Overview

overview

10

Static

static

5

2026-09-29...lc.exe

windows10-2004-x64

10

2026-09-29...lc.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 05:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_06b7cba379f78507526267f88a77952e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
  • Size 4.3MB
  • Sample260930-gprlfasdpg
  • SHA256 f895e01a9d2539ecb9e70c3d842e3c70de5db28c3fbee749b2919d2657184697
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoverystealcpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Detects Stealc stealer Version 3 3 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 3 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks system information in the registry 2 TTPs 12 IoCs

    System information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_06b7cba379f78507526267f88a77952e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_06b7cba379f78507526267f88a77952e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_06b7cba379f78507526267f88a77952e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_06b7cba379f78507526267f88a77952e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
      2⤵
        PID:712
      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
        "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update /updateSource:ODSU
        2⤵
        • Executes dropped EXE
        • Checks system information in the registry
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5016
        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
          C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /updateSource:ODSU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix /RegisterOneDriveLauncherAutoStartTask /EnableOneDriveLauncherRampDownloads /EnableDeltaBuildToTelemetryFeatureSet /ArgPerformNucleusLocalAccessRepair /PerformEdgeNucleusRepair /PerformChromeNucleusRepair /NucleusLNARepairVersion:1 /AddOD4PhotosShortcu /DisableRedirectionForShortCuts
          3⤵
          • Executes dropped EXE
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Checks system information in the registry
          • Reads the TCP/IP host and domain name from the registry
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3440
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\FileSyncConfig.exe
            "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\FileSyncConfig.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops desktop.ini file(s)
            • Modifies registry class
            PID:5284
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\OneDrive.Sync.Service.exe
            /silentConfig
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates connected drives
            • Checks system information in the registry
            • Reads the TCP/IP host and domain name from the registry
            • System policy modification
            PID:1304
    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\OneDriveLauncher.exe
      C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\OneDriveLauncher.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • Reads the TCP/IP host and domain name from the registry
      PID:5280
    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
      C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
      1⤵
      • Executes dropped EXE
      • Checks system information in the registry
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3688
      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\OneDrive.Sync.Service.exe
        "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\OneDrive.Sync.Service.exe" /silentConfig
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates connected drives
        • Checks system information in the registry
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        • System policy modification
        PID:5724

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Square44x44Logo.targetsize-256.png
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\Assets\Square44x44Logo.targetsize-256.png
          • Size 38KB
          • SHA256 f21d962c5327933d43c887e1d0531a116fb71cf0075126d9fd5eaa58447a055c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Resources.resw
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\Copilot\Strings\LO-LA\Resources.resw
          • Size 221B
          • SHA256 1f762fa2d859cab49e93ca9ce8ef24edc4409ac75de77dc8781cb06ae4ee7f3f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          FileSyncConfig.exe
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\FileSyncConfig.exe
          • Size 879KB
          • SHA256 66145fc43c03c672d68aa579582be11d176e4f47dd53e5cbbbb2fc80fea25583
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FileSyncEvents.dll
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\FileSyncEvents.dll
          • Size 134KB
          • SHA256 8bf283bdf4711420ff3d0f1cdfca6e78e3733f02ed76ceb2da9e86343b9fa003
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FileSyncFS.dll
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\FileSyncFS.dll
          • Size 1.1MB
          • SHA256 060e0c8dc33ad5e14c211bb21ead7faa4e429efd9b1baec8e9f9907ee2e47f18
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FileSyncHost.DLL
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\FileSyncHost.DLL
          • Size 531KB
          • SHA256 8569ef10e11a8b14731d6ec368c08b3ab7e839bcf17957bc0d02fb32273dc31f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FileSyncSqlite3.dll
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\FileSyncSqlite3.dll
          • Size 753KB
          • SHA256 7c1269c7efb09daacf404941a9919ee8d40200fb8cd677b032725fec5b48156e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FileSyncTelemetryExtensions.dll
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\FileSyncTelemetryExtensions.dll
          • Size 1.0MB
          • SHA256 574ca7a45a22816e18cd9d2382e4d8ee3110a52d6bb3f0e26d11883487f2038b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LoggingPlatform.DLL
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\LoggingPlatform.DLL
          • Size 709KB
          • SHA256 4958443ac2108acb50a3c22905776249ea0498480a1c6f6fa2ac4e540d38aa38
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OneDriveSmallTile.contrast-black_scale-100.png
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png
          • Size 563B
          • SHA256 5b9b49b6af48eb7551c3dd2a62a6a49ae6740b2b49010bb5b006cf85b4e54f44
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          OneDriveSmallTile.contrast-black_scale-125.png
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png
          • Size 874B
          • SHA256 37a6ca2212efeb34d8905ea08c81bd6f4cf884e4d009c245927618dd61e50537
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          OneDriveSmallTile.contrast-black_scale-150.png
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png
          • Size 962B
          • SHA256 c191a3138fdc51ccc4eaf8979f44fc4cff3ab96593e21371845cd7967971efbc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          OneDriveSmallTile.contrast-black_scale-200.png
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png
          • Size 1KB
          • SHA256 ee2b6b8103ac0dd5ad593e6b5106df0e8e5f1459682cfc6349d803c5802c2dd7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          OneDriveSmallTile.contrast-black_scale-400.png
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png
          • Size 2KB
          • SHA256 82d5e6a7643d34d618c7fd2cd38c63a360230a72211619c2ca8d70514b6eff6b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          PhotosSquare44x44Logo.altform-lightunplated_targetsize-16.png
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\LogoImages\PhotosSquare44x44Logo.altform-lightunplated_targetsize-16.png
          • Size 768B
          • SHA256 4fe026cd0890165668f2c0597992dd0b79e996496bc125a7beb4c4680d0d3227
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          PhotosSquare44x44Logo.altform-lightunplated_targetsize-24.png
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\LogoImages\PhotosSquare44x44Logo.altform-lightunplated_targetsize-24.png
          • Size 1KB
          • SHA256 33ee6f7430e34325f95f9b24679d602c31821587b1310b43e47aa1d6a4334f30
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          PhotosSquare44x44Logo.altform-lightunplated_targetsize-256.png
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\LogoImages\PhotosSquare44x44Logo.altform-lightunplated_targetsize-256.png
          • Size 58KB
          • SHA256 73f63a98f6721664516f8dd8043e8cb31a1345335f124ddfefaaa9fb83b2980a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PhotosSquare44x44Logo.altform-lightunplated_targetsize-32.png
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\LogoImages\PhotosSquare44x44Logo.altform-lightunplated_targetsize-32.png
          • Size 1KB
          • SHA256 9b047e84ca4555b15c9676a39279877367ef130fb2a91e4d255f7624392e3273
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          PhotosSquare44x44Logo.altform-lightunplated_targetsize-48.png
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\LogoImages\PhotosSquare44x44Logo.altform-lightunplated_targetsize-48.png
          • Size 3KB
          • SHA256 3f8517132701d52a31520148564d5150ff77ac83943d0ff5a746599f01d5e0b1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSVCP140.dll
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\MSVCP140.dll
          • Size 530KB
          • SHA256 e7594b19bb9daa19960cfba71d36cca2bf69edd0b083ff59085910890172eabd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ODResult.dll
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\ODResult.dll
          • Size 50KB
          • SHA256 b0bc6b126e9f012ea4b2013d755b8ff1d2de43d7e33bed77a21fd182d0fe3520
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OneDrive.Sync.Service.dll
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\OneDrive.Sync.Service.dll
          • Size 48.8MB
          • SHA256 16fbf74be5ee087acc6a4508702934cd7ba55d89ceff2cd8e99e0ae16d143c1f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OneDrive.Sync.Service.exe
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\OneDrive.Sync.Service.exe
          • Size 944KB
          • SHA256 32d94f605cde7ca6a9a1db79f72a063f9314503ccd9fe53071ae29e0262bfe6e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OneDriveLauncher.exe
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\OneDriveLauncher.exe
          • Size 845KB
          • SHA256 1a12209da8f9813aa7a6e0f51be5501a6e201a8b7e78b3d4b8cf5b1f9eefa1b0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OneDriveTelemetryStable.dll
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\OneDriveTelemetryStable.dll
          • Size 2.4MB
          • SHA256 6ce989b094ce06555b9044a13dbf23356c8828ede48155d73cc8ba7a57c3a56f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Telemetry.dll
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\Telemetry.dll
          • Size 1.1MB
          • SHA256 6862b6ddbc586d45be45cb853a5a3683885b1161bd41725e716dd1687145d481
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UpdateRingSettings.dll
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\UpdateRingSettings.dll
          • Size 775KB
          • SHA256 6078fe9a28789fe80a160f57d20a53b5027fb752e0d5f8468300f48b245d3b57
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\VCRUNTIME140_1.dll
          • Size 36KB
          • SHA256 2287d47793007a27b3030b98ca6a47e58e8f9e220f28344ded961708518514ae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pa-Arab-PK.json
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\WebAssets\static\strings\pa-Arab-PK.json
          • Size 67KB
          • SHA256 b2acd31a7520d206650ff4f21c0c825b920e6fb32b18026ed51e6855ad7f37c1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcp140_atomic_wait.dll
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\msvcp140_atomic_wait.dll
          • Size 37KB
          • SHA256 ba99b5049883c2b94096494ab1c218a2c37fbb6aa8367d889e2c27cea3f354b6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          localizable.json
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\pa-Arab-PK\localizable.json
          • Size 4B
          • SHA256 e3566b3a06430868d71e9287dfd6c6c520a3da027aabea01951d407ee131dc2f
          • MD5 SHA1 SHA512
          Submit Download

          od4-localizable.json
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\pa-Arab-PK\od4-localizable.json
          • Size 179KB
          • SHA256 ad8093883c02f6cc218bef464ae500cc44490212511884336964c8d67fca7365
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcruntime140.dll
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.168.0830.0006\vcruntime140.dll
          • Size 110KB
          • SHA256 f01524a86eca057fac79e69ddd5f01df4a7c1f75fb4958043296fd9b46ae8c8b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.ListSync.Thumbnails.db
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.ListSync.Thumbnails.db
          • Size 832KB
          • SHA256 536ffda0df7777427e82176b7f3d6b0fb4b99056993a5d884a0210f5e24287b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.ListSync.Thumbnails.db
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.ListSync.Thumbnails.db
          • Size 832KB
          • SHA256 2acabb069c0bf61eed0fb95267201be91d9db836984b569d5aa0eb48f74d204f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.ListSync.Thumbnails.db-wal
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.ListSync.Thumbnails.db-wal
          • Size 64KB
          • SHA256 f325c248cc65d585daab3ccdfe9a5222bf7bbd8efe003c2564c101abae7543b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.LocalContent.db
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.LocalContent.db
          • Size 368KB
          • SHA256 6e56ef4b3fb68b99b421171d03cb15f66523bfb78be4011f41bfb841b68a8739
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.LocalContent.db
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.LocalContent.db
          • Size 368KB
          • SHA256 277665bf51b0f92ff0850a064e0baf03c8831b230de6517f4dde1d0df24afb48
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.LocalContent.db-wal
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.LocalContent.db-wal
          • Size 32KB
          • SHA256 edc3e0af9ece4a5bd322322891659fdcd696d41a0ebd2de3a38f045999d96c7b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.ListSync.Settings.db
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\UnAuthenticated\settings\Microsoft.ListSync.Settings.db
          • Size 16KB
          • SHA256 a8079780e67ad92fa6e3528bdb7d7b28b9022b273115521d9485a281ed878bf8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NucleusUpdateRingConfig.json
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\NucleusUpdateRingConfig.json
          • Size 103KB
          • SHA256 112a004d1d60969f17fe09d0cd4f0ef334469c9265eb82e2939df5b280095562
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OneDriveStandaloneUpdater.exe
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
          • Size 4.2MB
          • SHA256 bc6aae0c15c3a7313085b9761874611cd9bccfdda074344b4c5c7c502bfb16c4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          telemetry-dll-ramp-value.txt
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\telemetry-dll-ramp-value.txt
          • Size 12B
          • SHA256 9dc5a9e2a0093ab9a71a2103a2a3f73b89598356944046c69dd36166cb12e774
          • MD5 SHA1 SHA512
          Submit Download

          memory/712-1-0x0000000140000000-0x0000000140050000-memory.dmp
          Download

          memory/712-0-0x0000000140000000-0x0000000140050000-memory.dmp
          Download

          memory/1304-3698-0x000001AC3D190000-0x000001AC3D3EE000-memory.dmp
          Download

          memory/1304-3699-0x000001AC3DCC0000-0x000001AC40DA3000-memory.dmp
          Download

          memory/3048-2-0x0000000140000000-0x0000000140492000-memory.dmp
          Download

          memory/3048-8-0x0000000140000000-0x0000000140492000-memory.dmp
          Download

          memory/3048-22-0x0000000140000000-0x0000000140492000-memory.dmp
          Download

          memory/5280-3750-0x0000027F225B0000-0x0000027F2280E000-memory.dmp
          Download

          memory/5280-3758-0x0000027F225B0000-0x0000027F2280E000-memory.dmp
          Download

          memory/5724-3793-0x000002352DEB0000-0x0000023530F93000-memory.dmp
          Download