Overview

overview

10

Static

static

3

Locker/Loc...er.exe

windows10-2004-x64

3

Locker/Loc...er.exe

windows11-ltsc_2024-x64

3

Locker/Loc...er.pdb

windows10-2004-x64

3

Locker/Loc...er.pdb

windows11-ltsc_2024-x64

3

Locker/Met...rk.dll

windows10-2004-x64

1

Locker/Met...rk.dll

windows11-ltsc_2024-x64

1

Locker/Stub/Stub.exe

windows10-2004-x64

10

Locker/Stub/Stub.exe

windows11-ltsc_2024-x64

6

Locker/dnlib.dll

windows10-2004-x64

1

Locker/dnlib.dll

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/09/2026, 10:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Locker/Stub/Stub.exe
  • Size 215KB
  • Sample260908-m16gmaydrb
  • SHA256 19b6c1905f4435815f6d79b7eb0aee50ccc6d4ccde4dca9b973e3589e15fc00d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverypersistenceprivilege_escalationransomwarespyware

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 59 IoCs
  • Modifies system executable filetype association 2 TTPs 11 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 15 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 8 IoCs

    System information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 14 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 23 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Locker\Stub\Stub.exe
    "C:\Users\Admin\AppData\Local\Temp\Locker\Stub\Stub.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Suspicious use of FindShellTrayWindow
    PID:2716
  • C:\Users\Admin\AppData\Local\Temp\Locker\Stub\Stub.exe
    "C:\Users\Admin\AppData\Local\Temp\Locker\Stub\Stub.exe"
    1⤵
      PID:4916
    • C:\Users\Admin\AppData\Local\Temp\Locker\Stub\Stub.exe
      "C:\Users\Admin\AppData\Local\Temp\Locker\Stub\Stub.exe" /setup
      1⤵
        PID:1272
      • C:\Users\Admin\AppData\Local\Temp\Locker\Stub\Stub.exe
        "C:\Users\Admin\AppData\Local\Temp\Locker\Stub\Stub.exe" --init
        1⤵
          PID:3492
        • C:\Users\Admin\AppData\Local\Temp\Locker\Stub\Stub.exe
          "C:\Users\Admin\AppData\Local\Temp\Locker\Stub\Stub.exe" -startup
          1⤵
            PID:5100
          • C:\Users\Admin\AppData\Local\Temp\Locker\Stub\Stub.exe
            "C:\Users\Admin\AppData\Local\Temp\Locker\Stub\Stub.exe" --wininit
            1⤵
              PID:3760
            • C:\Windows\System32\rundll32.exe
              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
              1⤵
                PID:1204
              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
                1⤵
                • Modifies system executable filetype association
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious behavior: AddClipboardFormatListener
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:648
                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart
                  2⤵
                  • Executes dropped EXE
                  • Checks system information in the registry
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1344
                  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                    C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode
                    3⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Modifies system executable filetype association
                    • Adds Run key to start application
                    • Checks system information in the registry
                    • System Location Discovery: System Language Discovery
                    • Modifies Internet Explorer settings
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:312
                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
                      "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      PID:4692
                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                      /updateInstalled /background
                      4⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Modifies system executable filetype association
                      • Checks system information in the registry
                      • System Location Discovery: System Language Discovery
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious behavior: AddClipboardFormatListener
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:3780
              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
                1⤵
                • Modifies system executable filetype association
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Modifies Internet Explorer settings
                • Modifies registry class
                PID:3124
              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
                1⤵
                • Modifies system executable filetype association
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Modifies Internet Explorer settings
                • Modifies registry class
                PID:4804
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\WatchComplete.css
                1⤵
                • Opens file in notepad (likely ransom note)
                • Suspicious behavior: GetForegroundWindowSpam
                PID:1648
              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
                C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
                1⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1856
                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Microsoft.SharePoint.exe
                  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Microsoft.SharePoint.exe" /silentConfig
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks system information in the registry
                  • System Location Discovery: System Language Discovery
                  PID:3352

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Persistence

                    Boot or Logon Autostart Execution

                    2
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Winlogon Helper DLL

                    1
                    T1547.004

                    Event Triggered Execution

                    2
                    T1546

                    Change Default File Association

                    1
                    T1546.001

                    Component Object Model Hijacking

                    1
                    T1546.015

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    2
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Winlogon Helper DLL

                    1
                    T1547.004

                    Event Triggered Execution

                    2
                    T1546

                    Change Default File Association

                    1
                    T1546.001

                    Component Object Model Hijacking

                    1
                    T1546.015

                    Defense Evasion

                    Modify Registry

                    4
                    T1112

                    Credential Access

                    Discovery

                    Query Registry

                    4
                    T1012

                    System Information Discovery

                    4
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    Lateral Movement

                    Collection

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
                    • Size 1KB
                    • SHA256 35b426f3094d49ac4c81888393841850814258afb92197bbb6f39c2886517c21
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                    • Size 471B
                    • SHA256 eaf4fac3ac8234fdc96869afa6feb923ccb89d8dc6fe4ea5b6b210123472f077
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
                    • Size 426B
                    • SHA256 6f416be202907fca1a4434c76b38b1ea9c7743edf8a13d70e51d32f2d95e618d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                    • Size 412B
                    • SHA256 a50f3b2c1c4cb3595c372c5c761b333079531009a9f0c0b49ced7e4f32b4cb48
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Stub.exe.log
                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Stub.exe.log
                    • Size 1KB
                    • SHA256 c897436c82fda9abf08b29fe05c42f4e59900116bbaf8bfd5b85ef3c97ab7884
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    FileSyncClient.dll
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncClient.dll
                    • Size 5.0MB
                    • SHA256 3d0250f856970ff36862c99f3329a82be87b0de47923debefe21443c76cddf88
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    FileSyncConfig.exe
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
                    • Size 553KB
                    • SHA256 a3a4b648e4dcf3a4e5f7d13cc3d21b0353e496da75f83246cc8a15fada463bdf
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    FileSyncSessions.dll
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncSessions.dll
                    • Size 3.7MB
                    • SHA256 1e0c26ceecee602b5b4a25fb9b0433c26bac05bd1eee4a43b9aa75ae46ccf115
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    FileSyncTelemetryExtensions.dll
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncTelemetryExtensions.dll
                    • Size 58KB
                    • SHA256 a742c9e35d824b592b3d9daf15efb3d4a28b420533ddf35a1669a5b77a00bb75
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    FileSyncViews.dll
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncViews.dll
                    • Size 2.4MB
                    • SHA256 146740eddcb439b1222d545b4d32a1a905641d02b14e1da61832772ce32e76ba
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    LogUploader.dll
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogUploader.dll
                    • Size 769KB
                    • SHA256 fe49f22bb132fedf1412e99169d307fa715dbdd84fe71c3e3ff12300d30d4987
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    LoggingPlatform.dll
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LoggingPlatform.dll
                    • Size 504KB
                    • SHA256 d5a538a0a036c602492f9b2b6f85de59924da9ec3ed7a7bbf6ecd0979bee54d3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OneDriveMedTile.contrast-black_scale-100.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-100.png
                    • Size 1KB
                    • SHA256 6f028542f6faeaaf1f564eab2605bedb20a2ee72cdd9930bde1a3539344d721b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    OneDriveMedTile.contrast-black_scale-125.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-125.png
                    • Size 1KB
                    • SHA256 cbdcf248f8a0fcd583b475562a7cdcb58f8d01236c7d06e4cdbfe28e08b2a185
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    OneDriveMedTile.contrast-black_scale-150.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-150.png
                    • Size 2KB
                    • SHA256 36a6aad9a9947ab3f6ac6af900192f5a55870d798bca70c46770ccf2108fd62d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    OneDriveMedTile.contrast-black_scale-200.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-200.png
                    • Size 2KB
                    • SHA256 67d1bb54fcb19c174de1936d08b5dbdb31b98cfdd280bcc5122fb0693675e4f2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    OneDriveMedTile.contrast-black_scale-400.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-400.png
                    • Size 6KB
                    • SHA256 5cb8fd670585de8a7fc0ceede164847522d287ef17cd48806831ea18a0ceac1f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OneDriveMedTile.contrast-white_scale-100.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-100.png
                    • Size 2KB
                    • SHA256 a024fc5dbe0973fd9267229da4ebfd8fc41d73ca27a2055715aafe0efb4f3425
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    OneDriveMedTile.contrast-white_scale-125.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-125.png
                    • Size 3KB
                    • SHA256 e8b30bfcee8041f1a70e61ca46764416fd1df2e6086ba4c280bfa2220c226750
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    OneDriveMedTile.contrast-white_scale-150.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-150.png
                    • Size 3KB
                    • SHA256 a0bbe33b798c3adac36396e877908874cffaadb240244095c68dff840dcbbf73
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    OneDriveMedTile.contrast-white_scale-200.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-200.png
                    • Size 4KB
                    • SHA256 fba9104432cbb8ebbd45c18ef1ba46a45dd374773e5aa37d411bb023ded8efd6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OneDriveMedTile.contrast-white_scale-400.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-400.png
                    • Size 8KB
                    • SHA256 9250ef25efc2a9765cf1126524256fdfc963c8687edfdc4a2ecde50d748ada85
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OneDriveMedTile.scale-100.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-100.png
                    • Size 2KB
                    • SHA256 8acbdd41252595b7410ca2ed438d6d8ede10bd17fe3a18705eedc65f46e4c1c4
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    OneDriveMedTile.scale-125.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-125.png
                    • Size 4KB
                    • SHA256 a5294e3c7cd855815f8d916849d87bd2357f5165eb4372f248fdf8b988601665
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OneDriveMedTile.scale-150.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-150.png
                    • Size 5KB
                    • SHA256 3df4590386671e0d6fee7108e457eb805370a189f5fdfeaf2f2c32d5adc76abd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OneDriveMedTile.scale-200.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-200.png
                    • Size 6KB
                    • SHA256 3384357b6110f418b175e2f0910cffe588c847c8e55f2fe3572d82999a62c18e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OneDriveMedTile.scale-400.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-400.png
                    • Size 15KB
                    • SHA256 deb0ec0ee8f1c4f7ea4de2c28ff85087ee5ff8c7e3036c3b0a66d84bae32b6bb
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OneDriveSmallTile.contrast-black_scale-100.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png
                    • Size 783B
                    • SHA256 292cac291af7b45f12404f968759afc7145b2189e778b14d681449132b14f06b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    OneDriveSmallTile.contrast-black_scale-125.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png
                    • Size 1018B
                    • SHA256 8efeacefb92d64dfb1c4df2568165df6436777f176accfd24f4f7970605d16c2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    OneDriveSmallTile.contrast-black_scale-150.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png
                    • Size 1KB
                    • SHA256 262b9a30bb8db4fc59b5bc348aa3813c75e113066a087135d0946ad916f72535
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    OneDriveSmallTile.contrast-black_scale-200.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png
                    • Size 1KB
                    • SHA256 9833b80def72b73fca150af17d4b98c8cd484401f0e2d44320ecd75b5bb57c42
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    OneDriveSmallTile.contrast-black_scale-400.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png
                    • Size 3KB
                    • SHA256 3a7ef7c0bda402fdaff19a479d6c18577c436a5f4e188da4c058a42ef09a7633
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    OneDriveSmallTile.scale-100.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-100.png
                    • Size 1KB
                    • SHA256 4e11167708801727891e8dd9257152b7391fc483d46688d61f44b96360f76816
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    OneDriveSmallTile.scale-125.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-125.png
                    • Size 2KB
                    • SHA256 69e432d1eec44bed4aad35f72a912e1f0036a4b501a50aec401c9fa260a523e3
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    OneDriveSmallTile.scale-150.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-150.png
                    • Size 3KB
                    • SHA256 7e3f35d5eb05435be8d104a2eacf5bace8301853104a4ea4768601c607ddf301
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    OneDriveSmallTile.scale-200.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-200.png
                    • Size 4KB
                    • SHA256 85823f7a5a4ebf8274f790a88b981e92ede57bde0ba804f00b03416ee4feda89
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OneDriveSmallTile.scale-400.png
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-400.png
                    • Size 11KB
                    • SHA256 9a0b901e97abe02036c782eb6a2471e18160b89fd5141a5a9909f0baab67b1ef
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OneDrive.VisualElementsManifest.xml
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDrive.VisualElementsManifest.xml
                    • Size 344B
                    • SHA256 d21077ad0c29a4c939b8c25f1186e2b542d054bb787b1d3210e9cab48ec3080c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    OneDrive.exe
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDrive.exe
                    • Size 2.3MB
                    • SHA256 5d8273bf98397e4c5053f8f154e5f838c7e8a798b125fcad33cab16e2515b665
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OneDriveStandaloneUpdater.exe
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDriveStandaloneUpdater.exe
                    • Size 2.9MB
                    • SHA256 969fbb03015dd9f33baf45f2750e36b77003a7e18c3954fab890cddc94046673
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OneDriveTelemetryStable.dll
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDriveTelemetryStable.dll
                    • Size 1.6MB
                    • SHA256 146811735589450058048408f05644a93786a293c09ccb8d74420fb87c0a4d56
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Qt5Core.dll
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Qt5Core.dll
                    • Size 5.1MB
                    • SHA256 ad44dbb30520d85f055595f0bc734b16b9f2fb659f17198310c0557b55a76d70
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Qt5Qml.dll
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Qt5Qml.dll
                    • Size 2.7MB
                    • SHA256 bdadc298fda94a9ad1268128863276c7f898bef3ae79a3e6782cecf22f1294a2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Resources.pri
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Resources.pri
                    • Size 4KB
                    • SHA256 e1252527bc066da6838344d49660e4c6ff2d1ddfda036c5ec19b07fdfb90c8c3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SyncEngine.dll
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\SyncEngine.dll
                    • Size 8.3MB
                    • SHA256 51b13dd5d598367fe202681dce761544ee3f7ec4f36d0c7c3c8a3fca32582f07
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Telemetry.dll
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Telemetry.dll
                    • Size 451KB
                    • SHA256 414f6f64d463b3eb1e9eb21d9455837c99c7d9097f6bb61bd12c71e8dce62902
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    UpdateRingSettings.dll
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\UpdateRingSettings.dll
                    • Size 432KB
                    • SHA256 9fb3abcafd8e8b1deb13ec0f46c87b759a1cb610b2488052ba70e3363f1935ec
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WebView2Loader.dll
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\WebView2Loader.dll
                    • Size 107KB
                    • SHA256 41a13ba97534c7f321f3f29ef1650bd445bd3490153a2bb2d57e0fbc70d339c1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WnsClientApi.dll
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\WnsClientApi.dll
                    • Size 668KB
                    • SHA256 114ea2a7872a991a00f2ffd907248cafe1f7475cd399982fd383488f6d7f4839
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    adal.dll
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\adal.dll
                    • Size 1.3MB
                    • SHA256 55234df27deb004b09c18dc15ca46327e48b26b36dfb43a92741f86300bd8e9e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    msvcp140.dll
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\msvcp140.dll
                    • Size 425KB
                    • SHA256 545bb4a00b29b4b5d25e16e1d0969e99b4011033ce3d1d7e827abef09dd317e7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ucrtbase.dll
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\ucrtbase.dll
                    • Size 1.1MB
                    • SHA256 5ade748445d8da8f22d46ad46f277e1e160f6e946fc51e5ac51b9401ce5daf46
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    vcruntime140.dll
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\vcruntime140.dll
                    • Size 73KB
                    • SHA256 c79241aec5e35cba91563c3b33ed413ce42309f5145f25dc92caf9c82a753817
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Microsoft.ListSync.Settings.db
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Business1\settings\Microsoft.ListSync.Settings.db
                    • Size 16KB
                    • SHA256 e1b72fdb6fb9da58322f43b4ac4d23a84be5800fefd87fea07b6895ce091fea6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OneDriveSetup.exe
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                    • Size 40.2MB
                    • SHA256 e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SyncEngine-2026-9-8.1057.3124.1.aodl
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Personal\SyncEngine-2026-9-8.1057.3124.1.aodl
                    • Size 5KB
                    • SHA256 8fbae627ea931a7823d51bd3116d88602b29fb36dfaec8918eebb45a41022109
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SyncEngine-2026-9-8.1057.3124.1.odl
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Personal\SyncEngine-2026-9-8.1057.3124.1.odl
                    • Size 6KB
                    • SHA256 9ef4716b130d361d766ee07df34e8e2e7bd54a79355563f0a0ad8795edbafe33
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SyncEngine-2026-9-8.1057.4804.1.odl
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Personal\SyncEngine-2026-9-8.1057.4804.1.odl
                    • Size 6KB
                    • SHA256 641a748fb2c0d645fba86b9f1fb7ad0e9a8691005fe3cc17a3311070c300362c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SyncEngine-2026-9-8.1057.648.1.aodl
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Personal\SyncEngine-2026-9-8.1057.648.1.aodl
                    • Size 692B
                    • SHA256 5559093d9a429f6f1609f24473c68ec0b0a6b498686e5554f0641212b9f04548
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    SyncEngine-2026-9-8.1057.648.1.aodl
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Personal\SyncEngine-2026-9-8.1057.648.1.aodl
                    • Size 41KB
                    • SHA256 264da831e94a5188ea189b5cc8de8e8cf3b4537b8c9c6a055024a189464baf1d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    TraceCurrent.0729.0013.etl
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Personal\TraceCurrent.0729.0013.etl
                    • Size 4KB
                    • SHA256 8aa66d6862ef006a054d56afd131edff58afaeca37ea6ac0fbd134de8b669cbf
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    TraceCurrent.0729.0013.etl
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Personal\TraceCurrent.0729.0013.etl
                    • Size 4KB
                    • SHA256 33e7b36ac90d7a55c8a369a13b3811836cf18fdb2bdfa6a1965e22a0d5794a48
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    telemetryCache.otc.session
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Personal\telemetryCache.otc.session
                    • Size 20KB
                    • SHA256 3c1c4810b6ee22b0ff94b85e202890d691b0b054f09c40b2a70598cf7b35c26f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    telemetryCache.otc.session
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Personal\telemetryCache.otc.session
                    • Size 20KB
                    • SHA256 f04b6eeecb8e8877cd3a9684ed6350851dfeff39d3e107c11c07cdab1692606d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    logUploaderSettings_temp.ini
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini
                    • Size 108B
                    • SHA256 f512ce171a4ecbc18b76fc1c7e63eb771d9bc2831457f7f3a3cf3b9c2691cad1
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    logUploaderSettings_temp.ini
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini
                    • Size 38B
                    • SHA256 884d272d16605590e511ae50c88842a8ce203a864f56061a3c554f8f8265866e
                    • MD5 SHA1 SHA512
                    Submit Download

                    PreSignInSettingsConfig.json
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.json
                    • Size 63KB
                    • SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    DeviceHealthSummaryConfiguration.ini
                    • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.ini
                    • Size 77B
                    • SHA256 7bc94aa23cfff98f1b35f95294347c7fdd885fba091e641c587f80a1240364cb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    update100[1].xml
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7FRQ0ITZ\update100[1].xml
                    • Size 726B
                    • SHA256 36a6bd38a8a6f5a75b73caffae5ae66dfabcaefd83da65b493fa881ea8a64e7d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    aria-debug-3124.log
                    • Path C:\Users\Admin\AppData\Local\Temp\aria-debug-3124.log
                    • Size 470B
                    • SHA256 23b21621fd498e3af6d0a842b4d6c285a958c9e8843248731692d47e2c359019
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    aria-debug-4804.log
                    • Path C:\Users\Admin\AppData\Local\Temp\aria-debug-4804.log
                    • Size 470B
                    • SHA256 01cca0776aff560897b49b4a28fe6975f4855425ea22766d3ad953dc46f942ab
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    aria-debug-648.log
                    • Path C:\Users\Admin\AppData\Local\Temp\aria-debug-648.log
                    • Size 470B
                    • SHA256 a3a5de0eb0a8e1c477461d4473b482ac23373dbf1507efef364ddfde534acb34
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    tmp67C8.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\tmp67C8.tmp
                    • Size 35.9MB
                    • SHA256 bbc70091b3834af5413b9658b07269badd4cae8d96724bf1f7919f6aab595009
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/2716-0-0x00000000003C0000-0x00000000003FC000-memory.dmp
                    Download

                    memory/2716-1-0x000000001B9D0000-0x000000001B9E0000-memory.dmp
                    Download

                    memory/2716-6-0x000000001B9D0000-0x000000001B9E0000-memory.dmp
                    Download

                    memory/4916-3-0x0000000001090000-0x00000000010A0000-memory.dmp
                    Download