Overview
overview
6Static
static
5SiloAI.exe
windows10-2004-x64
6SiloAI.exe
windows11-ltsc_2024-x64
6bin/res.exe
windows10-2004-x64
4bin/res.exe
windows11-ltsc_2024-x64
4bin/tor.exe
windows10-2004-x64
3bin/tor.exe
windows11-ltsc_2024-x64
3version.dll
windows10-2004-x64
4version.dll
windows11-ltsc_2024-x64
4vresion.dll
windows10-2004-x64
1Analysis
- max time kernel
149s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 10:51
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
SiloAI.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
SiloAI.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
Behavioral task
behavioral3
Sample
bin/res.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
bin/res.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
bin/tor.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
bin/tor.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
version.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
version.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
vresion.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target SiloAI.exe
- Size 4.2MB
- Sample261027-mx2dhadt6l
- SHA256 4dbedc9ed26ca15103eafef15f9b7bdcacaedc61b1e61ef5ce393dbdf4888aba
- MD5 98133fa62a46e79226e839ebc4e14d5e
- SHA1 e73042b4d75cfcb1ebe42d1014a884a9dbb6f81d
- SHA512 d5321c6b764cd69736bf0b42977ef3c38f7d99266fbf0d1decb4af21f8ed6c3aa8bedb5b515c24b78e356106183437b9cc443d061675f69a6ac334f4ee7514b1
- SSDEEP 49152:bNuCHZGcaRsw0qJ5Y0Sx/MAKUqR/Db2V9q1BwhC9dc02e7BOZTHkvu:HMRIVI9fFqkvu
- TLSH T170264A0BA7F901F4D0BBD1798AA79517FAB2B859873197DF0290465A0F237E09E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\"" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\"" OneDriveSetup.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\OneDrive\desktop.ini FileSyncConfig.exe - Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: OneDrive.Sync.Service.exe File opened (read-only) \??\F: OneDrive.Sync.Service.exe File opened (read-only) \??\E: OneDrive.Sync.Service.exe File opened (read-only) \??\F: OneDrive.Sync.Service.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
ioc Process \??\VBoxMiniRdrDN res.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks system information in the registry 2 TTPs 12 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OneDriveSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OneDrive.Sync.Service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OneDrive.Sync.Service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OneDriveLauncher.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OneDriveLauncher.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OneDrive.Sync.Service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OneDrive.Sync.Service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OneDriveSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OneDriveSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OneDriveSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer OneDriveStandaloneUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName OneDriveStandaloneUpdater.exe - Executes dropped EXE 7 IoCs
pid Process 4752 OneDriveSetup.exe 4664 OneDriveSetup.exe 5872 FileSyncConfig.exe 6040 OneDrive.Sync.Service.exe 5476 OneDriveLauncher.exe 1852 OneDriveStandaloneUpdater.exe 5976 OneDrive.Sync.Service.exe - Loads dropped DLL 64 IoCs
pid Process 5872 FileSyncConfig.exe 5872 FileSyncConfig.exe 5872 FileSyncConfig.exe 5872 FileSyncConfig.exe 5872 FileSyncConfig.exe 5872 FileSyncConfig.exe 5872 FileSyncConfig.exe 5872 FileSyncConfig.exe 5872 FileSyncConfig.exe 5872 FileSyncConfig.exe 5872 FileSyncConfig.exe 5872 FileSyncConfig.exe 5872 FileSyncConfig.exe 5872 FileSyncConfig.exe 5872 FileSyncConfig.exe 5872 FileSyncConfig.exe 5872 FileSyncConfig.exe 5872 FileSyncConfig.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 5476 OneDriveLauncher.exe 5476 OneDriveLauncher.exe 5476 OneDriveLauncher.exe 5476 OneDriveLauncher.exe 5476 OneDriveLauncher.exe 5476 OneDriveLauncher.exe 5476 OneDriveLauncher.exe 5476 OneDriveLauncher.exe 5476 OneDriveLauncher.exe 5476 OneDriveLauncher.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 6040 OneDrive.Sync.Service.exe 5976 OneDrive.Sync.Service.exe 5976 OneDrive.Sync.Service.exe - Modifies system executable filetype association 2 TTPs 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}" OneDriveSetup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname OneDriveLauncher.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain OneDriveLauncher.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname OneDrive.Sync.Service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname OneDrive.Sync.Service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname OneDriveSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain OneDriveSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname OneDriveSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain OneDriveSetup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname OneDriveStandaloneUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain OneDriveStandaloneUpdater.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain OneDrive.Sync.Service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain OneDrive.Sync.Service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname SiloAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain SiloAI.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS res.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer res.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName res.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION OneDriveSetup.exe Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000" OneDriveSetup.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}\TypeLib\Version = "1.0" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}\TypeLib\Version = "1.0" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\LocalServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Interface\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E}\ = "ISyncEngineOcsi" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Interface\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E}\ProxyStubClsid32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\.copilot\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\26.183.0920.0005\\OneDriveFileLauncher.exe,-103" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Directory\Background\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_CLASSES\OOBEREQUESTHANDLER.OOBEREQUESTHANDLER.1\CLSID OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\Interface\{1b7aed4f-fcaf-4da4-8795-c03e635d8edc}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\msonedrivesyncserviceclient\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\26.183.0920.0005\\OneDrive.Sync.Service.exe" OneDrive.Sync.Service.exe Key deleted \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_CLASSES\WOW6432NODE\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\PROGID OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_CLASSES\CLSID\{389510B7-9E58-40D7-98BF-60B911CB0EA9}\VERSIONINDEPENDENTPROGID OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\ = "ISetSelectiveSyncInformationCallback" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\CLSID\{3A308EFE-656D-46BB-9963-0A41C0D6BCA2}\ = "SyncEngineEnumeratorProvider Class" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\.agent\DefaultIcon OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_CLASSES\SYNCENGINESTORAGEPROVIDERHANDLERPROXY.SYNCENGINESTORAGEPROVIDERHANDLERPROXY\CURVER OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_CLASSES\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\INPROCSERVER32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\FileSyncClient.FileSyncClient\ = "FileSyncClient Class" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\TypeLib\Version = "1.0" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\ThreadingModel = "Apartment" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\AppID\{EEABD3A3-784D-4334-AAFC-BB13234F17CF}\ = "SyncEngineCOMServer" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\ = "OOBERequestHandler Class" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_CLASSES\WOW6432NODE\INTERFACE\{E9DE26A1-51B2-47B4-B1BF-C87059CC02A7}\PROXYSTUBCLSID32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Interface\{50487D09-FFA9-45E1-8DF5-D457F646CD83}\ = "IFileSyncClient12" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\TypeLib\{F904F88C-E60D-4327-9FA2-865AD075B400}\1.0\FLAGS\ = "0" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_CLASSES\INTERFACE\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E}\PROXYSTUBCLSID32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Interface\{1EDD003E-C446-43C5-8BA0-3778CC4792CC}\ProxyStubClsid32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\TypeLib\{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}\1.0\ = "SyncEngine Type Library" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33} OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9} OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_CLASSES\SYNCENGINEFILEINFOPROVIDER.SYNCENGINEFILEINFOPROVIDER.1\CLSID OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\Interface\{B54E7079-90C9-4C62-A6B8-B2834C33A04A}\TypeLib OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\OOBERequestHandler.OOBERequestHandler\CLSID OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_CLASSES\INTERFACE\{F062BA81-ADFE-4A92-886A-23FD851D6406}\TYPELIB OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\Interface\{2FF96428-73F3-4E3A-9C40-AF2D855AEB0F}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\Interface\{AEEBAD4E-3E0A-415B-9B94-19C499CD7B6A}\TypeLib OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Interface\{1F80F4F0-5D28-40D3-A252-4D3662D5E4BA}\ProxyStubClsid32\ = "{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_CLASSES\INTERFACE\{2692D1F2-2C7C-4AE0-8E73-8F37736C912D}\TYPELIB OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_CLASSES\WOW6432NODE\INTERFACE\{31508CC7-9BC7-494B-9D0F-7B1C7F144182}\PROXYSTUBCLSID32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\26.183.0920.0005\\FileCoAuth.exe\"" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\Interface\{EE6A6D4E-1A56-48E1-8AFF-268072B66738}\ProxyStubClsid32\ = "{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\.loop\shell\open\command OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}\TypeLib OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\TypeLib OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\ThreadingModel = "Apartment" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\SyncEngineFileInfoProvider.SyncEngineFileInfoProvider.1\CLSID OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\Interface\{B05D37A9-03A2-45CF-8850-F660DF0CBF07}\ = "IOneDriveInfoProvider" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Interface\{C47B67D4-BA96-44BC-AB9E-1CAC8EEA9E93}\ProxyStubClsid32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\odopen\shell\open\command OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\Interface\{13987a48-a837-465d-b6be-8302db0e4ce6}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32 OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\26.183.0920.0005\\FileCoAuth.exe\"" OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Interface\{EB3EED27-BCC1-4E91-A65B-9C2AFB189F4F}\ = "ISyncEngineEnumeratorProvider" OneDriveSetup.exe Key deleted \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_CLASSES\INTERFACE\{390AF5A7-1390-4255-9BC9-935BFCFA5D57}\PROXYSTUBCLSID32 OneDriveSetup.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\Interface\{1196AE48-D92B-4BC7-85DE-664EC3F761F1} OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}" OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\ContextMenuOptIn OneDriveSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\WOW6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\VersionIndependentProgID\ = "SyncEngineFileInfoProvider.SyncEngineFileInfoProvider" OneDriveSetup.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 4712 SiloAI.exe 4712 SiloAI.exe 4712 SiloAI.exe 4712 SiloAI.exe 4752 OneDriveSetup.exe 4752 OneDriveSetup.exe 4752 OneDriveSetup.exe 4752 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 4664 OneDriveSetup.exe 1852 OneDriveStandaloneUpdater.exe 1852 OneDriveStandaloneUpdater.exe 5976 OneDrive.Sync.Service.exe 5976 OneDrive.Sync.Service.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeSystemEnvironmentPrivilege 4836 res.exe Token: SeIncreaseQuotaPrivilege 4752 OneDriveSetup.exe Token: SeIncreaseQuotaPrivilege 4664 OneDriveSetup.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4712 wrote to memory of 4836 4712 SiloAI.exe 93 PID 4712 wrote to memory of 4752 4712 SiloAI.exe 95 PID 4664 wrote to memory of 5872 4664 OneDriveSetup.exe 100 PID 1852 wrote to memory of 5976 1852 OneDriveStandaloneUpdater.exe 109 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection OneDrive.Sync.Service.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection OneDrive.Sync.Service.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SiloAI.exe"C:\Users\Admin\AppData\Local\Temp\SiloAI.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\bin\res.exe"C:\Users\Admin\AppData\Local\Temp\bin\res.exe"2⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update /updateSource:ODSU2⤵
- Checks system information in the registry
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4752 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /updateSource:ODSU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix /RegisterOneDriveLauncherAutoStartTask /EnableOneDriveLauncherRampDownloads /EnableDeltaBuildToTelemetryFeatureSet /ArgPerformNucleusLocalAccessRepair /PerformEdgeNucleusRepair /PerformChromeNucleusRepair /NucleusLNARepairVersion:1 /AddOD4PhotosShortcu /DisableRedirectionForShortCuts3⤵
- Adds Run key to start application
- Checks system information in the registry
- Executes dropped EXE
- Modifies system executable filetype association
- Reads the TCP/IP host and domain name from the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\FileSyncConfig.exe"4⤵
- Drops desktop.ini file(s)
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5872
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\OneDrive.Sync.Service.exe/silentConfig4⤵
- Enumerates connected drives
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- System policy modification
PID:6040
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4360
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\OneDriveLauncher.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\OneDriveLauncher.exe1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:5476
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe1⤵
- Checks system information in the registry
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\OneDrive.Sync.Service.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\OneDrive.Sync.Service.exe" /silentConfig2⤵
- Enumerates connected drives
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:5976
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\Assets\Square44x44Logo.altform-unplated_targetsize-256.png
- Size 38KB
- SHA256 f21d962c5327933d43c887e1d0531a116fb71cf0075126d9fd5eaa58447a055c
- MD5 2e5aa4725dfa1dd1b830850a67e91de3
- SHA1 f95890d18ba8f2553150b65d08df0d5a62685d48
- SHA512 9b7aadc90730c839c1a33ef15f9e87f69f57d0fe68f8e618269517ad9fd43d81d4f661a7bc17f3fccb174b6a15aa1265633e98a666ad9321572c76c0661db6da
- SSDEEP 768:1TybQFwVa0EWHLrrow7oZk0aQDTHYNbE52IFKRQHsaexuDDp+6WFt:V6Ha0tProw7Wk0acHdiQHmuDDp+t
- TLSH T1F603E1109E8ECB2B2B069EE295C24D120FD9B79D7CB6503D90D9CD669484AD03F327BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\Copilot\Strings\HY-AM\Resources.resw
- Size 221B
- SHA256 1f762fa2d859cab49e93ca9ce8ef24edc4409ac75de77dc8781cb06ae4ee7f3f
- MD5 19638dd07d7bb7e3429874af1375ecf9
- SHA1 17843afc8c73bdf38c81e86f86c01323010690c5
- SHA512 f2548e201d60cd175b5545607417716e3626f243f11ceb4e93770e07f291072a6e8a18f376e3d34d99eeb8fb135cd68d16fd37a3c3c1bf43d208be6f7da2e847
- TLSH T1EED0A710B9D4EC551476021B5C37504D99B0A7B41260B0193DE5DA473D51DD8A8E3284
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\FileSyncConfig.exe
- Size 879KB
- SHA256 25416c7166987c063af5d71af7de9d82f3b62b1e969b1c2bc2239e8fb8194899
- MD5 bc5280b94d7198bdbe370ab70c407111
- SHA1 3b50a2cfc3421f9ffd7518be6c58963d2a42b621
- SHA512 9da6cbaf6cc426df7ebac54477c06929e7cb11da9256360f1eff65cda1075da8f8a45cb4edfb26b71d8b5e60384bef8abb0ab99312228a511761b14a862e91a5
- SSDEEP 12288:C5WX5UnVOTC9FnTeWbBr/vXqWD5O/jhUJNQ7FnYIRFFGil:Ca5UnVOTOTemqWD5O/8NK3RFFGil
- TLSH T1FB154C1A62A802F9D0FBD2B8CD974417F672BC164732DADF02A1455D6F376E08E3B660
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\FileSyncEvents.dll
- Size 134KB
- SHA256 7b7af331dde51ace0504022e8346a8e918bce6f07351d03823bf6958cf701c16
- MD5 9bf072f3dfbb561af65fd83b3a3f6994
- SHA1 aecc6f2bf0b804a1e0fde26c123e251dfce28d78
- SHA512 ab31d371fc556097f1717ee35cb0abac95255e93724d987fb801c73f7a2caeb93d46ac5d6349d8fc676c30ca0e6841f1ca815b1fc5cf1fc22202c8c64403dd74
- SSDEEP 3072:TRWaudTUXI7zEbUYRf44p+5Pbe0wnawXZSRM4Y8Bx:dI7zCzPpq/RMux
- TLSH T16FD339577358008AE519D1B98EA7C957FB33BCA6172297CF13A5D30A4FA36E04DBA210
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\FileSyncFS.dll
- Size 1.1MB
- SHA256 fc2e19a2f3fe1a87aaf8af938ec9eb83df705e0bc635101a6d287ee5e0572d48
- MD5 c4aabb07d0b350846b7c1ffbf46f7481
- SHA1 97f5fd86ae4cb8a988759a02097a0f8d18de2a84
- SHA512 a71adaac97198482dbe08ccba7ec92e915beb7785a3194caa7756284df6586e6c48c33443645a9bc7abc0c43c1b3a3b097eaa4ee2a0d9d8568d4ff3d21889b95
- SSDEEP 24576:Oq+K9LR58DpmICd8aQKB1GYfqyjA7ngeg:SKBADpmIlaQKB1hpjjN
- TLSH T18D356D1767AC01A7D4BAE2F9CDA74917E7B2B84A43329ACB03A1920D5F577D0493F720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\FileSyncHost.DLL
- Size 531KB
- SHA256 78a8bac75691aa9b3063cb8c08d06079ff418b068a2bb1c1a10145cc992d378e
- MD5 702abb0e5b094a6f103ac372645f11aa
- SHA1 5afc39b4a51d4f3e5a9c3f94dec71adfbf289a24
- SHA512 d1e8c3fef3922ac6858696bd74d5b02743e6a7d5ddd53c84e2fdd8aa6db9d22d0fded88f56e18351b285a619e841588dbd0bf9b1bb54d2bf049dde0c0c7bb9b0
- SSDEEP 12288:UW5zmUIJupwQObMoL2kk52wsX5/ZmY3Pdhtmp:UW5zHIJhTL852wYdZ/ap
- TLSH T13AC43A1AA2A807B5D1EAD1B88A67880BE773BC554722D6CF13E1D56D0F37BD0853B720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\FileSyncSqlite3.dll
- Size 753KB
- SHA256 291cbde386145e3352859ff3b5644d3496a59f6ff459d906bb941c46f02bba4b
- MD5 a941fce5b6cc104a06c1e2335062093f
- SHA1 428e7ead884b794c6852992a583d0bc91688ba96
- SHA512 5d8e951c90f3166e4b135044088bbf347694cb2cff30172e95ab276864735448f04915e1b55ec850a7f8aa367892a015a1fe213423107a04ed3d9683b42849fc
- SSDEEP 12288:N2kFjA2sekHmuW7mcfydvSaUWIZHM5OvjbjiYlSd4V6TSHm09HYYnDrK0:N2kFjA2seKmuqTfOvSiz5OLdllIObYe
- TLSH T194F48D5AA7A901B8E4679279C9574617EFF2F405237087CB91908A4E7F13BF21B3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\FileSyncTelemetryExtensions.dll
- Size 1.0MB
- SHA256 c4f87a6cd90b5e68583e098125176da41511ad7bbe64913585e8d493a72dd58f
- MD5 99b393003bcc2200fc04e759ecbb77cb
- SHA1 7321fb020ab4744aeb20f92286b1cc86dcbfda86
- SHA512 ea0f595fe7b6924467f0b18d387c83f548f0763bd96c8e8bd7445d700d14ca119430476345987c706ce37f3e6ab8ec1aacb4a786643c1d8da6735603a17de79e
- SSDEEP 12288:21qnPDbOBj6WzMf/Y7cNlY+xjpYYz46SywT:21qgDzMf/Y71+xjW66
- TLSH T12635942F99D7BBA4D5C88173E6741E8778EC60E873B86072D66440208E9C5F192FED63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LoggingPlatform.DLL
- Size 712KB
- SHA256 2f643522b900152021ef415fa36f5c2068499e3ef0b84a768da8e9989fc75283
- MD5 1d345066f41cdc47400f10e1f3671662
- SHA1 4c4a5dffd7e81c210bef5cf52caa1825e615467e
- SHA512 441a8325137e8fd5ff5f784cefd9e988865ae51a0ddf32ed13d04d037117e0924a7b8c3d6d0ef3fc4189f0c3dce6469f862d5264b4dd9c8f8a2ed5e5c796e068
- SSDEEP 12288:1ZXNwnE5pX6/re9q9K0BWqnAxYIYqcGYF8P9cE96m:1ZdwnOX6i/qnAOIYqcGYF+9cg
- TLSH T11BF46D2AAAA802A8D1FAD2B8CD634417F773BC554732D6CB0390956E5F277D05A3F720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveMedTile.contrast-black_scale-100.png
- Size 965B
- SHA256 3910d0976a41bc9802e6c1460c441f0ce5bf6520b47e2e7f1237eea0342553cf
- MD5 d635128a586a11b8bc6643ca430da338
- SHA1 dce9874bbc095f922fb117ca0eb4633c263d3876
- SHA512 45732a40485708da65970119ad31289cb7a36bc43254370effc2c1c1bec27a8932aa378aaeee4bbc6e2ee45424abf3a5dc1c457588b99df863f6dff886df6ad5
- TLSH T1521188F5477DA71EF4DC86F7206930EC455F83E6067E460D4D5035205892A0C20A07D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveMedTile.contrast-black_scale-125.png
- Size 1KB
- SHA256 7876f97812c78b2a6a6857b748cfcb083654b0df7a9968d28a337f553c9bb740
- MD5 37d99de37e5e0a880b1e7e92af4f2414
- SHA1 2f4383a6c27d03e37c27d55bf18c81f7e448df88
- SHA512 435584c224d442eedd0a2d92bdcf11a8263950e04f50d4b6e5df16cb96ff44447de8cca56de09cca163355c63d5695de72c4508496c534be2309dd9cdde47090
- TLSH T17521C6EF7AEAA97FE02B303A5A5111E2411F8027C8003D096EB866B16A7936092667D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveMedTile.contrast-black_scale-150.png
- Size 1KB
- SHA256 49bac30adc5e19520c9aef662bf6ab7f825d17de893f49f935f52bb58231d912
- MD5 f0a8471454b9457e787c5107a669704e
- SHA1 d6296385e16bf20cffa7abe0b626ef650474b869
- SHA512 1e81ad245b17b9f0a51cbc882f61fe852ef86b11af67fab70c21d248f1c6fae83bcf52ed9d5ddf19979d6917aab99bf5111807c028c5baec6b9b1f29f6a8713a
- TLSH T18431D8129635897FCF8D8771957D8D0562C3AD3CE75432DD1AE01A250A3A974059E0F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveMedTile.contrast-black_scale-200.png
- Size 1KB
- SHA256 06c80abf5996c0f80d90db0335ec7d77e756fbbea33e97b399e58eda97be5f77
- MD5 dd05cf58f3f493f7eb04faf889232e3f
- SHA1 8e03035ab0fce9dd0f18b3c61b43e612e393292d
- SHA512 e48727ac4185c289b572f729d0f86e51d5a56e504bc89a548f80337b417741e6c0a7cb1e3aa9ff0c784482b2dc034bd0eb4bbf08c8f5707c758f3ac70fa0bdb9
- TLSH T16241E9BC99CEC426D9A24EB2839C082274A63FC744A067941AD085820E48EB48FEC596
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveMedTile.contrast-black_scale-400.png
- Size 4KB
- SHA256 0048c2fbe78c434315a40c489a6233de3eaac4877d3ab3b87f233de97ef45760
- MD5 6cee6177303ddc4dc6ff243c4e066537
- SHA1 c35e27cbef07f2c29e95e677e637adb2a70e4b7a
- SHA512 0cada45d061bfa990265e3dbbabdb902cb2a3364564310bb611e6e4da2ab2b80910f8bdff21240c8fedd8e8acfcffa457d8aab19e443951d8a81c7dda8c19b00
- SSDEEP 96:9SNbFu3l/nCJnfP8ut2UriYSdAzVGh7AX5sg6:9SxFu3pCFHnlrieVcx
- TLSH T17EA15CC7249DF17BD46BA133026C86E8B8F7399487AC36A5967132CD4B135E5CE4D102
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveMedTile.contrast-white_scale-100.png
- Size 898B
- SHA256 d66500db2be2a08e1fbe3c25bfb3f8f92af7c1222ae01d983ff01f28e161a173
- MD5 9fd897bb6d2d83c0c2874f0bd977532a
- SHA1 d45a0a45487a3875b2ec53d5949089269f5a42c5
- SHA512 99a1dcc62612b7491b275158d98074a26ff5a04b685a76ce6d810fa3c184b940922b0012d6aacc271bb67e86670cc4ca51a2c2bcda41eb9871bb2b16f5904a11
- TLSH T1C4112FC4EE8514F9CA8A8EF754976B9112322B0DAB94661BB74869B855004CC090A2FC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveMedTile.contrast-white_scale-125.png
- Size 1KB
- SHA256 684f98e53e6508ade14997324ed729b2dbd54fc95ff0d0cf242a0af2ff87b296
- MD5 8e64cb13b83fdc456f799a8d468cd4ff
- SHA1 e781ed50c2247bd78f1f5c3aa1663b5e256d716d
- SHA512 d4c4a7a174c8d18b4803312f6506e80d3ea23643af7cf6a28e3f374aa29668bd17b6694637a891c2c9b6353dc4378fecda80344edba4844140fbfa4a0ce4dfd8
- TLSH T1A62118E5AE5AA118D8578138C55FFCF190272807A85FFC302F8030E81600B497E36FE2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveMedTile.contrast-white_scale-150.png
- Size 1KB
- SHA256 f1758274ecb3b62b6324055d6ebfe894fb022af30d646c26ff75245ffe07e97a
- MD5 fdd4e3bb210ea902687788de2582946e
- SHA1 3f54d394be273f8f7d179cff1b7238a454c561db
- SHA512 a3d564f0eb98ae266752148ff78bd8438f03f78002057baf1929349e833212ac82d73a99fa2d273ca3325e95d5a9be16f5c230373684782461074a3d76536d99
- TLSH T13A2187EF17D97C14C95B4FB9E67A7AB0891F2F0424114780481901E29E3D4414AD4AD5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveMedTile.contrast-white_scale-200.png
- Size 1KB
- SHA256 969e3c485b450ad929616ae0f64408afb25098a8e32993d92e84a6558d3ad8a3
- MD5 d9a0baf2ad9f556e02055b5df310bad5
- SHA1 89fd7ea535ddd01f332848e11db835be0acf31b2
- SHA512 4493b500563af82b955694793a19d0e1821162f6ae6abb8fbaa4f455a41b122db753696ae357c2dae81ab0018d432b791724847946feae4a612dc647acbb3741
- TLSH T108312AC61DA939F8D918CB32C8310D58B8C22B12453357C01A2D1DDFD9B0E8C47D64E0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveMedTile.contrast-white_scale-400.png
- Size 4KB
- SHA256 2167f453dec79f0f053913908fb0eb74b54342f9f298dffeee339712bae851e4
- MD5 387e0eaae22c86ef0f9086703675f546
- SHA1 0b216d6f6c570fd2ee7e214af38671fb3e9dc7d6
- SHA512 7620f497f4935317ef01cbc1e93f8396f7684f0a13d5fe08ef2f1c69450e8fe9fe9d26a0d0da2c42b685ad2293a84918a49a9e1af6c1438eea7d3d5f507ec863
- SSDEEP 96:9Sj1yh70iOWgmvD5xDUQX02WIZHt9cR5CX:9Sjkh7bpvfgU0cHtU5A
- TLSH T152914C9D079CD179CE662235D98A06A92C3F3CBD268A9052950BB0B305A379167264DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveMedTile.scale-100.png
- Size 5KB
- SHA256 ee57225deb5b003c11d84f099a3cfe378ada230aaa89c6d7fc6334a21ce7dc06
- MD5 ff1bcb9da494dc82c33d72d254e685f0
- SHA1 a53c1067d1c62d5af3fa940bcc10db919ac0cbab
- SHA512 891d8dabc1edc132a8e559e635a24f9b978462a43aa5b722b58a6b0fdc1ddf00b49de29c4dd00a42d7c0597a5c1765958844b80e013712da4dbc36414429b5b6
- SSDEEP 96:5SZElqpLKR080FknPAC4G08hfQu2gib3HatOB1ihWscAgd/M2veRUufqI:5SZ580FknPRt9xQww6ABsEs1gdM5Uufr
- TLSH T1F3C16D48822CDA4C96CD583CD792523D9B66FC27CA20409D6B709C636D42D8EDE4DD7F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveMedTile.scale-125.png
- Size 8KB
- SHA256 b3ce4ca2c3598012a7815108f0480bfb3b71b834995993a4160752a2577a3b6d
- MD5 be9a752781ffaeff9d8bbeed90d45b91
- SHA1 2c4e6f18b75d7dccd36a4e79003dfd75b79a2cff
- SHA512 1c75d936032ce23acb4bdd8ed215c07bb7763585447443d45f760a59bd961032df9adac11b13b91140e953bea72304020cb3a65862b90fb1873dd03c63127a75
- SSDEEP 192:9S3ifaS/VXPAXOS3SjNTZrqjQIbDBGSzx24piRvU3YkKvP94zbh+yc:83e/ReIroGCp2pvl4zl+yc
- TLSH T1B9029E14FBC10757C4FB767724C574B7A79BD80E6876AE2D7812E43ED089442090EBE6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveMedTile.scale-150.png
- Size 10KB
- SHA256 a285df7d2be2aad1ff4053c3a95ff0016e23051c48bb17bad83c9fb59d8f41d0
- MD5 2b84c5e76851a95e98b474aba8152fc9
- SHA1 6b3017777397b7157c27b8a4e1f8328c73f8bc05
- SHA512 e7e3594f2728d9960cdd020c69b0016a7adcc2fae76cae6ad27ff10d3708f8293c7a048af3b803fac7db25e32d81be4be36364b87c72611ba56842ee7eac509a
- SSDEEP 192:iaOS5WquttsnUxgluNgERWuqnpJ8knWFeTWM6r6FpKD9faobQqaI4C:io5WqfUxgcgeyJDn7TeUuao0qF4C
- TLSH T15322A0D998FDFA21DF57A17020B2CF8BDB5386480AEE96E8DF14369CA811CC86444E49
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveMedTile.scale-200.png
- Size 14KB
- SHA256 c655edecb76d1f95fc64c2742869e54d80f9102a0e0fb8f5824912b7a1f1d6af
- MD5 908859e57528f8057da25c5b2154f065
- SHA1 3d4c6cf6b05f267ea9aa43ba4a0c47464ca69d8e
- SHA512 fc2671d553e28d95e34bcef7ba3eaefb8796402c322d540c05be049ab5b45d5a42e021146535172cfbbe7b90e9205a7a149aebcc5616e70313a9fe10b9de77f7
- SSDEEP 384:bvfUYwHWjJy2c1DiaAeJyrliP23MIczfbTzofYR:rjNJlc1nyq2cdfbfoQR
- TLSH T18462BE80E2BDF934BCC75878E6A64F5B45034944CDC11B0AF964BF8EB289D9DA048AD8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveMedTile.scale-400.png
- Size 48KB
- SHA256 e472291a236bfad76c209b5785c329dbc094fbd70194c21cffd20fe32ab59a12
- MD5 0969de469e60a500eb13864d1edfc318
- SHA1 4d45041beca4202ad12bb660025d9b0883aba910
- SHA512 631df4c5b7f9356c2f57330cb62f2605b74cb22d470792c6653ef933c7603d89ce525c03f63ac69309209b1fa565befd60873f01668afc095918733722c0f550
- SSDEEP 1536:nLNY+lbWM/kXLLnecjWPSnK3q8dcUoqejbwJ0isZRN9/18:LNHlbWM/Kuz+4qUcUo1c0rZRbm
- TLSH T16A23F1E3547D873ACB60A9779ABDA0C77CB619971F71680D7A1238506B540B8FBC7023
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png
- Size 563B
- SHA256 5b9b49b6af48eb7551c3dd2a62a6a49ae6740b2b49010bb5b006cf85b4e54f44
- MD5 5b30085b5e50938bf98cb35640fb1c6f
- SHA1 a6f4ddb0368b532341e5046a1bbe0a4007f3f393
- SHA512 b75226fa58382975a52e556de1ed34e84a834d47a9048d1e6f4855702730a9ee78cf3d05b9e8f90ea18b81a57ab1763b15649d92da36626f5a803fa509f2412a
- TLSH T19CF096F002035D1CCF9FC2B71AFF53D7B25D52C400212C0C34923039982C0CAB10A550
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png
- Size 874B
- SHA256 37a6ca2212efeb34d8905ea08c81bd6f4cf884e4d009c245927618dd61e50537
- MD5 40060690ed4e89bfaa4cdf6b62bf10c1
- SHA1 8a501642ae3ca2fca8b5a9fbeb09642faf64d920
- SHA512 b1bcf0ad4c5db86479c6933fdc877df6291908677d1fff58c07d09b3afdc762f1ec42e34f5f3fffb2b42cdd79204a702d5abf97f9373b8a5f55c3f99283b621e
- TLSH T1D71186F39E6CF34DE96E68B7A486C095BBBD5B1761140105C8622E3D9051CCDCC42E6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png
- Size 962B
- SHA256 c191a3138fdc51ccc4eaf8979f44fc4cff3ab96593e21371845cd7967971efbc
- MD5 b5c1fe27b4496370dd116258600d79d3
- SHA1 a0e4573c1e8dd3b9c711e2ef60ce8fb90c2c51b0
- SHA512 4b649ca9557a66a1e2a859b7ef2eaca770004d5f2a030228c1579339dbaac7c23b23537c0dae04b2c7736c6a1f7bcb0b4ccaaa2e83ed2ad3c3e4bf2b73d6f446
- TLSH T1201184CDDB06B8D5C1059F7A50232DB2F1270F9D2F479AA37BC608005B6989996B1E24
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png
- Size 1KB
- SHA256 ee2b6b8103ac0dd5ad593e6b5106df0e8e5f1459682cfc6349d803c5802c2dd7
- MD5 94f7df106a5a9d491c28101f5b729e70
- SHA1 0ae47dbafacff9b6fd0119cb30d5d32236894bef
- SHA512 2922593a29f11675d4d3ee0d78ca3e5fea92b8a151090afef293f2139f39c8fffe0a585f83ccf7a5800ff5cfabcefe834e4ead37b511746c52a729544e59c170
- TLSH T16A211A9BBC583EB0C57EDFB60B99FC7103030AC4018868880D0BB4AA1272426AB43701
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png
- Size 2KB
- SHA256 82d5e6a7643d34d618c7fd2cd38c63a360230a72211619c2ca8d70514b6eff6b
- MD5 70bd5f9c5c78011d2a39d358911909e3
- SHA1 ec4da9b9eac67be2483558114fb768b68f6b1a08
- SHA512 015aeb96f0e8e09208d71e35fe2ff487ab5c583d0d9810012a3380b88eab1a549faa63b5a14cdc1397caa63a72edf3bdcad78b1db5594f3e293011d37b1ddfb8
- TLSH T122512CDC5D2321F6ECE188B8842EBD40BE5358F48E271401A4819832D579E51DF95C07
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveSmallTile.scale-100.png
- Size 1KB
- SHA256 1c1975f56416589fd0aa9add4c44a87c5dfd71ca365630e40e9f64bde6f0e49c
- MD5 635c7e6f9c9a77202ca96e8c68899321
- SHA1 0dbc327ae14c76fafe2d5fc860eec45a7414c974
- SHA512 cc7a8175fce47f3db218a9279d244d7f1391d56fc2d7e3603a558baaa555ec7d84ce27dfc5e581952a7f76d65c2ac4c4bf2b1b28c8c41cf84db84e0e4ee691c5
- TLSH T14531089FC22D50E5730F6E8F8C7F8A411897E3740287B10AB5280A30283BD294837ADB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveSmallTile.scale-125.png
- Size 5KB
- SHA256 46a6e452b5bf41b9ae867aec03f38bc5970b6c8a3128387b0b4c75cc203db9f9
- MD5 3c81de4ef5b1d3aeffc440404858dcb9
- SHA1 90486aeb79d47cae3d2c143b7436a6b1844d8f91
- SHA512 001f9e29105e6730ca04d2ab198456a59cb3c47f83b3fc408c804789801d4760869331b63365c2357fc5e8540f79c18481c4e6696dcc4716d9fe50406eab686a
- SSDEEP 96:bSB/bHKj+BNstFqpL3V8voyrt5N+q7SNvhvhqkpX+kes5YoXD9Oc/:bS5Kj+BN37Sr77SrpqO+kesvXhOc/
- TLSH T1F4B17DD230610ECA83CA9570B16B7421EFE62EC90152C1D18EB36311DF67695CFF5766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveSmallTile.scale-150.png
- Size 6KB
- SHA256 4e80205d7bff5c25be88be6f21ea5e32a2edbf115cdf4f26751f2a24a3d5c3d2
- MD5 14ec3144f6e63b10d1a5f84268c5e634
- SHA1 d0a2668cede02a7bb7e86ec081ee0730af01e98a
- SHA512 2f21b1387d5d33a0b42a2a793c432d24a17b6d39db98f6362da45885d38ce6c9a6af224d99725c1754534e950d05c56b5944b720dfa8ecf067d166605b23df25
- SSDEEP 192:tSSYIgYD/JzlAbIvvfIhEWuLuAM9dzOrowSKwe:srYDJibGfp/rok
- TLSH T1DBD1AE909D4838D87BA669928237676354C83CC635A34FD8D04CF3C51E9D299FE91E71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveSmallTile.scale-200.png
- Size 9KB
- SHA256 19d6b52f75aca670c722499bf04a6de7eb9eb6cccdc78f489a73d72417fcf478
- MD5 1499cf8f813f3c22dd0764ef4a695367
- SHA1 2ea9b463553c5d97a33832ee46b600f6d3640620
- SHA512 0fc4d5f1b21b608205f082a19aabf816cf503df1b8650fcc83a3d0d208b4651bf999afb0927b4d3a248e501aa656495108c646bdc073839d88ea1554e70d3c88
- SSDEEP 192:OSJRFyoZ4ZzqBpnJa42GYFmk4iQ14eFFKOl082BYpKTK4odOHrEN06WPBS:xL31JKGOpnhebpl05BY4TVoW4WPk
- TLSH T1F122AD4653BB7182A092A4EF351385A504F10EDDCD8945B3DC8478E39D8E2CB25BA78A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\OneDriveSmallTile.scale-400.png
- Size 22KB
- SHA256 ce53878af8d98b9e2e94374841d4be37c6942e6bccde660d05b86d051ef5f078
- MD5 8fe69f9883b3959993c5069c8612ee57
- SHA1 9bb5a5d31cb99039e8671735ef6130dff7be9f02
- SHA512 e6348fc499af5a5aad8cfb2e1c0aed8644afbd91a19ac671819f4e8f060d33fef0153eb19ce773c979e15718c8a3e857922163ada71324496fdcd88558548d85
- SSDEEP 384:w07l8gzGyVUmGiQKyz0uPLXt5mQUl2gEIusi10jTnanX3Ucym1pHs:NewG4BQKI0yqZ2IuHMsTU
- TLSH T1B9A2D0A969E4D89F1D05721F0737997EE13764C860317809EDD8D7D91632A2BDE10BC3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\PhotosSquare150x150Logo.scale-100.png
- Size 21KB
- SHA256 7b31060527478a8e3ee7910d83fdda8ca59ab4376fe068fd8b0009489551debe
- MD5 9b093b69ad431049b6f75c61bc2cb47e
- SHA1 ec476e7d39bbc5e12bcdf5cf4033fd2ea1210570
- SHA512 2e9770ae2800b855855d36073a45cc37ec8dfe5822de3d131aadec41edd3e8449e5a7c96e53105ae116fcdd5234394cc039ed4151bd843bb4098f7d62861e09e
- SSDEEP 384:3eqAVfTs4W1mMejENSftmljruxRV2BDBewtwUyWGXOvhsF9WCRQo4QSyDFCKEfgi:3evs4WgqEF4PuxRQtEw6UOO5s3J2oPF8
- TLSH T1E0A2D04096135DBED428767AB9077EF2952687603DB27FEE9435B2C285D0B8E8173806
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\PhotosSquare150x150Logo.scale-125.png
- Size 33KB
- SHA256 6bff72c20aa952b48b297f0086e87f79879ef065923954ae034e82685f013982
- MD5 b0968e1a37138d0ac00f815089738093
- SHA1 8d234f182695e6da33e09b86c20fe01562a7bd7f
- SHA512 b0fbdff94ce3e31e3e6135613b0f0641d9aa6fb5c42f60f3128150e6232fddd6986700f6a82ff88067ce63defb2498c67291f808370132ce01765a0dc3bd4771
- SSDEEP 768:6/uz+lpnxBbSP0lH3vY2FSoInuMFZd0Qwe55MXQXt:zzQpxBGwH/VFSLnuMvd0Qwe55MXct
- TLSH T125E2F142E7B13160607DEAF80E40EDF8A1785A73AA616653F771408E5EC9B91B0F0BB5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\PhotosSquare150x150Logo.scale-150.png
- Size 46KB
- SHA256 997e35af34bbb97f0a55cd8f9d0f8a1a11016f9f145e54b4b4c5b98201620f93
- MD5 38f7db353cc68a436784fa0e8adacd3a
- SHA1 0a6c70874ec65b425beb97e054ce355f3b654fd7
- SHA512 515ca46114c4c4dc855ea87127a0e92aa1ded19c7c82293fd53348225787cb1c5156adfb5257cc0a01fb11950d587041122e7b0dda09c6072b622724502e8446
- SSDEEP 768:mfdB1q4mlTY0mhiwuWqsrJy2uJXM3cxJ5hNdixma/p1BKcCJLrhQGVfdf68:mlG4mlSPuuJy2udQqta/pKVjV1C8
- TLSH T11823029FF0D4B4BF06466B3DA521A4AE2407DC2D0268C5F8BBF5A33D5BE83B5A044D50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\PhotosSquare150x150Logo.scale-200.png
- Size 73KB
- SHA256 303d1b92d5e84db12c62c59bafdaeb511817f9a96052e0ab4440749ca31e5107
- MD5 6087a47f5fe97fcb701e9a10f36f37c8
- SHA1 85c7b5c10d394664794b3e3301cc678163d92c4a
- SHA512 0777a1be01c914e14ca498ddca78f08638612d57d8a0be6f32a623f3538b88f490a5393a79e2775220fc23b5772f5c1e1a5ec223d854605d924bb5ef71b7e79e
- SSDEEP 1536:uiDRN10qtk5i+sBjW4iVt39yL27bazCgk2Nfx12q6ag6pIn52BW9wYSF2:uivk8+Oj0Vt39yL+WzCqxkqrguIHSY
- TLSH T1CB7302302602A897147625ED2A5D3E8EAB0DD1223035E0EB1835F5E9F03D7344FDB396
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\PhotosSquare44x44Logo.altform-lightunplated_targetsize-16.png
- Size 768B
- SHA256 4fe026cd0890165668f2c0597992dd0b79e996496bc125a7beb4c4680d0d3227
- MD5 f6590c79cb6bcf344d4a070f9296bf39
- SHA1 e34651210440834f9c904b3444b6588e3e23549b
- SHA512 ff62528fda15203ae4a73e4e9dc3d3a03c06897e4f028aa882a0bb39a3be6c9323564a27e9cf174a64fbe7e68a362bd79446ad7a759550944919be0215518404
- TLSH T15D01C547ADB3A100C016583C03C22810AD3061E939DE21CEAF0FF4C42C0827400BCD11
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\PhotosSquare44x44Logo.altform-lightunplated_targetsize-24.png
- Size 1KB
- SHA256 33ee6f7430e34325f95f9b24679d602c31821587b1310b43e47aa1d6a4334f30
- MD5 02a871b84bdff02f079102c4c24a87a8
- SHA1 aa622fb6bb1d42a5a1b6089de853e2a175713184
- SHA512 7ccc8ede9bce4a9f8f3537cb3f2bb78cacfdb00d99f7e3bc418e2838c501803e7ff248975de29c4d58956c09a421a7987726b55797db8fc2061b31ceb7f98c4b
- TLSH T15B31E9D3BB80482D035EA2B9516259F8A22433FFB0397A843E566D798424CA0658C2EF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\PhotosSquare44x44Logo.altform-lightunplated_targetsize-32.png
- Size 1KB
- SHA256 9b047e84ca4555b15c9676a39279877367ef130fb2a91e4d255f7624392e3273
- MD5 2bd2ac8d930e5aa88cd8742344c33fd8
- SHA1 5ef60efb32886ef6f5b08c615cb5e9e5168732bc
- SHA512 d5aef1e7e16d07ef9999e3ae90d17863ccfa7b9e68cdeae10f3018c55861b7524cf4bd8d7622203b705b2824934f5856144245c4a086e048cc9a692693118ccb
- TLSH T10941F8D2E3CDAA74505EC0B1E762245B51287EB1AEB06088B732D1263D7D2E17660722
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\PhotosSquare44x44Logo.altform-lightunplated_targetsize-48.png
- Size 3KB
- SHA256 3f8517132701d52a31520148564d5150ff77ac83943d0ff5a746599f01d5e0b1
- MD5 17d124cd703886af6bf0fb9e14f61617
- SHA1 aad99008c094d88b9804205b0a8206de99cc0aa0
- SHA512 fb94e685f84c026f31e84f6864c4cffc2f7f9057b2458e010c65bd940bd123fd780f96fd7c54fc0804485bfc3063a041c6d78543f61ec31552f5e3ce3bfaa5cb
- TLSH T118818DE2AE95E318D391BD1562D320B75B3C18D2AFDA868ECFD71B8D337089C0D05619
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\PhotosSquare44x44Logo.scale-100.png
- Size 2KB
- SHA256 6b137a3b7ea0be5358c0428acf8081d3cfe613b72951d21e42c9e404a6cfd66e
- MD5 e33e1eb44e3b8918b44cb8c0014b930a
- SHA1 a21f82a9c9bee2e46da9ff7420fbcd4b8d02bb54
- SHA512 1383486ce6d10577efae908d74f2ba23d767614ebfbca362d7187d3aa93520143e723656d351a9ff278d7990c8afb6bfb604fd96cead1ac413b96daf38ad8ddb
- TLSH T131516C561EFA3ACDB3EC19BB68F73665A3B59F6A8050D3C517801154B008F82F010DB0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\PhotosSquare44x44Logo.scale-125.png
- Size 4KB
- SHA256 34ebc8f9b3b1477dc09aa418e98cc9c6edaee0002fa1603af4db3b3f58f75776
- MD5 c8c9c52412edc1d5c42f5cb29c5b3c38
- SHA1 ced4b78dfe5827f7f334bd7c65071d26b1356a3c
- SHA512 be2436f272bf1dae75ed50dfa98153b141680cc409f108d50b7cecdf5e8816c63450f249d295028ae94e6eef49827eb74063c8579392259ad6feaeb1f26308a9
- SSDEEP 96:+l0ZULvnYch90Co08aWp7/BAB8TiwhT2iZ16jhz:4UQ+C98XqWTzRP0jhz
- TLSH T197816FD0F4D07AD3932EC7CF4D84AA01A6A8D3676DA18AD9F80E4375516CCDD0999020
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\PhotosSquare44x44Logo.scale-150.png
- Size 5KB
- SHA256 ed32c01317c12d117d84c9394f22e4036ad65b38d62127f075a6b25d1d5adc25
- MD5 5da55d446dd60be2efdc067f606c1ead
- SHA1 640745e3c64be27dbc33a8ebe923b81b1f64434f
- SHA512 fb57c43a7d5e882aeb8f5615e0890a62556c9bd29ed19b1f7a7dc10115075f0a7125d3d9d8bbcdec9a20c4746cfedf52fe4f4373cc99048c2f623bfddd7a4a9a
- SSDEEP 96:f7ml2Fakphsm8JZWH+WQT7k/YUSLKBOowXDQdzujtiRvhYnjoprPHR+PN1gSH7zR:fRawhszJMHsUhMVXDQdzujUasrPHR+PF
- TLSH T11CB18FC9331E54FE5C5BB1EF8EE306E2467171E1821D5DF6A6027D785E52811B90D094
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\PhotosSquare44x44Logo.scale-200.png
- Size 8KB
- SHA256 c6c927733060f9a181d4c725d70dfd422c48e6137ee07e58e87dbc56542dfaea
- MD5 63aee050bfc9283b110223951ae1f7c9
- SHA1 939f20bdae68de9e868025b0e7db297b3c649d0c
- SHA512 eda6d9fc7ecaae0712615122297c9b9dca5931805c5daad3d61c12fe6f09664c3b35b2cc4551fadd76e1ae36153c412b1cd427bf2d44b4200bf18e59093e947b
- SSDEEP 192:oxb/m2xY5CvRs7ipuI/quKSmJuj7TYUiQh:oN/LYEpsU/sUDNh
- TLSH T17C029FF87754E7975AC449E6720E63A0ED6A4BEA400B27CAEF94339A53875B00945311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\PhotosSquare44x44Logo.scale-400.png
- Size 29KB
- SHA256 a10d09f50fe80ba4ae6f9e8bce85b960d1c6b657a74c7dba8d767c70838bdd95
- MD5 f5290484a9642b7c7783a324700000aa
- SHA1 1d1983e84fb4e7add1fdd9410310f149e6f51506
- SHA512 e3040045b39dedefbdc0735843979065a1aaae7d548b82adbcaf6e5ea38433f3319a6fc6542f7b81b1d036116d2a6687e24a185721117f1260f944d6b11d645c
- SSDEEP 768:O1ik9L7gzQUWB/L3LnCkdwqYBrhQ1OZcH5wTOSzVsDMZ48:Ock9OerLCkdKBQ/wTJzI8
- TLSH T140D2F1C73ABDC0D03E4F623194D014045720726F6FEA318679BE8D272AA7305BE6AC98
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\PhotosStoreLogo.png
- Size 58KB
- SHA256 73f63a98f6721664516f8dd8043e8cb31a1345335f124ddfefaaa9fb83b2980a
- MD5 9ac786330ea209f7d02415385a66a515
- SHA1 09d8199787e04915e70baa2a1ef033b7b1d7b6f1
- SHA512 5cfc0367fd7cc7f27fe249b3472aa309de0ba4fd2adedc631691c618c9f6ed3acb49652c0f51e21cd4793cb06c96672f8a4e939e8cecad2e881f66ee1b11386e
- SSDEEP 1536:NC6QgPrENrCeg+cco6fQY9COxLssI0kl2Hgk9:NVIrng+PoQQ5iYsIAHgy
- TLSH T1DA4302F4F3DAE2647223BE6E1B43A3518A76218748914A754A360478CF47E770797F88
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\LogoImages\Resources.pri
- Size 18.1MB
- SHA256 e666f311a75efea5ed9a8ecfd59f43c30ce3acaeb976dc2679b0c5f53ada2967
- MD5 e8380c63d231010a3ceb1a2e62d03140
- SHA1 2ebb54f5b25f7228acea194fb07a0ea3284717cc
- SHA512 b6cb09f9e602de9dbf8f4e0408f3ab72545f0a2f0e35c8206268ff58301e48cee203d82e74581ababcaba747864e3926c447ac7552b16a3e464533a31956fce9
- SSDEEP 49152:45Ha9zdQxa21dr0LOCd74LBd/HEw4EHrEe+fr6ykfrZpTXj2qOkIqcQ:wwsjx
- TLSH T11A175301E3FB0248F2F36B717EBA496598B7BE525930C07E42049A4E1B72B855BE5373
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\MSVCP140.dll
- Size 530KB
- SHA256 388a78ad8b10dfa342b311eb983179d3f22bc8bc4d8afb3b63b7f848af57001e
- MD5 1704fc6c31c57fb83dd393304bf8792a
- SHA1 46faab6285a82d0604e65c9d8be31dfb8d9e64dd
- SHA512 b36829551e5b1bfc5bae220a0b9461ad3d87dc529e79ec338884d0c6e31511a675b414e7d25129b27c0e30fad13b9344fc89ada78500957d1465f14b8b34aba1
- SSDEEP 12288:N0MrE03u1mHWV/I3HVbQEKZm+jWodEEV7ij:N0p1F/IpQEKZm+jWodEENij
- TLSH T1BEC41A23F75906A0E195E3B8A1838702D7F1BC598322E3C742EB955E2F577D0A63F690
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\ODResult.dll
- Size 50KB
- SHA256 590a9efb323bd65e6f51d11635e65f3b0ad51ae7fdd0a5b0a5d30d45484d4cbc
- MD5 9d4af9a0ead27e3211b8b0c4e584598a
- SHA1 7400d298250c2d7da5c2529fcdda6b666ce668b7
- SHA512 4f08b81c8db85ea6bd2300d1bb5c1277f7698d7d0a76ae292195d6abba78f75d5e7f80a94f8bda6ac24eee6e5edb877d821bb24218541f886a33e5dadd4d5d4c
- SSDEEP 768:rdwpPXlRF/SQSLCv6LluewULVSbHjkPO59zbiVr:CpP7AjCKwPG4zbS
- TLSH T1C233E76ACD25902BD34DDC74CA438C0ADE32BCC78BD1B5D76B515DD20866BE4AB3E206
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\OneDrive.App.exe
- Size 1.0MB
- SHA256 fc9ebe7941e29f9c0468b12288b9b6e4de99d0fcbd4bf5e10e9515a4f5ca4cf4
- MD5 4a95929dc8446a1287cc941a42d8af24
- SHA1 38f47490db23fcd195eb9bd6c8520b3335e17088
- SHA512 fafd7ee9482d49e655ab9a167c1ddf9ba53595f1d186a83b98bf836583496283b0d6ab8c21021fdc71897859afeabaa03b267bdadc4d624166d2a04c01d29c32
- SSDEEP 24576:j5UTjG3N0l2Qrh1yCBh2Y92LBq1gokHog55T+:+TjG3Nyrh1yCULsOvHF+
- TLSH T1BC358D5EA6AC41F9D1B6D178C9924017E6B2BC165731C3CF02A1769E3F376E08E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\OneDrive.Sync.Service.dll
- Size 49.2MB
- SHA256 cabf7263bd1d25af46d25e0fb7a4eef0f274c538880e7011df99ebca9e7ff65e
- MD5 64169422d0f5276065546f5daa52b871
- SHA1 aa16c3c3abeb1c796b4bca4a07decfdd55c80290
- SHA512 d5e3d6e587b3040951d0124cbd09a9fd6902c41eeb1f17f125138da04826191f679351ff18b143bdfaced7f019cfcb8e9bf78975f4907450d5327c3baefcad8a
- SSDEEP 393216:HToOfHlgml1r7aDofwMF8GptSETrovVmLJONfH:HT/fl/1r7aDUwquETrowmfH
- TLSH T18AB74B0BB20D42C5C09AF1B8696BD913FB32B84E43A1A3A315CBD3171FDB958667B750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\OneDrive.Sync.Service.exe
- Size 946KB
- SHA256 b721151b78e6325411a2349e9cd78f4e7264128cac0a0a0b6aedacdd2bcbb2bc
- MD5 cfb783bb31797e12dccc6819d7981a96
- SHA1 22d686c501e4941a542c76fc9fe44b3a9217ffce
- SHA512 c87d2af9c6326237ca8a506640d30852bdf308dbac98e4e1b4d71881df96e3a0b17cec88c6eca2ea0a17f00df5e19d5125032c7e1636e2dc05383cf05da4b4b6
- SSDEEP 12288:oKcNgNnN5D0kB1s7NkkEK+xPWAGjLuqfpJSbSAThgoF/:oK7bD0kBC7NkkE3xPFGjjBJ4got
- TLSH T1A6257D19B6AC42F9D1B6E178CD924117EBB2BC164731C6CF03A1565E3F276E08E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\OneDrive.VisualElementsManifest.xml
- Size 344B
- SHA256 d21077ad0c29a4c939b8c25f1186e2b542d054bb787b1d3210e9cab48ec3080c
- MD5 5ae2d05d894d1a55d9a1e4f593c68969
- SHA1 a983584f58d68552e639601538af960a34fa1da7
- SHA512 152949f5b661980f33608a0804dd8c43d70e056ae0336e409006e764664496fef6e60daa09fecb8d74523d3e7928c0dbd5d8272d8be1cf276852d88370954adc
- TLSH T13EE02688B16841C263D369B5643399CD329D329FC3C905C296A145B62154CCC4D8B18E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\OneDrive.exe
- Size 4.5MB
- SHA256 36beca78647782b3f8df3de6a841e0f14290735ca5175a394fa976cb153d680d
- MD5 93c868765a10757a06c624c5e8f669f0
- SHA1 78ffecf3eb564445ad89dd39d0693177425215ab
- SHA512 4d4fc493e77342eb6723d24ee7115b7312aa890726fd9804709f60ea2bb25bddf466ace82d017d728ea6883f4f396ed3cb4cf2ecf3acc749860f8558d9907f66
- SSDEEP 98304:JrDhpwBP/OlsLzFmNfW6FJKxxfZA4AnyxpELRSKE+R1:RGpELcoR1
- TLSH T1EB268CC6BE88F5E4C0A48834B916D57ED6737C7A8A11468732D7FB1F2A37180453B92B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\OneDriveLauncher.exe
- Size 855KB
- SHA256 773bb91add2330dfde01fca2b2af2201bb3c875f2e2178fda9e0a48c2db3c551
- MD5 6a8446fc508cc5a2569db0e326ec7cee
- SHA1 a86cd76cb766fded40ae254e3865d114e8fb753d
- SHA512 03bdfbd88edd006885ba79386ca887c36b50378e5f5f9f79a9dbfde2f06d25fe27766a6472fbe33a9a5dfe9927544e0a9ec0c24f6fb7572a6a82eb999cef1ade
- SSDEEP 12288:O7icuRNDtxtbHawXaRn9+bV8w1Xlf8AQUgJ5pAfgkGrkWk0:OGcuRVFXO4VnXlkPJ5pygkXWh
- TLSH T1C5154C6AA6A841F5D0FAD3B8CD934417E673B8064B32D6CF0291455E6F376E08E3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\OneDriveStandaloneUpdater.exe
- Size 4.3MB
- SHA256 cba89984df440d658c6c0fc308247f15d8338948c9f3c2980b0532fd0ff3cc26
- MD5 6cf20c53ff0020382ee0d6725a0202ec
- SHA1 a00e4497ab63a62e139a6cb42f1d0df6d97fcd45
- SHA512 2a30fddbb1bdee154b6bcb984a4dbe534bb0b1f62907a569f70f02fa2c1c8ede9c848f6864f0838fa94fc7892af1ec45df5d38f55ef821c11f5e10794911060b
- SSDEEP 49152:KT2u0RSsRpohmoCSX0+XO/IOchIIon6mpQHpdWEBRcZPOcmBTLcFMY1:dUI/PM0
- TLSH T1F4265A0BA7F901F4D0BBD2798AA78517FA727819873197DF0291465A1F237E09E3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\OneDriveTelemetryStable.dll
- Size 2.4MB
- SHA256 b65d84c8fe6af183c17a9e906b35a947949df4de2aaf1aa7a393bf85856c3746
- MD5 98224875e681c3326b2f3ed338423a62
- SHA1 b557face3dd51eae1a21a7a927f7a6087b6cc425
- SHA512 33646f78e439064af5bc81bdc52dbbc27b4faa11740d93f77ea0befe9fab12bfb064935c76536df4dac38cfc3a92a5904541a53695ccee7babfd6844f10e86dc
- SSDEEP 49152:o/ioFgF1u1JFxFMXBg/8QJapLdBZlav/WTTBs8bGTft:SGgdUQP8bwt
- TLSH T153B5495BE6B541E4C5BBD13C8A97A617FAB2785A4330D7DB4791464A0F23BF09A3E300
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\Telemetry.dll
- Size 1.1MB
- SHA256 336bcd767a73eb26ab98da9f57ce3991bd08aeca564ce883e05deccec587b68e
- MD5 25ba7bb49ac25bb395cbda475b88a249
- SHA1 61bfcc6a148c72b9a18e88452a1803241f774583
- SHA512 b8be8de5ce7b51ccd8ca293e524d2e95feef18fa96c074c944d834bc0406aa876efb25705842b93f07ba30b553e0ea337df3e47ac15456035045c67f88c2695b
- SSDEEP 12288:+Zj8pAmJ9+YvLAFGhF3ti/dYQ/Um4mR7sN4TVqsyigYsUc17r:Sj8bJw4LAx/dhx4mBsN4TIHV17r
- TLSH T11D355B1677A47FB9E29BD0B9E6734003E5F2F4385321A1FF45DA59280D27AC04A35BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\UpdateRingSettings.dll
- Size 777KB
- SHA256 8f598a254c8a7018b438e86e2e735b8e791097029589777a560a54ae9af92049
- MD5 aa5213048a78bce04ed4b62ea1bc3723
- SHA1 284a4fe2c5653410a7e6f384868595da9abc1969
- SHA512 328a87efe3d3c3585472e116171318dfc95945d4dd5c6034ac31d8e3109c4e1753b3b24f1f3f966084c882d7eb88f307d924fc90d9a9aee8c91cbe5d8fecbd06
- SSDEEP 12288:tfyNjel3G43WIAgxkF7KusxYAx/AtkVxIiVdeP8b15p40YRf:tf8K243WIhx+KMkVxIiVdeP8b15hY1
- TLSH T1AC054B1DA6F802A9E0B7D1B88EE74517EA72FC155732DACF0291865E0F277D0893B721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\VCRUNTIME140.dll
- Size 110KB
- SHA256 78308cb545c980e08ede8f8ac4f0a73a3374588f686361c4974e0e7fc59cb42c
- MD5 2a905378a52541d668aded0b147996eb
- SHA1 3e5d018537475d061a5fc58c2449205ef0926d0a
- SHA512 a1ea741ee07d862345c12cc029604b04ad3f598632aa8607b8379eb14ebd6319954bf29126288dea735b96832f74fd382b9f0a6b3e05bcb93915e26812e5c3b2
- SSDEEP 1536:q9pCUgtBAVcxStMXcfG8VwfmpcGLOI5EvMvecbeQ6N7vN94zj:6yA+3EOfmpcGSL8ecbeQ6NTN94v
- TLSH T1F8B36A0272B802FBD16ED278C1929E67E7B6F40687609BDF07AA46660F63BD05D3D341
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\WebAssets\static\strings\nso-ZA.json
- Size 69KB
- SHA256 a483640c09e35878ab0d44360a55ee04237918e38729a62ff955e67bd234977c
- MD5 35843895877fb6ef7589d3ac40b0b6b1
- SHA1 453dc0983ce9464b7bda86937a2d2efd46424a27
- SHA512 3104d8580e013cb55f5eb5394a845353ab704a108919b9cf3755ce7776b1078e0adb721190bfe0e7cea1c7a5d6ed7a0965aa6fdb0a3af17264649bb6b4d79d56
- SSDEEP 768:g+Qsdv679pnZZrphsXGn5ObqnDVa9E8kEpFVDGcUEnT7zx5O:ggupnZZrDsX2tnDsR7PO
- TLSH T14363A62E8600097704D5A543BD5269A235114F2F6380345D2FEF722E339EEAB72F766E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\msvcp140_atomic_wait.dll
- Size 37KB
- SHA256 6c7d70d305da02b8bda7b0e40ca35321fac13bc3487d90a6e285baac4d0a750e
- MD5 0907dcdfb5d7eb96f39e70775d0c08f1
- SHA1 b02d2e16599bc072281b5c4b520b35b12ad52dce
- SHA512 b40024986023b483bd6bcd929422fd503dda16db55f876f085f63c3e60d24b3bc6a8a41223f1c8dbf4a24048f8795c65d516014757d9f8b4ee087aceb1e73970
- SSDEEP 768:tPMo5RIqKYwIYPhpLSQl4wFhGbHQDwPO59ze:SOR+lPhQQl4wTGsD64ze
- TLSH T188039D45B7680082F5AB8735C496A60BF6B9B7E14710CBDF1361E64D0FA3BD1BA30B18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\nso-ZA\localizable.json
- Size 4B
- SHA256 e3566b3a06430868d71e9287dfd6c6c520a3da027aabea01951d407ee131dc2f
- MD5 c443b04d0fc26b0a5a4573a78e0082a1
- SHA1 3c957535345645dce7190b85eb10b39da96b2518
- SHA512 7bbf6dac485c9e59d02edabc91ff5b15bc1319cef6905c0077ee16e3b1f572b61bff85f2400bc0f5b4aeab0260bd5d68787d72c7a688d79192952f7957a44de3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\nso-ZA\od4-localizable.json
- Size 179KB
- SHA256 ad8093883c02f6cc218bef464ae500cc44490212511884336964c8d67fca7365
- MD5 ee62f84aacdfd1c172e3b948f16ab356
- SHA1 14683dde72e5fae1cd63d5e37b9b3fc05a6fc45a
- SHA512 9914a5ba0031a7eef00d163e157bfbf52472fbd00ca2fa564231e192e8d3cc38289a7ccac858b339e072a7819fab5986cac1ab62d4f678017cc6ddb2b3c39756
- SSDEEP 1536:fmsUN+1P0I4NkZ8mDo8EL/BX000pvjWLXVZJ9kxlu3v:+F6Z8mHEL/BXsYYE
- TLSH T12D04917BA1808B7304316253BD4D19E277120B5F42B28D9F34BF614D9286E6BB3A77E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\vcruntime140_1.dll
- Size 36KB
- SHA256 ced7d638c52789bc8696822f5f6e14e84b96e09841914d8cf4505c097c670522
- MD5 4fd640e9bfcff012365ad3c60b6f505f
- SHA1 56a071518d3d771496ddff3ef6a2418eb785b14b
- SHA512 034870b411e3c58972e37a2dc2f751eb27aa0167cad9651ef5ac29d88a06c7388257b0d546891045a610bf7c1355b12ad47305cf1d392731304598437da259d7
- SSDEEP 768:lezSkbhNfI4fWLZySXdPWD/0bHychULi9zlo:CYZyqPWD/0GA1zlo
- TLSH T109F26B52A3B84086E8ABC670C4979E57FE39F69157A093CB1BE4C60C1E537D0973D326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Business1\settings\Microsoft.Media.db
- Size 288KB
- SHA256 b25a3dd12eee700f735f49b262d24fa2256ece146e0c109982a22103a94e3d91
- MD5 9329d902a9b701da98ca200ecd5d01aa
- SHA1 66389a0c800250c355984a48c2e73d129673adf5
- SHA512 74f1887c182ec31e725c5015acabb02f009cd2400569ee649534ff5e00d8426f15d19272181a27af378c7ef54b238d35a7f4cec1841c243306359e0a3ce24612
- SSDEEP 768:27pVPbMowWO3Yx6psPb//dydwoJuPdF1xw:27pVPbcC6psPb/V+woJuPz
- TLSH T10954745BEB48AE32D2D7B0369CF50153A7192C5F4EA26EA17EEC41C81F4685C9034F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.CommonMediaCache.db
- Size 68KB
- SHA256 aad240efb95de0559fd3c4336a30c212b11e154d91ff4e7d939ea3e3654b1bae
- MD5 9691773f85477eafc4bc2d1f1e0e62a3
- SHA1 0cf8e2a2f0c28662e5d24a81e4885b739da0b7db
- SHA512 4f4c43c6d17ad49512e156f7adfcb54db58b3c5f5790cdb46cb8a40aa3c0d29a3fc98f016ff63183b3153c255e9fb29fd65d7114e8e19591875bd227005fe16a
- SSDEEP 96:v8tsm8npn1rZPnTgSn9l2ggJoXBfOlC8:vxN7Bz
- TLSH T14D632DCB0993AB20CD8C7274C7A32510AB39068FCBD27972BE7380A55F4851C64F9DA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.ListSync.Thumbnails.db
- Size 832KB
- SHA256 536ffda0df7777427e82176b7f3d6b0fb4b99056993a5d884a0210f5e24287b5
- MD5 7ccdfe9d7c82a55824ad5d9c3cc4da59
- SHA1 061df6e040d8b39efbd839715374abaa5c92545c
- SHA512 e0eb172b6573111b42dc4b7080717978a7eb4e6e62474e27ad5fd480eb33c690873e6fad19a4a3064be3ac8883c41c66009c066e010689e9c5a50bd4131cc0f1
- SSDEEP 96:DAim5non0gw+qn6n20nun8eQns1n7xRLvUHRfOJJnGnGnnWnOa4Arzo3CnzEd1nD:UBvIsdJ
- TLSH T1C605EC8D2E106B01C1A25170DDD35A1A7B39A76F0612AD9A3DBC1071CF6929CF8B17E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.ListSync.Thumbnails.db
- Size 832KB
- SHA256 2acabb069c0bf61eed0fb95267201be91d9db836984b569d5aa0eb48f74d204f
- MD5 ed80c09885ba5cc9288be210f1832328
- SHA1 17cffacf38afffaf06251772b0f21e010ebc23c1
- SHA512 6bce8d70f9a9e7a34f5c1efbfd575bc95a6a4e3ca8ee7099cfbbce7ed8dca02fb80ea3d9d63bee451c401aee4ce25c0f445f2ce7a71f04acd1402f3dae5e3a52
- SSDEEP 96:Dwim5non0gw+qn6n20nun8eQns1n7xRLvUHRfOJJnGnGnnWnOa4Arzo3CnzEd1nD:kBvIsdJ
- TLSH T1E805FDCD2E106B00C1A25070DDD35A1A7B39A76F0652AD9A3DBC1071CF6929CF8B17E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.ListSync.Thumbnails.db-wal
- Size 64KB
- SHA256 1e11e95ceb7b95630c04a228217bf5ff43b02be942dad71106353d9fb325a431
- MD5 6fa8cb0173e38f9e7c376d2b358d88b4
- SHA1 afac9657e6c0acf18efc2106973f6e953c23d332
- SHA512 46cd8f3e8bc908536fd6c620a69ec2c2fe3b72acef4b9dbd77f7ac209a87f21c989bd8db9b5789988d8789503617ce2f4787c9f7ca12e7b40e68181847cf7666
- SSDEEP 6:K8miwdfiaPlmt2Q4d+U4IpJllE+GQ4d+n:K3VdfL9mJW9n
- TLSH T14D53A9B2DF0BC013EA2168B12B062B305F478820816E6C2240B0B841820B2A9CBA9A4A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.LocalContent.db
- Size 376KB
- SHA256 c04d00cdcd798acd5df836d464227f8091a2aaaa37643e3aa6013027af4b8cac
- MD5 b98e082282e36cf7ce61a07b250ce482
- SHA1 d9bba6a5a67269af1877f294ae4b78c387e9bb7b
- SHA512 1fe9ee0b79f413a9bf682fcf833369b8c499c52f176612f6a2cac4bfbad0ca78c45bd491659dec85da9a4c086ad2ea9c93c643b585c8d8f75dae7ef4b88b8f44
- SSDEEP 1536:0NFa61DkECvdMiQsIyBOrUB6hqkvVf3Oo9OORO61u1kCVCaGWeayrpkbetvdBXVk:0NFa6alH60c2Hwi
- TLSH T1178442A93641F33AE9D973B1ACE2C4913232B11F4EA1DA0078DD15449F476CE9E7E6C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.LocalContent.db
- Size 376KB
- SHA256 4c45f8098119099071a38a5730c1fdc501440c281ed371ae46cdbe0bfdf9c208
- MD5 03f9d9d40af985b7b4812510b89c88a5
- SHA1 5180e44e5ff0c4e6f2686eddaaaaa7efcf0a2472
- SHA512 0c2ccb5328f45dbcba1e37057081263b8e14818d1e6f6cb10f5d644aa75382a2f5284f5cc6e5cfea2771ea8add2e864db66cde6221b8c2f18e466be92e2d466d
- SSDEEP 1536:jNFa61DkECvdMiQsIyBOrUB6hqkvVf3Oo9OORO61u1kCVCaGWeayrpkbetvdBXVk:jNFa6alH60c2Hwi
- TLSH T1138442A93A41F33AE9D973B1ACE2C4913132B11F4EA1DA0078DD15449F476CE9E7E6C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.LocalContent.db-wal
- Size 32KB
- SHA256 88ccf86fcb61b5e3f16fbaad848a79b345a381574ca2aa26e1e1abecf5eeafb4
- MD5 4632dc0a41a6ad14a5a5fe27abf16d75
- SHA1 ad78d01c6d5e65591f89c5dbe536d1f536bbf938
- SHA512 5cf0864132d2cd8f2f52537fddb4417fcdaaf7f971da192575ae9bf6638ae218b84629b72997b0555b7d517422f8a1f48a7d704f7afb53f11067394e26a52794
- SSDEEP 6:K2NmmkXg4ZsZoXZvsHm4Lz4He+Xhno/NB+aA4FXx+aINldFq9Lkg+aaNwlSFq9Oc:K2lbZIeG4Lz4/iPjPM3dQ9rtMQVl
- TLSH T194E2A0D3EA74DCE7C29C203AE474BAFCD5E152BE322E687211E5CE244AA49004D4E1DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.LocalContent.db-wal
- Size 4KB
- SHA256 19897881a92177b414686f8204972f983c9b36bdb6ac41d72060a15a7a89415f
- MD5 e80f621f70fb813bdae193f958f83502
- SHA1 2f356c7c2711856d4fed03d3b0fe4bdf3d58f01a
- SHA512 1c931dece1af1252208aa6a3e49be9f3c71e09a06c1be488d4088679842f17b9506180f9d422d4f91cfc640985b523938846a39b24fa5c2285a8da232297f802
- SSDEEP 3:OlH/lkaAgbFZYlXiolvqfTllXTlXj:K22bFZIXRvOtlz
- TLSH T12481125C14400461C85B53306104D1F50841AB1E10414107C800110013B849C2C15E0D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\UnAuthenticated\settings\Microsoft.ListSync.Settings.db
- Size 16KB
- SHA256 fa92e44b18aceaa97aef646f541f33c42965c620bb9ea4a6cdaa994dea70951b
- MD5 6305b6226a6ba4cc30d1100d3f188746
- SHA1 c5a2af7fe8c9fd5554dbf31ee21dcca206698772
- SHA512 c6c9886084c4a500dc3a4d6c3d6658b559dd21f4e252185577a960fd95b0750bbbc042aa5ce8a2bf73d6f5f5e7996602576bd7b879d7b95156d2167ddbac6d6a
- SSDEEP 12:T4lbLwMGdymz3biyyZO22abBX1tyyhblq:ThpRSL2osslq
- TLSH T1197259A7810488BBC516037DD46343051B31460E7321C6F7B87D111B9F42AC85D272EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\NucleusUpdateRingConfig.json
- Size 103KB
- SHA256 480fe7617d0a7e6ffd5d708c0374e33e907de560bc1eb20f4217819845936fec
- MD5 aa99d8dccc53a1df71bbf635102f452d
- SHA1 5851af3fa8d5a64f38e5f642f01b8cab1f79763a
- SHA512 b0ad883279a1a22a4e80bc5ff042a3305bc07d3d664fba5fc8bdcf14bca2889f72277af1af91ff024ced8c7aecbe47d1bf91d1b6bfc17bc09959e6646db62ddd
- SSDEEP 768:WEeIBl+UaPNGZwXJn5U9mLzo922ma++8JDcE4rRByhUPGNbqLxStzJ8RW/E/+5wA:Wh9zJn5UQYAOEePGns8vco4EdF8AR
- TLSH T1F9A3EA4E2008B7AFE316AD5A7D6B69861C21746E3852CFCEE0CDC26C6E44DC4734A5B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\Update.xml
- Size 896B
- SHA256 09f8a7c12de8983d5e37317b937fd88ca8aff71e018f39b0ad060caea4f077ca
- MD5 66949b0b5a8b0696e49dc8e94b08441c
- SHA1 19a4bce7ac253e86adeaf1e549e0345a99164085
- SHA512 158b94483ca2f3cb77936c28e684d9584b921a75d62f808d2dda942148675a1882c5bd02dc659999a7a4e666a1b93b34ffd2b22cb14c083729fb8289ab2a0725
- TLSH T1D71180C76470B931875015CC8742F4BDE371BE1F0BE8816DB0D2A00B6F9E6DC917605A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\telemetry-dll-ramp-value.txt
- Size 12B
- SHA256 291644a1204c9b0e460c04ff50292382476ad19a9296c12ced5768f9fa76eadd
- MD5 938803969367c4063aba4ff7460ab4a7
- SHA1 91ca0fe11d6910f01e157d48da36e24fa41418e5
- SHA512 76b8566410a839167fe5c2e0626828b0549ea2ff8849a3bae1dfccc947fbc63811b273d07c4c48c215061949ac4a28385cdeb566d587940205170b25fd33f073
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\OD4UpdateRingSettingsCompactCache.txt.tmp
- Size 10KB
- SHA256 2db147f2acb0fde2f605edb5ef956dfd7887009939c0008f044e84496c0b0b3d
- MD5 8c7514fb460479f417903ec1f9f7a79a
- SHA1 23daa758692848205bf1d71b19ec2a77e2aeba3b
- SHA512 5b0253ddad8270d618af5cfd31627a6d160493e2205a2a2159be2c60d9b33867e9f7ee6eeb5d6f763845fbbd14a0acfc29a9ed8618c6d8bbb7e07d8841697b7d
- SSDEEP 192:F92mTxTnzx4EY5QtlN1Mk4cB/PgF/XcdDthSI9T6pc6s235OL92mTxTnzx4EHF:F92m9Tzx4rQVbdhipm23o92m9Tzx4OF
- TLSH T1112240F09CF5DBE5EBE68C4DF0DE363746B48C334BA6815347A360868C37619C05A8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\OneDrive\desktop.ini
- Size 96B
- SHA256 f625a1050e8ba6df4de974c2acc572e1e637a3429bf2ee1449c552999a6c7268
- MD5 2b98cc2afc1d0907c7066453643faac3
- SHA1 864b3477bba5fb913b0e017f7bc087c3c6af95c4
- SHA512 9e2eecf1715378f44539cc79c718bcfd9181728e9f2330e34d228badd482ce48a8b916275a0d063dfbcdcadcde25be82c43fea44aea0393ecf3385095550c6e2
- TLSH T19EB01221804AC925D05AD00F1452490490A50C0F9E09BF049300C40405C5F8CFCC92C7
- MD5 SHA1 SHA512 TLSH