21b0353e496da75f83246cc8a15fada463bdf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.contrast-black_scale-100.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-100.png
            • Size 1KB
            • SHA256 6f028542f6faeaaf1f564eab2605bedb20a2ee72cdd9930bde1a3539344d721b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-black_scale-125.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-125.png
            • Size 1KB
            • SHA256 cbdcf248f8a0fcd583b475562a7cdcb58f8d01236c7d06e4cdbfe28e08b2a185
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-black_scale-150.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-150.png
            • Size 2KB
            • SHA256 36a6aad9a9947ab3f6ac6af900192f5a55870d798bca70c46770ccf2108fd62d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-black_scale-200.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-200.png
            • Size 2KB
            • SHA256 67d1bb54fcb19c174de1936d08b5dbdb31b98cfdd280bcc5122fb0693675e4f2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-black_scale-400.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-400.png
            • Size 6KB
            • SHA256 5cb8fd670585de8a7fc0ceede164847522d287ef17cd48806831ea18a0ceac1f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.contrast-white_scale-100.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-100.png
            • Size 2KB
            • SHA256 a024fc5dbe0973fd9267229da4ebfd8fc41d73ca27a2055715aafe0efb4f3425
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-white_scale-125.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-125.png
            • Size 3KB
            • SHA256 e8b30bfcee8041f1a70e61ca46764416fd1df2e6086ba4c280bfa2220c226750
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-white_scale-150.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-150.png
            • Size 3KB
            • SHA256 a0bbe33b798c3adac36396e877908874cffaadb240244095c68dff840dcbbf73
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.contrast-white_scale-200.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-200.png
            • Size 4KB
            • SHA256 fba9104432cbb8ebbd45c18ef1ba46a45dd374773e5aa37d411bb023ded8efd6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.contrast-white_scale-400.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-400.png
            • Size 8KB
            • SHA256 9250ef25efc2a9765cf1126524256fdfc963c8687edfdc4a2ecde50d748ada85
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.scale-100.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-100.png
            • Size 2KB
            • SHA256 8acbdd41252595b7410ca2ed438d6d8ede10bd17fe3a18705eedc65f46e4c1c4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveMedTile.scale-125.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-125.png
            • Size 4KB
            • SHA256 a5294e3c7cd855815f8d916849d87bd2357f5165eb4372f248fdf8b988601665
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.scale-150.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-150.png
            • Size 5KB
            • SHA256 3df4590386671e0d6fee7108e457eb805370a189f5fdfeaf2f2c32d5adc76abd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.scale-200.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-200.png
            • Size 6KB
            • SHA256 3384357b6110f418b175e2f0910cffe588c847c8e55f2fe3572d82999a62c18e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveMedTile.scale-400.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-400.png
            • Size 15KB
            • SHA256 deb0ec0ee8f1c4f7ea4de2c28ff85087ee5ff8c7e3036c3b0a66d84bae32b6bb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveSmallTile.contrast-black_scale-100.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png
            • Size 783B
            • SHA256 292cac291af7b45f12404f968759afc7145b2189e778b14d681449132b14f06b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.contrast-black_scale-125.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png
            • Size 1018B
            • SHA256 8efeacefb92d64dfb1c4df2568165df6436777f176accfd24f4f7970605d16c2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.contrast-black_scale-150.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png
            • Size 1KB
            • SHA256 262b9a30bb8db4fc59b5bc348aa3813c75e113066a087135d0946ad916f72535
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.contrast-black_scale-200.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png
            • Size 1KB
            • SHA256 9833b80def72b73fca150af17d4b98c8cd484401f0e2d44320ecd75b5bb57c42
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.contrast-black_scale-400.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png
            • Size 3KB
            • SHA256 3a7ef7c0bda402fdaff19a479d6c18577c436a5f4e188da4c058a42ef09a7633
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.scale-100.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-100.png
            • Size 1KB
            • SHA256 4e11167708801727891e8dd9257152b7391fc483d46688d61f44b96360f76816
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.scale-125.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-125.png
            • Size 2KB
            • SHA256 69e432d1eec44bed4aad35f72a912e1f0036a4b501a50aec401c9fa260a523e3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.scale-150.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-150.png
            • Size 3KB
            • SHA256 7e3f35d5eb05435be8d104a2eacf5bace8301853104a4ea4768601c607ddf301
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDriveSmallTile.scale-200.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-200.png
            • Size 4KB
            • SHA256 85823f7a5a4ebf8274f790a88b981e92ede57bde0ba804f00b03416ee4feda89
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveSmallTile.scale-400.png
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-400.png
            • Size 11KB
            • SHA256 9a0b901e97abe02036c782eb6a2471e18160b89fd5141a5a9909f0baab67b1ef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDrive.VisualElementsManifest.xml
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDrive.VisualElementsManifest.xml
            • Size 344B
            • SHA256 d21077ad0c29a4c939b8c25f1186e2b542d054bb787b1d3210e9cab48ec3080c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OneDrive.exe
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDrive.exe
            • Size 2.3MB
            • SHA256 5d8273bf98397e4c5053f8f154e5f838c7e8a798b125fcad33cab16e2515b665
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveStandaloneUpdater.exe
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDriveStandaloneUpdater.exe
            • Size 2.9MB
            • SHA256 969fbb03015dd9f33baf45f2750e36b77003a7e18c3954fab890cddc94046673
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Resources.pri
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Resources.pri
            • Size 4KB
            • SHA256 e1252527bc066da6838344d49660e4c6ff2d1ddfda036c5ec19b07fdfb90c8c3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.ListSync.Settings.db
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Business1\settings\Microsoft.ListSync.Settings.db
            • Size 16KB
            • SHA256 e1b72fdb6fb9da58322f43b4ac4d23a84be5800fefd87fea07b6895ce091fea6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            NucleusUpdateRingConfig.json
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\NucleusUpdateRingConfig.json
            • Size 63KB
            • SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OneDriveSetup.exe
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
            • Size 40.2MB
            • SHA256 e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            logUploaderSettings_temp.ini
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini
            • Size 38B
            • SHA256 884d272d16605590e511ae50c88842a8ce203a864f56061a3c554f8f8265866e
            • MD5 SHA1 SHA512
            Submit Download

            DeviceHealthSummaryConfiguration.ini
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.ini
            • Size 77B
            • SHA256 dd0a5994c0e6abebd7a8028963ee77a44d8734cf8c87118d513428c65957a521
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            update100[2].xml
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1G6LDOHX\update100[2].xml
            • Size 726B
            • SHA256 36a6bd38a8a6f5a75b73caffae5ae66dfabcaefd83da65b493fa881ea8a64e7d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ButtonEvent.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsf5169.tmp\ButtonEvent.dll
            • Size 7KB
            • SHA256 21c44d5409dadfa9cb0d669757b0837fb51b5f39d242c66a76ff985409b98e37
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsf5169.tmp\System.dll
            • Size 12KB
            • SHA256 9a69d4c14a1191931576912e752d4fdebda6448673e753d12739a54a970508bf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UAC.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsf5169.tmp\UAC.dll
            • Size 23KB
            • SHA256 e6875dc440e675678068b53d80ab871a4cb85fc8baac48bd522b2be1b277c7e0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsDialogs.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsf5169.tmp\nsDialogs.dll
            • Size 10KB
            • SHA256 d31f0e78976c588b936f973a89f2a9dae7a43af091bd734d1360d913fe6f2b34
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsJSON.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsf5169.tmp\nsJSON.dll
            • Size 29KB
            • SHA256 e904f2eba2a96aed533114aae09374d0ae88edc7f0c0cd603f44ab4acaa089f2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tmpBC80.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\tmpBC80.tmp
            • Size 35.9MB
            • SHA256 bbc70091b3834af5413b9658b07269badd4cae8d96724bf1f7919f6aab595009
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/2380-258-0x00000000005A0000-0x0000000000B76000-memory.dmp
            Download

            memory/2380-280-0x00000000005A0000-0x0000000000B76000-memory.dmp
            Download

            memory/2380-315-0x00000000005A0000-0x0000000000B76000-memory.dmp
            Download

            memory/3436-10-0x00007FFF6C205000-0x00007FFF6C206000-memory.dmp
            Download