6dde3590ab830a8410cc24b99be44444c95cb503f6129a91308007e4a2df0f6e

Analysis

user interaction
yes
max time kernel
76s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
chrome.exe
Size 1.8MB
Sample261104-1846esdx8x
SHA256 6dde3590ab830a8410cc24b99be44444c95cb503f6129a91308007e4a2df0f6e
MD5 ac131a20cd53abc0706772a6eb2e153e
SHA1 47be95c35408922002037c8b32314fef7e096004
SHA512 9727a2adc8a9c0e3ef8db8286d3f006a09d395d44236c7e55ff17c0bbe3d4ec25a0895edb5b7612848566ee38f9bbf0918c85ab788e52263433cfb8b1a59ac61
SSDEEP 24576:T6tsDSRApFu2JW8eq0/ygdNaPiInHMPcrIpst3zbqsXnN8MttpLvlPTl2Kh:2tsD7uQW+gfnInK2l7cKh
TLSH
T171858D1AA2E79299C0538538B823A343C6793C2513DA35CB4FEB7FAD1BF78E41572251
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence privilege_escalation spyware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	OneDriveSetup.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
4760	OneDriveSetup.exe
3004	OneDriveSetup.exe
3672	FileSyncConfig.exe

Loads dropped DLL 1 IoCs

pid	Process
3672	FileSyncConfig.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDrive.exe

Checks system information in the registry 2 TTPs 4 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDriveSetup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OneDriveSetup.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OneDrive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OneDriveSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OneDriveSetup.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2904	msedge.exe
5256	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OneDrive.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OneDrive.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDrive.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDrive.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}\ = "IFileSyncClient5"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{d8c80ebb-099c-4208-afa3-fbc4d11f8a3c}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Interface\{9E1CD0DF-72E7-4284-9598-342C0A46F96B}\ProxyStubClsid32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\AppID\OneDrive.EXE	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_CLASSES\SYNCENGINECOMSERVER.SYNCENGINECOMSERVER.1\CLSID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Interface\{5D5DD08F-A10E-4FEF-BCA7-E73E666FC66C}\TypeLib\Version = "1.0"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{f0440f4e-4884-4a8F-8a45-ba89c00f96f2}\TypeLib	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Interface\{1B71F23B-E61F-45C9-83BA-235D55F50CF9}\ProxyStubClsid32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\OOBERequestHandler.OOBERequestHandler\CurVer\ = "OOBERequestHandler.OOBERequestHandler.1"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Interface\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}\ = "IFileUploadCallback"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\ = "UpToDateOverlayHandler2 Class"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\ProgID\ = "SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy.1"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{10C9242E-D604-49B5-99E4-BF87945EF86C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\VersionIndependentProgID	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\TypeLib\{082D3FEC-D0D0-4DF6-A988-053FECE7B884}\1.0\ = "SyncEngineStorageProviderHandlerLibrary 1.0 Type Library"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Interface\{B54E7079-90C9-4C62-A6B8-B2834C33A04A}\ = "IGetSpecialFolderInfoCallback"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Interface\{1B71F23B-E61F-45C9-83BA-235D55F50CF9}\TypeLib\Version = "1.0"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Interface\{2692D1F2-2C7C-4AE0-8E73-8F37736C912D}\ProxyStubClsid32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}\TypeLib	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{B05D37A9-03A2-45CF-8850-F660DF0CBF07}\ProxyStubClsid32\ = "{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\odopen\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{ACDB5DB0-C9D5-461C-BAAA-5DCE0B980E40}\TypeLib	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\TypeLib\{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}\1.0\ = "FileSyncLibrary 1.0 Type Library"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{1b7aed4f-fcaf-4da4-8795-c03e635d8edc}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\ProxyStubClsid32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\OOBERequestHandler.OOBERequestHandler\CLSID	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\TypeLib	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{f0440f4e-4884-4a8F-8a45-ba89c00f96f2}\TypeLib\Version = "1.0"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Interface\{944903E8-B03F-43A0-8341-872200D2DA9C}\TypeLib\Version = "1.0"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Interface\{EA23A664-A558-4548-A8FE-A6B94D37C3CF}\TypeLib	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Interface\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E}\TypeLib	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\AppID\{EEABD3A3-784D-4334-AAFC-BB13234F17CF}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\FileSyncClient.AutoPlayHandler\shell\import\DropTarget\CLSID = "{5999E1EE-711E-48D2-9884-851A709F543D}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{10C9242E-D604-49B5-99E4-BF87945EF86C}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{10C9242E-D604-49B5-99E4-BF87945EF86C}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}\ = "IFileUploadCallback"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{466F31F7-9892-477E-B189-FA5C59DE3603}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{1b7aed4f-fcaf-4da4-8795-c03e635d8edc}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\ = "SyncingOverlayHandler Class"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{9D613F8A-B30E-4938-8490-CB5677701EBF}\ = "IFileSyncClient"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{0f872661-c863-47a4-863f-c065c182858a}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Interface\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Interface\{b5c25645-7426-433f-8a5f-42b7ff27a7b2}\TypeLib\Version = "1.0"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\ = "IToastNotificationEvent"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\FileSyncClient.FileSyncClient.1\CLSID	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\FileSyncClient.FileSyncClient\CurVer\ = "FileSyncClient.FileSyncClient.1"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\WOW6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\odopen\shell	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Interface\{9D613F8A-B30E-4938-8490-CB5677701EBF}\TypeLib	OneDrive.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5192	OneDrive.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5192	OneDrive.exe
5192	OneDrive.exe
4760	OneDriveSetup.exe
4760	OneDriveSetup.exe
4760	OneDriveSetup.exe
4760	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe
3004	OneDriveSetup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2404	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
788	msedge.exe
788	msedge.exe
788	msedge.exe
788	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4760	OneDriveSetup.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
788	msedge.exe
788	msedge.exe
788	msedge.exe
5192	OneDrive.exe
5192	OneDrive.exe
5192	OneDrive.exe
5192	OneDrive.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
5192	OneDrive.exe
5192	OneDrive.exe
5192	OneDrive.exe
5192	OneDrive.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2404	chrome.exe
5192	OneDrive.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 788	2404	chrome.exe	83
PID 788 wrote to memory of 4976	788	msedge.exe	84
PID 788 wrote to memory of 2904	788	msedge.exe	86
PID 788 wrote to memory of 968	788	msedge.exe	87
PID 788 wrote to memory of 1820	788	msedge.exe	88
PID 788 wrote to memory of 968	788	msedge.exe	87
PID 788 wrote to memory of 968	788	msedge.exe	87
PID 788 wrote to memory of 1820	788	msedge.exe	88
PID 788 wrote to memory of 2644	788	msedge.exe	89
PID 788 wrote to memory of 3560	788	msedge.exe	90
PID 788 wrote to memory of 2644	788	msedge.exe	89
PID 788 wrote to memory of 2644	788	msedge.exe	89
PID 788 wrote to memory of 3560	788	msedge.exe	90
PID 788 wrote to memory of 3560	788	msedge.exe	90
PID 788 wrote to memory of 4284	788	msedge.exe	91
PID 788 wrote to memory of 4960	788	msedge.exe	92
PID 788 wrote to memory of 4284	788	msedge.exe	91
PID 788 wrote to memory of 4284	788	msedge.exe	91
PID 788 wrote to memory of 4960	788	msedge.exe	92
PID 788 wrote to memory of 4960	788	msedge.exe	92
PID 788 wrote to memory of 3768	788	msedge.exe	93
PID 788 wrote to memory of 3768	788	msedge.exe	93
PID 788 wrote to memory of 2376	788	msedge.exe	96
PID 788 wrote to memory of 2376	788	msedge.exe	96
PID 788 wrote to memory of 1580	788	msedge.exe	101
PID 788 wrote to memory of 1276	788	msedge.exe	102
PID 788 wrote to memory of 1580	788	msedge.exe	101
PID 788 wrote to memory of 1276	788	msedge.exe	102
PID 788 wrote to memory of 2780	788	msedge.exe	104
PID 788 wrote to memory of 1636	788	msedge.exe	105
PID 788 wrote to memory of 1636	788	msedge.exe	105
PID 788 wrote to memory of 3108	788	msedge.exe	106
PID 788 wrote to memory of 3108	788	msedge.exe	106
PID 788 wrote to memory of 5004	788	msedge.exe	109
PID 788 wrote to memory of 5004	788	msedge.exe	109
PID 788 wrote to memory of 3704	788	msedge.exe	110
PID 788 wrote to memory of 3704	788	msedge.exe	110
PID 788 wrote to memory of 2988	788	msedge.exe	111
PID 788 wrote to memory of 2988	788	msedge.exe	111
PID 5192 wrote to memory of 4760	5192	OneDrive.exe	129
PID 3004 wrote to memory of 3672	3004	OneDriveSetup.exe	134

C:\Users\Admin\AppData\Local\Temp\ chrome.exe
"C:\Users\Admin\AppData\Local\Temp\ chrome.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bubbly.land/activate?code=EDTG-7HSY
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffbe05cc188,0x7ffbe05cc194,0x7ffbe05cc1a0
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,8569817849398396247,5225403535479375240,524288 --field-trial-handle=2848,i,18242278269049687229,11970753975551535229,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,2647712357942383286,17218603761614194029,262144 --field-trial-handle=2848,i,18242278269049687229,11970753975551535229,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
    3⤵
    PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,11610813230976628532,8459111334616295097,524288 --field-trial-handle=2848,i,18242278269049687229,11970753975551535229,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:8
    3⤵
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,13865634013063131373,14078505063452538792,2097152 --field-trial-handle=2848,i,18242278269049687229,11970753975551535229,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,11406680765645171389,1269039358539579865,2097152 --field-trial-handle=2848,i,18242278269049687229,11970753975551535229,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4092,i,1176395421451841885,6019449686460435642,2097152 --field-trial-handle=2848,i,18242278269049687229,11970753975551535229,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:1
    3⤵
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4084,i,2299194535881900084,2476858583073524673,2097152 --field-trial-handle=2848,i,18242278269049687229,11970753975551535229,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:2
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,9404469391376926860,8560488393815868980,524288 --field-trial-handle=2848,i,18242278269049687229,11970753975551535229,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
    3⤵
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,11875012416224683814,4257235754112939816,524288 --field-trial-handle=2848,i,18242278269049687229,11970753975551535229,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,5071433683823518349,6587458384270463953,524288 --field-trial-handle=2848,i,18242278269049687229,11970753975551535229,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
    3⤵
    PID:1580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,7550459436400894374,7187523458144577418,524288 --field-trial-handle=2848,i,18242278269049687229,11970753975551535229,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
    3⤵
    PID:1276
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,13183371928570442122,1631021664809060433,524288 --field-trial-handle=2848,i,18242278269049687229,11970753975551535229,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,13183371928570442122,1631021664809060433,524288 --field-trial-handle=2848,i,18242278269049687229,11970753975551535229,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
    3⤵
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,4889753583562674937,8697292719525241535,524288 --field-trial-handle=2848,i,18242278269049687229,11970753975551535229,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
    3⤵
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,5754093626169835844,14992473159147469333,524288 --field-trial-handle=2848,i,18242278269049687229,11970753975551535229,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,16105616918477824258,14519403272556617139,524288 --field-trial-handle=2848,i,18242278269049687229,11970753975551535229,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,8072933560342627171,14876625278434575905,524288 --field-trial-handle=2848,i,18242278269049687229,11970753975551535229,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
    3⤵
    PID:3704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,12417380054395593967,4416292570134441757,524288 --field-trial-handle=2848,i,18242278269049687229,11970753975551535229,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
    3⤵
    PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4244

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5960

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
1⤵
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5192
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4760
- - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
    C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Checks system information in the registry
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
      "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3672
  - - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
      /updateInstalled /background
      4⤵
      PID:4576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:5704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbde6bc728,0x7ffbde6bc734,0x7ffbde6bc740
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,9318121392805885152,15630327458062591794,524288 --field-trial-handle=2024,i,10973867726365508147,5927308523217634469,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,11477785594670628177,18025794005588071806,262144 --field-trial-handle=2024,i,10973867726365508147,5927308523217634469,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,16238672763136849105,8622952516428277361,524288 --field-trial-handle=2024,i,10973867726365508147,5927308523217634469,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:6080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,18151484663390272249,2543666511158144996,2097152 --field-trial-handle=2024,i,10973867726365508147,5927308523217634469,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,9154283741575967658,16103509976023993442,2097152 --field-trial-handle=2024,i,10973867726365508147,5927308523217634469,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4596,i,7444349604353875291,1296521603645953369,2097152 --field-trial-handle=2024,i,10973867726365508147,5927308523217634469,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4616 /prefetch:2
  2⤵
  PID:5560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4788,i,60979549468647509,15785801294546372897,2097152 --field-trial-handle=2024,i,10973867726365508147,5927308523217634469,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:1528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbde6bc728,0x7ffbde6bc734,0x7ffbde6bc740
  2⤵
  PID:876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffbde6bc728,0x7ffbde6bc734,0x7ffbde6bc740
  2⤵
  PID:3780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbde6bc728,0x7ffbde6bc734,0x7ffbde6bc740
  2⤵
  PID:5912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbde6bc728,0x7ffbde6bc734,0x7ffbde6bc740
  2⤵
  PID:4356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5168

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
1⤵
PID:5332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF
Size 2KB
SHA256 70ba5ab0b7f7a9070c2aaa199fd92485ff9ed07ec79f5c5ea727f15c3d21dbfa
MD5 cf1387ba59e643fa327a4f7111ce32e8
SHA1 ef5b3a46641e7592b689212e28a31e65cbcd4175
SHA512 9dc5eb8f34f4904e35a7aaa6dc9729f1070dbbb30305cdc89ba2c7a7fe7579b77f0e8a0ddc6e6baa7c2dec4a655f725232db761ce9b1725275bddb9ce50f18af
TLSH
T126412B434B353001DD6DEE9DBA64C641B87CDB914894548F576CE5DCA45FFB30F0484A
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 471B
SHA256 b655762faaed09ddc32c601b79b5b193a086145ffa74ee824248c1bd539e6fea
MD5 1bc71825921fd2b61b875b929fca85da
SHA1 10ea3fcea2bd24b488cf1a12e0a76cb82e385b05
SHA512 fb6f66cc4dcf3b7336a7814138dee6713de3d94e552b564fdd4021ac6b3f061bb13a511ea0f5e173bfd9c4dacc38013fe895b2858ef0b924886b2290ccd50b27
TLSH
T18EF0D445D119E44C7D8199DC36FC405E2421E2FD11E5E54E203887F401725BD162703E
MD5 SHA1 SHA512 TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF
Size 426B
SHA256 e7daf34dc299bde07c4e18107027fff6abb078b028681697db1bcaaae35bcb1c
MD5 2216394c80bc49c227110be85fe8577f
SHA1 0fd5d8e268466324fa38ec0617bae8c8d8eeb0c4
SHA512 782241bdc7c5a564a3a10d058604a30708113f8c7134371b4b81124ad3fa654cf703ae83ebab9368f5bbce93e1eda15b1121eafe8ed8dc22e955f359f79c05a8
TLSH
T12DE0C01229FE011CE3315EBD6BD8543E573EF5230404A7741E10A11D221AC560E32F33
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 412B
SHA256 7b1a6baf7bca8ce0464912b30889c6a2938a4a05ab58cbc83c709799c7d92674
MD5 22f0d580867238bfcbe3452001385c96
SHA1 bf26c95595def95f4e7b3ac286a2144870b5d4dd
SHA512 d1220562e61914708e09ec88286c8ea0a5c152817b193a69d7b63ba8c7b2df75362d2c35ef4f1bfeaeab97dfc751c13177a529bd81dd4a2b9fa08e9abcbaa457
TLSH
T117E0C62429FA421CF1F0C9380FEA78B1859BF0220810A7B22AC02B09BA06A80EC12D30
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 6c819db0734bfc935c63a42a6712058d6e87eb2d95f26b8e6caba4343fef250d
MD5 5d4465f007be84d401efd8ce339bdaae
SHA1 69994fdcc3188edee330493acac43550aad590f4
SHA512 172ce455e13ca65ea3a0dfaf4bd1df651e2423b5386930107c85e61e0374e6eac041602f6df06c15f953d9c1eec6c37938cc1096979f6ee7f2797695bb65197d
MD5 SHA1 SHA512

Submit Download

e77442f6-587e-4cb3-a8a6-697cd769b134.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e77442f6-587e-4cb3-a8a6-697cd769b134.tmp
Size 130KB
SHA256 8cbf8bcd578cf4d13b2c384cd8cae0c7fa0c37fba18db1790c633238c6dc05e1
MD5 229a38d6318f39bb19f84fbadda04727
SHA1 b5a75f5455e34c563d74b74d34aa5f5e68a0a230
SHA512 9373bfd40712a903d77aaa76d263770db111ab1d755fa95eea564750f9f6f71492760b8948248100a1f297906fa697ed4518aace9ba0e16a3d54c072ce7c6bc0
SSDEEP 3072:D+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:D+hFD+7t56OD9ZfSApprU
TLSH
T1E8D31232AA91D87BC9FD6541B147A300DD766CED41EE2A09444A9F8EE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35f3dd97-158c-4e72-8651-e023faa928e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\35f3dd97-158c-4e72-8651-e023faa928e9.tmp
Size 22KB
SHA256 49c912386833046f5a8aad583b0f78540d59540a8e5b47524def4b604ae6dc98
MD5 c8c1870eb53fe278b73c518daf90d687
SHA1 562fdfa1d73fcc021fb9f3ecc3904c54810cf86c
SHA512 b58b0052746d08ade558a5352e3824d540497a96f9003f4fc7557cc91d13c0dfb1035e617933528fcda2bda5373bc072807224aba9860eae14b85c32c740948b
SSDEEP 384:nsQkUSv0sN6Ow/dCp5u8iEm+MIKASt6I7oFjkVr+qFH7vBEaIIll:s0PgkEiESEZkVr+qFH75EaLL
TLSH
T139A25BB0D8A96CFB04B2E8D0A646F6476EA45137C6C80B4CD6F9B63830CF5F82717916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39843177-5387-4e6b-8893-2f9461a9d7d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\39843177-5387-4e6b-8893-2f9461a9d7d0.tmp
Size 18KB
SHA256 1a58018ad8d398f31796aaf66ce35686cd5e33f442512466271cb4850ac23a26
MD5 a1e1db5dbc7b7aab6225df0a68939764
SHA1 59dc2d50464f0a0f82a5813b9804381e1e555abe
SHA512 1b5d463087c7307b9406aaa86c51ae1c83e3584058aefe99a74edbb21324d2bdd89e235d9a7e3f5c0f85bcc8f76d1e43b1561c0b1786b4544ae23d26ce2e7672
SSDEEP 384:nKQkUSv0sN6Ow/+Cp5u8iEm+M9H7vBEaIIll:y0UgkEi9H75EaLL
TLSH
T1A4828D716878AC3B59B7E520F24B3793AEA85167CAD81F80D9D9972C00C72DC370B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6dc7bac2-5d1e-42ff-8f4c-96a216719fc0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6dc7bac2-5d1e-42ff-8f4c-96a216719fc0.tmp
Size 8KB
SHA256 19d3a0d072871bb5daaa98ac7c625a6cf5cda0fc567d65ab7c4babea7eac162f
MD5 5a310728ac5f3affe0a7aff31f62925c
SHA1 de8adb8f9037509491a7f95444c0b1a6e30aa689
SHA512 61ac6e0c6a39b71405e5f6b0e4da7176470e420137b17a6bd4431f1d8fd3847485288369c65bdb3008974667e6c62eaaad129f1fabb7a6cdf694ce5cf46b5193
SSDEEP 192:NONb6iDCQmiUyRIeq5u88P1uhYoetASuZ7qcFU6:NONb6D1eq5u8iEm+l9U6
TLSH
T100123974A87CBC2B6DE3A824B9C736675EA41277DE886F84D9E8561C00DB39C370B513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9bf133ce-7e46-48c2-abe4-9408b3630120.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9bf133ce-7e46-48c2-abe4-9408b3630120.tmp
Size 8KB
SHA256 33b65ee4d1f1f56877b47b702470b57d1559e9519aa41c1fb97762f9296487bc
MD5 4612f860b84c95ef4adff04044924554
SHA1 64476c3877fecde2858c9c018529d1d074ba2ede
SHA512 13445cfa2d12492491667178aeac37118ec479582abce251c1b118ad9c740f6d61eac5be1129750cd3d3912d9db81ce9ccd10a28113b0fc2816aa962dfcf59d4
SSDEEP 192:SONk6iDCQmiUyyIHq5u88P1uhfSq2IlU6:SONk6/0Hq5u8iEjPU6
TLSH
T19502EA39AC683C7BADF3AD15B58777275FA4013BE6942B84D9E81A2C41D729C2307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f3d322d8-3397-4275-aaf6-a43c00221326.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\f3d322d8-3397-4275-aaf6-a43c00221326.tmp
Size 105KB
SHA256 e2d1a78ddd4a2613e2e137a9b8a6ee6a025f24ce78c71783944f051445e3063d
MD5 a68138180bf134fe6e360a0e37c3184b
SHA1 359c64103a0eb1cbba384f963ad47bd6cac7e41c
SHA512 a8338bac44852d511db583b349822cd7e5ec3c426141655b68ecc184832731c5830c69e5af34998dd6e85c0ddb2400530e818deb283053d561c8afc2b615cacf
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
TLSH
T178B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f6c603c48bad8cf6fc5bfa1901589a53022a5c1315888da77b07a5c7516687a5
MD5 4fabfb1f7d070458e2895ffec233ff43
SHA1 98393503bad4d9db97f3ddfbb3e45d91868d9978
SHA512 8d103d2ec672aaef277a945b102deb58448c812a35ac148aeabfd0c6f3a0f02507510d1c81989a1842eaf658c9190a9493eb0148dbc239fa99fadbb1108ebe40
TLSH
T13ED0805474663DFCD16E71355415CD405744DF53E1021755160B4C15D5501C61CF1EDD
MD5 SHA1 SHA512 TLSH

Submit Download

271d84c3-2a03-4d17-ae5f-8c8a2820fa25.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\271d84c3-2a03-4d17-ae5f-8c8a2820fa25.tmp
Size 10KB
SHA256 8078cf484e83b2fed8f5d2dd28090b5e80380bb7d00c9db30ac047f9b441ad83
MD5 7eeb330fdaf6c3bd657067dc6d507d9a
SHA1 571a57519f38f6caff095ec49dfcabdbddf67671
SHA512 ab78ba5b70f550466f7559d225e8f24f28ec21ba29daecdf9c42b7a759daa9a31063044dc3cfd0bfdfef94e7628b792a589a873fcbde71660f913e0af736e05e
SSDEEP 192:sxZbRjs+/fOsTcHQ9ONfIdpmhHW6+WNF0D/Ya1SUX0Ig4J:sxZbO+/fOsTcw0NQKHbi/Sc
TLSH
T18D22C7516E28B87B9CC7D20DBB157F13D6FA103295951D48A6FCD61C04EABDD324780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

681c3023-0bfd-4664-829e-f155b4ebc3fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\681c3023-0bfd-4664-829e-f155b4ebc3fb.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6dac0dc6-77ae-452f-ac1b-6f49a4a57024.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6dac0dc6-77ae-452f-ac1b-6f49a4a57024.tmp
Size 11KB
SHA256 b8f40010484f6227376286957834886add8f14e76cc619c05b4bfe287131ca84
MD5 948df9e312fa979daa0ddde970f93e92
SHA1 9ff570f33bcdfbb2424e0e6ca0fe4026cdf42e6c
SHA512 bdcb828a6b75a06c8b6bbd61e36e56cb156fa8f094e5b2ca551091d92f65926568f72dff244b34d6c1537a3ae26e91e31910572642d7b3a033716273d1ff4e91
SSDEEP 192:sxZbRuZ+/fOsmcdWpVaQ9O8fIdpmhHW6+WNcA0D/Yez7d90IgyJ:sxZbc+/fOsmcdWvj08QKHbI/4O
TLSH
T1A142E751AD28A87B9CC7D20DBB557F13D6FA103295D51E48AAFCD91C04EABED320780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fa9b021-63b9-4626-adba-4597ac20760e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8fa9b021-63b9-4626-adba-4597ac20760e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 885d65e7f26c3d2d58558223ca6bd4d2b63c306a84b2460671e39ccaa8d1c4f6
MD5 6a7c0db9adc2816be417ee00e22e8781
SHA1 7b5c528cfa8b3c561905f7950e0dab463ae72247
SHA512 73737a7cf9be4c92e068188d8670d301ff4ec31ff8626948b8c241d279f84d6dc143163371090d8be8aae9a6dafc80ec32033db17752f9ae2de764aa84b55378
TLSH
T1B571FBF5719740E9FB984233A3D6A88B3130A4B069831F6230E9F4B99CCA7158DF7847
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bd55e41cc7e4af27a84ed523c5311a5a80d17ce7ba799446cf00f38c847d5373
MD5 e3ecb83c13ea824aa8f18a00c5f5df5b
SHA1 35529461afe8ef6245a6e741d8a2fd4a81609f36
SHA512 78f5c3d69130aae3234ca327b988c2f6e370f4a42308069b6edcb3f2f31939fdce5a7649a05bb69b941500f375d071d59be6dd2c01521a465b18f60209ce5579
TLSH
T1B561D8F5759341E9FB88467393D6948B313065B0A9831F6230E9F4789CCAB158CF790B
MD5 SHA1 SHA512 TLSH

Submit Download

12017fbc-c853-4de3-a782-72e543e970d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\12017fbc-c853-4de3-a782-72e543e970d0.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

3c9b20d4-b1a9-48cc-bc39-ebcee75148c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3c9b20d4-b1a9-48cc-bc39-ebcee75148c1.tmp
Size 1KB
SHA256 5c2473a714c3b40206b330a492085c93a0ff9a3cb7bfb095c3a4af9a89b1dffc
MD5 35def8d31e702c507b07268cec9e44ff
SHA1 40554da7bdae1946cd0004361c819c42dd3ae1a0
SHA512 62307fd24607a98c7e0eb3fdd754d1c10c6cd976c47f834938da0e3a5acf8333fea241940a67e7452edf619d3cb02bbdcd1f8b70a2754cc3ce1f7467e07741c9
TLSH
T17241CFF3C2E8852E890196F0A7147E2BCE1D0914432C3D5AC4E4EF6BD7E2471D24155F
MD5 SHA1 SHA512 TLSH

Submit Download

4fea1fa1-5388-49e4-819f-c7122bb518da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4fea1fa1-5388-49e4-819f-c7122bb518da.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a68bc849-279c-4988-b451-ee8e249eef5c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a68bc849-279c-4988-b451-ee8e249eef5c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c9f33a2624c7e9a5aaa2c70191d38561d76ea35c5b96d51d129707a8b760785a
MD5 8062dce39a02b2e8e804c5e65832250a
SHA1 95175d0d245960ce4849fcc21a56206f623cba10
SHA512 e460b41c0bf4e4511826b3c7b1585d0d3f8d8eb477b80de6ed4865673bbd5f87d15fa563050da0d984825c72247f07de328165f83febfa31cb1eb2a8c8eb5851
SSDEEP 96:KMIQKxiGOhWKSs6B6DGq8gcY4INL6CYKi960YuCi90I:izp9B6DGq8gc5IN2CO960xCi90I
TLSH
T1D691156531BB0A0538BD254893758B6E124232F37019F52BBFBC40E29D6EE040EFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d22a9004-f225-4ac9-819f-d86073c5be03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d22a9004-f225-4ac9-819f-d86073c5be03.tmp
Size 32KB
SHA256 b1ebaa832f5b02145c811d6888683f21096b541a7cbdb759f36a3cbc20b7ab22
MD5 d32efd29ad7d82152bb42615f70eebf9
SHA1 cda89065c7248a2f37cf35fbb934e84b675c7872
SHA512 735c550884684b9743864f53a7f8a167e09a2516da8ed5f7bba313bc3b2f18caf7c067cc0e509762e6d0c587c34e01591afdae89c3b49b612ce12923c91b6578
SSDEEP 768:5GyQRmC7pLuLjTrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOpmKLlRXH3arow:5GyQRmaEjTrWvvlpZu1ja7pmKLf33RQD
TLSH
T126E2FB7B780CCA7E4FC00EDCDD2A6E9A6DA802CB5698C94447FA945C02C7BEE51174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

ddf05f9b-fb09-40ce-9229-89d14385cf34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ddf05f9b-fb09-40ce-9229-89d14385cf34.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

FileSyncClient.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncClient.dll
Size 5.0MB
SHA256 3d0250f856970ff36862c99f3329a82be87b0de47923debefe21443c76cddf88
MD5 2df24cd5c96fb3fadf49e04c159d05f3
SHA1 4b46b34ee0741c52b438d5b9f97e6af14804ae6e
SHA512 a973bc6fd96221252f50ebb8b49774ccfd2a72e6b53e9a412582b0b37f585608e1b73e68f5d916e66b77247b130b4fc58bf49f5bf7a06e39b6931c5f7dac93ab
SSDEEP 98304:s8cqx4fMgrg+KKl7HHCJg8tvUPGvYakdR76D:s85Wwc7HHCJLUKYf6D
TLSH
T1FF367D323BD98429F47F0270296D5675867ABAB20B3382CF6751E30E19F49C25E72B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileSyncConfig.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
Size 553KB
SHA256 a3a4b648e4dcf3a4e5f7d13cc3d21b0353e496da75f83246cc8a15fada463bdf
MD5 57bd9bd545af2b0f2ce14a33ca57ece9
SHA1 15b4b5afff9abba2de64cbd4f0989f1b2fbc4bf1
SHA512 d134f9881312ddbd0d61f39fd62af5443a4947d3de010fef3b0f6ebf17829bd4c2f13f6299d2a7aad35c868bb451ef6991c5093c2809e6be791f05f137324b39
SSDEEP 12288:cscVDL0MP7LP6IX2ZlkCvzRkxdcEBTDvakst5VXsjl:csODVPd2ZlrvzujdBT2ksnVXsZ
TLSH
T1FDC45B322FECD13AD06383314965D2559379B8B01B334ACF6394275E2AA8EC19E37763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileSyncSessions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncSessions.dll
Size 3.7MB
SHA256 1e0c26ceecee602b5b4a25fb9b0433c26bac05bd1eee4a43b9aa75ae46ccf115
MD5 ae97076d64cdc42a9249c9de5f2f8d76
SHA1 75218c3016f76e6542c61d21fe6b372237c64f4d
SHA512 0668f6d5d1d012ec608341f83e67ce857d68b4ea9cfa9b3956d4fc5c61f8a6acd2c2622977c2737b936a735f55fdcce46477034f55e5a71e5ef4d115ee09bfec
SSDEEP 49152:iUVOcM56st3GTq3jG/l0EVx61z00qDNP79r0d6OtBSS98VW1rt3dA7bN5E0CRmeG:i6OcMMUWewlLD6TqD59Yx5UeRqhTX0G
TLSH
T143069D337299D671E91F0270515C6BA6C2FCDEB05B3285CB9684660E3EF58D29E3A703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileSyncTelemetryExtensions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncTelemetryExtensions.dll
Size 58KB
SHA256 a742c9e35d824b592b3d9daf15efb3d4a28b420533ddf35a1669a5b77a00bb75
MD5 51b6038293549c2858b4395ca5c0376e
SHA1 93bf452a6a750b52653812201a909c6bc1f19fa3
SHA512 b8cfdab124ee424b1b099ff73d0a6c6f4fd0bf56c8715f7f26dbe39628a2453cd63d5e346dbf901fcbfb951dfbd726b288466ff32297498e63dea53289388c0c
SSDEEP 768:i3Z3hmyXujRV3EH5NgU4ULpgsQ5Ryn3wVwBhYUZHWV4QgEyXRyNdQA/xtU:iJRmyEn3Q4OaPmwVwBqUU2EYRy8A/xa
TLSH
T1A043D765E7258602E9875075B91BA7630D3C397C2671C092FB4AF34D78297C4F2AAB0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileSyncViews.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncViews.dll
Size 2.4MB
SHA256 146740eddcb439b1222d545b4d32a1a905641d02b14e1da61832772ce32e76ba
MD5 8e9ef192850f858f60dd0cc588bbb691
SHA1 80d5372e58abfe0d06ea225f48281351411b997c
SHA512 793ad58741e8b9203c845cbacc1af11fb17b1c610d307e0698c6f3c2e8d41c0d13ceb063c7a61617e5b59403edc5e831ababb091e283fb06262add24d154bf58
SSDEEP 24576:eQcWFtoGx+xABhJq3OUYMuMgEsfnbCrH0K:zFtoeKzg1nbCrH0K
TLSH
T17BB50F2777D9DF12E0AD06304EBD80D41736BBA8AE51818F7141EB6D17B2F819D32B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogUploader.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogUploader.dll
Size 769KB
SHA256 fe49f22bb132fedf1412e99169d307fa715dbdd84fe71c3e3ff12300d30d4987
MD5 03f13c5ec1922f3a0ec641ad4df4a261
SHA1 b23c1c6f23e401dc09bfbf6ce009ce4281216d7e
SHA512 b47dbd9fad9467f72d4d0d5ca9df508247176f9e11b537c750837e8b3782a2d20f31fad361153d816ddf7f5e8109a614f3c6e4e2307af69cd3e2506cc0515d81
SSDEEP 12288:24dm5YfCSLK98EbtD8oMrWiM2kQsFTnlp+Jkj1:Pdm5aGvMr82wFTkkj1
TLSH
T164F47D336AEA813AE17F16320929559593BEB8701B3289CF6290775F19F4DC24E3B743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LoggingPlatform.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LoggingPlatform.dll
Size 504KB
SHA256 d5a538a0a036c602492f9b2b6f85de59924da9ec3ed7a7bbf6ecd0979bee54d3
MD5 4ffef06099812f4f86d1280d69151a3f
SHA1 e5da93b4e0cf14300701a0efbd7caf80b86621c3
SHA512 d667fd0ae46039914f988eb7e407344114944a040468e4ec5a53d562db2c3241737566308d8420bb4f7c89c6ef446a7881b83eaac7daba3271b81754c5c0f34a
SSDEEP 6144:dwTCtLPWX8adoMUxhR5JdMdkxMSCt/Fychq+JdAjfdiyvevO87D9xI+lQ8+5VlMY:CCWNdyxhDMdkxgfyCvJRZo75wzpkJ9JT
TLSH
T19EB46B326EDD8135E16F5230381AA25993B8E9700B3395CB57D4736F2BF89C19E36A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.contrast-black_scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-100.png
Size 1KB
SHA256 6f028542f6faeaaf1f564eab2605bedb20a2ee72cdd9930bde1a3539344d721b
MD5 72747c27b2f2a08700ece584c576af89
SHA1 5301ca4813cd5ff2f8457635bc3c8944c1fb9f33
SHA512 3e7f84d3483a25a52a036bf7fd87aac74ac5af327bb8e4695e39dada60c4d6607d1c04e7769a808be260db2af6e91b789008d276ccc6b7e13c80eb97e2818aba
TLSH
T12D2163DE103BA9FE9165C9A47BB143B2CC70A054012B956B010F05F708ABA19ACB1ED2
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-black_scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-125.png
Size 1KB
SHA256 cbdcf248f8a0fcd583b475562a7cdcb58f8d01236c7d06e4cdbfe28e08b2a185
MD5 b83ac69831fd735d5f3811cc214c7c43
SHA1 5b549067fdd64dcb425b88fabe1b1ca46a9a8124
SHA512 4b2ee6b3987c048ab7cc827879b38fb3c216dab8e794239d189d1ba71122a74fdaa90336e2ea33abd06ba04f37ded967eb98fd742a02463b6eb68ab917155600
TLSH
T1C1312E4606F0A4DB477ECA8DCAEEE5F19067F20189F082F9018B75D96657530D6B64C3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-black_scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-150.png
Size 2KB
SHA256 36a6aad9a9947ab3f6ac6af900192f5a55870d798bca70c46770ccf2108fd62d
MD5 771bc7583fe704745a763cd3f46d75d2
SHA1 e38f9d7466eefc6d3d2aaa327f1bd42c5a5c7752
SHA512 959ea603abec708895b7f4ef0639c3f2d270cfdd38d77ac9bab8289918cbd4dbac3c36c11bb52c6f01b0adae597b647bb784bba513d77875979270f4962b7884
TLSH
T16541C7C2533801BC7BEC48780E98F1329AB761BC453BA3BC7C081B07D8A94C6856C375
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-black_scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-200.png
Size 2KB
SHA256 67d1bb54fcb19c174de1936d08b5dbdb31b98cfdd280bcc5122fb0693675e4f2
MD5 09773d7bb374aeec469367708fcfe442
SHA1 2bfb6905321c0c1fd35e1b1161d2a7663e5203d6
SHA512 f500ea4a87a24437b60b0dc3ec69fcc5edbc39c2967743ddb41093b824d0845ffddd2df420a12e17e4594df39f63adad5abb69a29f8456fed03045a6b42388bc
TLSH
T18C511D42790CA4AB8942A931655C8631B24E5CA0CDE2D054F788DDFA24EEB5EF476E33
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-black_scale-400.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-400.png
Size 6KB
SHA256 5cb8fd670585de8a7fc0ceede164847522d287ef17cd48806831ea18a0ceac1f
MD5 e01cdbbd97eebc41c63a280f65db28e9
SHA1 1c2657880dd1ea10caf86bd08312cd832a967be1
SHA512 ffd928e289dc0e36fa406f0416fb07c2eb0f3725a9cdbb27225439d75b8582d68705ec508e3c4af1fc4982d06d70ef868cafbfc73a637724dee7f34828d14850
SSDEEP 96:Jf99IAakytjwNKZuwEyy4Mihd1FKf3tLV2ZauN8Vsr09L2:JHt4jwoZu2AfZVsj
TLSH
T1FBD14743F1A601862AB82EC582C5FAF5049E2C4C7BF2E7B10543236F97461E959BDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.contrast-white_scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-100.png
Size 2KB
SHA256 a024fc5dbe0973fd9267229da4ebfd8fc41d73ca27a2055715aafe0efb4f3425
MD5 19876b66df75a2c358c37be528f76991
SHA1 181cab3db89f416f343bae9699bf868920240c8b
SHA512 78610a040bbbb026a165a5a50dfbaf4208ebef7407660eea1a20e95c30d0d42ef1d13f647802a2f0638443ae2253c49945ebe018c3499ddbf00cfdb1db42ced1
TLSH
T14A51948DDC42CF04AF89A06216D9835AAD338F9CE5A1F16B2C9ACC825D211F1D76C1F5
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-white_scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-125.png
Size 3KB
SHA256 e8b30bfcee8041f1a70e61ca46764416fd1df2e6086ba4c280bfa2220c226750
MD5 8347d6f79f819fcf91e0c9d3791d6861
SHA1 5591cf408f0adaa3b86a5a30b0112863ec3d6d28
SHA512 9f658bc77131f4ac4f730ed56a44a406e09a3ceec215b7a0b2ed42d019d8b13d89ab117affb547a5107b5a84feb330329dc15e14644f2b52122acb063f2ba550
TLSH
T13251D90BB9D018704679FA5668C5F35BA86337EC45419C06B98FA74FC9201E2C6BD2D3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-white_scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-150.png
Size 3KB
SHA256 a0bbe33b798c3adac36396e877908874cffaadb240244095c68dff840dcbbf73
MD5 de5ba8348a73164c66750f70f4b59663
SHA1 1d7a04b74bd36ecac2f5dae6921465fc27812fec
SHA512 85197e0b13a1ae48f51660525557cceaeed7d893dd081939f62e6e8921bb036c6501d3bb41250649048a286ff6bac6c9c1a426d2f58f3e3b41521db26ef6a17c
TLSH
T1797162C5F42C0D409146E23EA1DD5581B7F10B7CD6A2F9C9FBAEA54302E45FA9089FA2
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-white_scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-200.png
Size 4KB
SHA256 fba9104432cbb8ebbd45c18ef1ba46a45dd374773e5aa37d411bb023ded8efd6
MD5 f1c75409c9a1b823e846cc746903e12c
SHA1 f0e1f0cf35369544d88d8a2785570f55f6024779
SHA512 ed72eb547e0c03776f32e07191ce7022d08d4bcc66e7abca4772cdd8c22d8e7a423577805a4925c5e804ed6c15395f3df8aac7af62f1129e4982685d7e46bd85
SSDEEP 96:cSJYkknmWIYvl+//zFHns188puB6CLIpXQ2PaS:cSykknplGzFHpUSIpX5aS
TLSH
T13C91E6DEE890C8407A0BDD41A9A0D3DB5ABE05C179B0BCB55BA4D98F4833CB1C6DF592
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.contrast-white_scale-400.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-400.png
Size 8KB
SHA256 9250ef25efc2a9765cf1126524256fdfc963c8687edfdc4a2ecde50d748ada85
MD5 adbbeb01272c8d8b14977481108400d6
SHA1 1cc6868eec36764b249de193f0ce44787ba9dd45
SHA512 c15951cf2dc076ed508665cd7dac2251c8966c1550b78549b926e98c01899ad825535001bd65eeb2f8680cd6753cd47e95606ecf453919f5827ed12bca062887
SSDEEP 192:9Sykkn0RefAHwGvINqjaSq1uahCNW2w9mb7mKS:8en8NwNYOeFba1
TLSH
T1FA02E1CE27D61C511968BBC30AC0B782842E16BD5D8B5CA5FA69C341F0BDD6E037B993
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-100.png
Size 2KB
SHA256 8acbdd41252595b7410ca2ed438d6d8ede10bd17fe3a18705eedc65f46e4c1c4
MD5 57a6876000151c4303f99e9a05ab4265
SHA1 1a63d3dd2b8bdc0061660d4add5a5b9af0ff0794
SHA512 c6a2a9124bc6bcf70d2977aaca7e3060380a4d9428a624cc6e5624c75ebb6d6993c6186651d4e54edf32f3491d413714ef97a4cdc42bae94045cd804f0ad7cba
TLSH
T1975109546FEEA6FF9773904207054F3498FA5EC61A30A3177B3D68AE9CB62061560C38
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-125.png
Size 4KB
SHA256 a5294e3c7cd855815f8d916849d87bd2357f5165eb4372f248fdf8b988601665
MD5 d03b7edafe4cb7889418f28af439c9c1
SHA1 16822a2ab6a15dda520f28472f6eeddb27f81178
SHA512 59d99f0b9a7813b28bae3ea1ae5bdbbf0d87d32ff621ff20cbe1b900c52bb480c722dd428578dea5d5351cc36f1fa56b2c1712f2724344f026fe534232812962
SSDEEP 96:L5Zy3CmIOD1skTcTG/3QplxPxPIhO2jhH/lxRYLRHRcSI+gK:L503C1ODeIOY3wX5PIIktlXY1H9vgK
TLSH
T1E68119984FC6CBB5DC3B69EE6785427082C552B0B07C78A8DA25B400FF7AED858D49C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-150.png
Size 5KB
SHA256 3df4590386671e0d6fee7108e457eb805370a189f5fdfeaf2f2c32d5adc76abd
MD5 a23c55ae34e1b8d81aa34514ea792540
SHA1 3b539dfb299d00b93525144fd2afd7dd9ba4ccbf
SHA512 1423a2534ae71174f34ee527fe3a0db38480a869cac50b08b60a2140b5587b3944967a95016f0b00e3ca9ced1f1452c613bb76c34d7ebd386290667084bce77d
SSDEEP 96:ia6PoHkGJgd0Nmt4xTOtlCjtH7zQqLH4hn+MwXWx0xfD+H9LROm:ia6ARJZNtxO2h7ZLY1+MAWmxCHVt
TLSH
T1D5B12ADA64F9DEA7C5B07501403711749F2DE4635FCF20978B7FB2BC88A59649C50C62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-200.png
Size 6KB
SHA256 3384357b6110f418b175e2f0910cffe588c847c8e55f2fe3572d82999a62c18e
MD5 13e6baac125114e87f50c21017b9e010
SHA1 561c84f767537d71c901a23a061213cf03b27a58
SHA512 673c3bec7c2cd99c07ebfca0f4ab14cd6341086c8702fe9e8b5028aed0174398d7c8a94583da40c32cd0934d784062ad6db71f49391f64122459f8bb00222e08
SSDEEP 96:gfaOPOqfO9OntEIwWwMKnx67PrURatSfC2mMrEgmCt1kY7sXjGR1eXH/01bPgJPF:gNtnwxx60RqSrmMrJmC1kYYGR1eXH8kF
TLSH
T1FAE14C86F7CC8CDBA97A1407BF836F30882C825F2D6057F88441047EDE436586C67EAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.scale-400.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-400.png
Size 15KB
SHA256 deb0ec0ee8f1c4f7ea4de2c28ff85087ee5ff8c7e3036c3b0a66d84bae32b6bb
MD5 e593676ee86a6183082112df974a4706
SHA1 c4e91440312dea1f89777c2856cb11e45d95fe55
SHA512 11d7ed45f461f44fa566449bb50bcfce35f73fc775744c2d45ea80aeb364fe40a68a731a2152f10edc059dea16b8bab9c9a47da0c9ffe3d954f57da0ff714681
SSDEEP 192:RnafhqshxJKO9rKQGKsNq94yRMDbJ5VwG5y/5HrEuByuLsrjp8xdaTUZ5tAXx8im:Ra8OKhpxfBwG5YLDjWux/AXdVP4F
TLSH
T169627D96F18B01476BBD7AE6D5D1FEA9144F1D0DFB71E7720A42222FAB406E104ADCC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSmallTile.scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-100.png
Size 1KB
SHA256 4e11167708801727891e8dd9257152b7391fc483d46688d61f44b96360f76816
MD5 1f156044d43913efd88cad6aa6474d73
SHA1 1f6bd3e15a4bdb052746cf9840bdc13e7e8eda26
SHA512 df791d7c1e7a580e589613b5a56ba529005162d3564fffd4c8514e6afaa5eccea9cea9e1ac43bd9d74ee3971b2e94d985b103176db592e3c775d5feec7aac6d1
TLSH
T171410A4C0E36686A4EA80A63B339A6061BAB8E08D08D6FD4D514EC4E924D8C30F8037C
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-125.png
Size 2KB
SHA256 69e432d1eec44bed4aad35f72a912e1f0036a4b501a50aec401c9fa260a523e3
MD5 09f3f8485e79f57f0a34abd5a67898ca
SHA1 e68ae5685d5442c1b7acc567dc0b1939cad5f41a
SHA512 0eafeaf735cedc322719049db6325ccbf5e92de229cace927b78a08317e842261b7adbda03ec192f71ee36e35eb9bf9624589de01beaec2c5597a605fc224130
TLSH
T104511DFF4545879EF346D89D206439DF9C3E3F38BB4AC254548186717E0113D6574587
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-150.png
Size 3KB
SHA256 7e3f35d5eb05435be8d104a2eacf5bace8301853104a4ea4768601c607ddf301
MD5 ed306d8b1c42995188866a80d6b761de
SHA1 eadc119bec9fad65019909e8229584cd6b7e0a2b
SHA512 972a42f7677d57fcb8c8cb0720b21a6ffe9303ea58dde276cfe2f26ee68fe4cc8ae6d29f3a21a400253de7c0a212edf29981e9e2bca49750b79dd439461c8335
TLSH
T16C716DCAD2D4082DE35368453B97BCBBD15B84163D7499284546B8EF06726AEEE0C760
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-200.png
Size 4KB
SHA256 85823f7a5a4ebf8274f790a88b981e92ede57bde0ba804f00b03416ee4feda89
MD5 d9d00ecb4bb933cdbb0cd1b5d511dcf5
SHA1 4e41b1eda56c4ebe5534eb49e826289ebff99dd9
SHA512 8b53dec59bba8b4033e5c6b2ff77f9ba6b929c412000184928978f13b475cd691a854fee7d55026e48eab8ac84cf34fc7cb38e3766bbf743cf07c4d59afb98f4
SSDEEP 96:eL1TUq/OmmTrKuYII7MenCK1R0yr/+3AJhQNr1iv3Nja0Ln:eL9UFmwrKuYIYMfmR/cJp0v3NjaKn
TLSH
T168A15C589992E87A930FB3D685C8F3B799F9A7C6736B86DC223A01113492B4D2CC6D14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSmallTile.scale-400.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-400.png
Size 11KB
SHA256 9a0b901e97abe02036c782eb6a2471e18160b89fd5141a5a9909f0baab67b1ef
MD5 096d0e769212718b8de5237b3427aacc
SHA1 4b912a0f2192f44824057832d9bb08c1a2c76e72
SHA512 99eb3d67e1a05ffa440e70b7e053b7d32e84326671b0b9d2fcfcea2633b8566155477b2a226521bf860b471c5926f8e1f8e3a52676cacb41b40e2b97cb3c1173
SSDEEP 192:jSAHMMNs2kU4s9nHuXJHAk0qh5UdkWsHi1dVw069+yyk/AfLTmf+TJB6cQYaN5lo:OKNs2kPDCMh5DqdVw0bk/GmSd+Q0i7n
TLSH
T175328C9652FFD6BEEB18AE315E41F7376C1D3800A158EE81C122BDC62BCBE0406A3605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDrive.VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDrive.VisualElementsManifest.xml
Size 344B
SHA256 d21077ad0c29a4c939b8c25f1186e2b542d054bb787b1d3210e9cab48ec3080c
MD5 5ae2d05d894d1a55d9a1e4f593c68969
SHA1 a983584f58d68552e639601538af960a34fa1da7
SHA512 152949f5b661980f33608a0804dd8c43d70e056ae0336e409006e764664496fef6e60daa09fecb8d74523d3e7928c0dbd5d8272d8be1cf276852d88370954adc
TLSH
T13EE02688B16841C263D369B5643399CD329D329FC3C905C296A145B62154CCC4D8B18E
MD5 SHA1 SHA512 TLSH

Submit Download

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDrive.exe
Size 2.3MB
SHA256 5d8273bf98397e4c5053f8f154e5f838c7e8a798b125fcad33cab16e2515b665
MD5 c2938eb5ff932c2540a1514cc82c197c
SHA1 2d7da1c3bfa4755ba0efec5317260d239cbb51c3
SHA512 5deb54462615e39cf7871418871856094031a383e9ad82d5a5993f1e67b7ade7c2217055b657c0d127189792c3bcf6c1fcfbd3c5606f6134adfafcccfa176441
SSDEEP 49152:YwcM40vky++ia4lw4XyTtsBP/OlsLzFmNfW6FJKxxfZA4XFrF:YwcMpiacw4XzBP/OlsLzFmNfW6FJKxxl
TLSH
T1A8B5C5D63E91B2B6D19CD8313567B3BC866BBC386F534E8F6287FF2E02351945926012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDriveStandaloneUpdater.exe
Size 2.9MB
SHA256 969fbb03015dd9f33baf45f2750e36b77003a7e18c3954fab890cddc94046673
MD5 9cdabfbf75fd35e615c9f85fedafce8a
SHA1 57b7fc9bf59cf09a9c19ad0ce0a159746554d682
SHA512 348923f497e615a5cd0ed428eb1e30a792dea310585645b721235d48f3f890398ad51d8955c1e483df0a712ba2c0a18ad99b977be64f5ee6768f955b12a4a236
SSDEEP 49152:X63yWRyqw4amAiJkGrzzGWxTGdY9JPEHUxJyEl276xDeaGtkf6IUDeOCxbyvTovg:q3HRyq2mAiJ7qY93Dw/9tkketo
TLSH
T14CE58E21B7C58037F1B3017056AC9275A6B8B6312B3249CF62C07B9E7B749C17E36A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveTelemetryStable.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDriveTelemetryStable.dll
Size 1.6MB
SHA256 146811735589450058048408f05644a93786a293c09ccb8d74420fb87c0a4d56
MD5 6e8ae346e8e0e35c32b6fa7ae1fc48c3
SHA1 ca0668ddb59e5aa98d9a90eceba90a0ee2fb7869
SHA512 aa65ef969b1868a54d78a4f697e6edbded31b118f053bbe8a19a599baaf63821dc05f75b2ac87452cb414ab6572b8d9b349093931e64601c47f8ebbb49c431cd
SSDEEP 49152:k/KP7NCxsPhupiOva/T1p6XzAyT9DTYkdl5g:o2wxcuFvU6Wkd0
TLSH
T1B0759F22EA41C03AF58B00F2867A5679E77CE770172011EB67C46B9EBF749D27931A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resources.pri

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Resources.pri
Size 4KB
SHA256 e1252527bc066da6838344d49660e4c6ff2d1ddfda036c5ec19b07fdfb90c8c3
MD5 7473be9c7899f2a2da99d09c596b2d6d
SHA1 0f76063651fe45bbc0b5c0532ad87d7dc7dc53ac
SHA512 a4a5c97856e314eedbad38411f250d139a668c2256d917788697c8a009d5408d559772e0836713853704e6a3755601ae7ee433e07a34bd0e7f130a3e28729c45
SSDEEP 96:WqGIsIgAI+IOIZIgIwI7IiI9IFI0IcI/IkFDLEaOkIzNjkIzSjjSyIzIjzIzMjXG:Wqe1DLyejmW9fISjQU5vr8xdndbb
TLSH
T113913AA12E2E5F13E3A73339A45252202778BE06D31B0992225C51395979FD47CBCBED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SyncEngine.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\SyncEngine.dll
Size 8.3MB
SHA256 51b13dd5d598367fe202681dce761544ee3f7ec4f36d0c7c3c8a3fca32582f07
MD5 0e57c5bc0d93729f40e8bea5f3be6349
SHA1 7895bfd4d7ddced3c731bdc210fb25f0f7c6e27e
SHA512 1e64aaa7eaad0b2ea109b459455b745de913308f345f3356eabe427f8010db17338806f024de3f326b89bc6fd805f2c6a184e5bae7b76a8dcb9efac77ed4b95b
SSDEEP 196608:6csll0jt/67F5OnOZQqyFmvGhHxhLQtZD8zSx+HktX1CAReS6lo:xjt/67XE+7ys+ZxhLue3lo
TLSH
T135967D33E7F8543AF1BB0771A97911459639BA712B3285CF6101631E19B2AC39E36F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telemetry.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Telemetry.dll
Size 451KB
SHA256 414f6f64d463b3eb1e9eb21d9455837c99c7d9097f6bb61bd12c71e8dce62902
MD5 50ea1cd5e09e3e2002fadb02d67d8ce6
SHA1 c4515f089a4615d920971b28833ec739e3c329f3
SHA512 440ededc1389b253f3a31c4f188fda419daf2f58096cf73cad3e72a746bdcde6bde049ce74c1eb521909d700d50fbfddbf802ead190cd54927ea03b5d0ce81b3
SSDEEP 6144:Cs8wOCDR71pgOYV3jUaX6pvHWgUDpapwrpwyOkkc2byJMztvBTBsCgNNdW0gY4MC:P8wOmREh3jKp39ybQ5vBTCCgjL0Ek5
TLSH
T109A44B3267958539E0AF03B06529915453B9F8B01F32D2CF9BC8671F2BB8AC19E37653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateRingSettings.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\UpdateRingSettings.dll
Size 432KB
SHA256 9fb3abcafd8e8b1deb13ec0f46c87b759a1cb610b2488052ba70e3363f1935ec
MD5 037df27be847ef8ab259be13e98cdd59
SHA1 d5541dfa2454a5d05c835ec5303c84628f48e7b2
SHA512 7e1a04368ec469e4059172c5b44fd08d4ea3d01df98bfd6d4cc91ac45f381862ecf89fe9c6bedce985a12158d840cd6cfa06ce9d22466fbf6110140465002205
SSDEEP 6144:+u30QPcNF7LqMG80zQVkqwD+dUZzYrGeDHT8Qser/iHH3aZCgCfNbfb9g7wclPXc:L0QGFNlVk1ZIlfCa7CFbfXcl2kxPHo
TLSH
T15A945C726A998039E16F567074189285A3B8E9B01F33D6CFD384765F2BF8DC19B36603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\WebView2Loader.dll
Size 107KB
SHA256 41a13ba97534c7f321f3f29ef1650bd445bd3490153a2bb2d57e0fbc70d339c1
MD5 925531f12a2f4a687598e7a4643d2faa
SHA1 26ca3ee178a50d23a09754adf362e02739bc1c39
SHA512 221934308658f0270e8a6ed89c9b164efb3516b2cc877216adb3fbd1dd5b793a3189afe1f6e2a7ef4b6106e988210eeb325b6aa78685e68964202e049516c984
SSDEEP 3072:9XKaNm8sCEvfpFVUKbiDUuP7ANt+/NvcD/EtK9nsnRj81VLI:96ac8sCiXbiguP7n8EtSnIRQ1VLI
TLSH
T1C7B36B5075D0C071EAAE193D0474DA656B3F7A60EF709DEB2B5406AE4E303C1DE34A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\msvcp140.dll
Size 425KB
SHA256 545bb4a00b29b4b5d25e16e1d0969e99b4011033ce3d1d7e827abef09dd317e7
MD5 ce8a66d40621f89c5a639691db3b96b4
SHA1 b5f26f17ddd08e1ba73c57635c20c56aaa46b435
SHA512 85fc18e75e4c7f26a2c83578356b1947e12ec002510a574da86ad62114f1640128e58a6858603189317c77059c71ac0824f10b6117fa1c83af76ee480d36b671
SSDEEP 12288:Ggc0BGzePo6+J+4P0xYv7IQgVhUgiW6QR7t5s03Ooc8dHkC2espkWKb:A01Po6+J+dxYv7IQgy03Ooc8dHkC2egG
TLSH
T189943932BB464DF1E48913B971C9472193F9FC610362E3C397DAF12A2F566C6A633A50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\ucrtbase.dll
Size 1.1MB
SHA256 5ade748445d8da8f22d46ad46f277e1e160f6e946fc51e5ac51b9401ce5daf46
MD5 7a333d415adead06a1e1ce5f9b2d5877
SHA1 9bd49c3b960b707eb5fc3ed4db1e2041062c59c7
SHA512 d388cb0d3acc7f1792eadfba519b37161a466a8c1eb95b342464adc71f311165a7f3e938c7f6a251e10f37c9306881ea036742438191226fb9309167786fa59a
SSDEEP 24576:Bh85O5bBi5MSggquSDJls3gvpmcvIZPoy4NahZ:b85mgquSDJlCOaj
TLSH
T155357C10BB88C1B6DCA971BC079DF67E05AE72401B28A8C37BF44BEED43C1C1A576659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\vcruntime140.dll
Size 73KB
SHA256 c79241aec5e35cba91563c3b33ed413ce42309f5145f25dc92caf9c82a753817
MD5 cefcd5d1f068c4265c3976a4621543d4
SHA1 4d874d6d6fa19e0476a229917c01e7c1dd5ceacd
SHA512 d934c43f1bd47c5900457642b3cbdcd43643115cd3e78b244f3a28fee5eea373e65b6e1cb764e356839090ce4a7a85d74f2b7631c48741d88cf44c9703114ec9
SSDEEP 1536:52HuqvERNjBwySXtVaSvrgOFw9RxKMniecbCera4:52HZMRNjKySdLcOiHiecbCerD
TLSH
T1F4739E0278D0C272D1AD4AB9057AF612663DAA204FD15FDB7FD858C8AB75AC1EF31213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSmallTile.contrast-black_scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png
Size 783B
SHA256 292cac291af7b45f12404f968759afc7145b2189e778b14d681449132b14f06b
MD5 f4e9f958ed6436aef6d16ee6868fa657
SHA1 b14bc7aaca388f29570825010ebc17ca577b292f
SHA512 cd5d78317e82127e9a62366fd33d5420a6f25d0a6e55552335e64dc39932238abd707fe75d4f62472bc28a388d32b70ff08b6aa366c092a7ace3367896a2bd98
TLSH
T1FA01659BF7428CCCFBBB19E1313209B22957B85C8B81A409B0137061156534E62CB399
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.contrast-black_scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png
Size 1018B
SHA256 8efeacefb92d64dfb1c4df2568165df6436777f176accfd24f4f7970605d16c2
MD5 2c7a9e323a69409f4b13b1c3244074c4
SHA1 3c77c1b013691fa3bdff5677c3a31b355d3e2205
SHA512 087c12e225c1d791d7ad0bf7d3544b4bed8c4fb0daaa02aee0e379badae8954fe6120d61fdf1a11007cbcdb238b5a02c54f429b6cc692a145aa8fbd220c0cb2d
TLSH
T10C11FC7F03204A1F884B2AAB8000AE173A8F165A6036890CBA62DAF0C15A49BF842043
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.contrast-black_scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png
Size 1KB
SHA256 262b9a30bb8db4fc59b5bc348aa3813c75e113066a087135d0946ad916f72535
MD5 552b0304f2e25a1283709ad56c4b1a85
SHA1 92a9d0d795852ec45beae1d08f8327d02de8994e
SHA512 9559895b66ef533486f43274f7346ad3059c15f735c9ce5351adf1403c95c2b787372153d4827b03b6eb530f75efcf9ae89db1e9c69189e86d6383138ab9c839
TLSH
T103210F4DF2490C11D398CC193BDFD12F6B1312A741C8764A0653542B21DC0483E3CBAE
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.contrast-black_scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png
Size 1KB
SHA256 9833b80def72b73fca150af17d4b98c8cd484401f0e2d44320ecd75b5bb57c42
MD5 22e17842b11cd1cb17b24aa743a74e67
SHA1 f230cb9e5a6cb027e6561fabf11a909aa3ba0207
SHA512 8332fc72cd411f9d9fd65950d58bf6440563dc4bd5ce3622775306575802e20c967f0ee6bab2092769a11e2a4ea228dab91a02534beeb8afde8239dd2b90f23a
TLSH
T16431DBC06ADD1C965657DA03677101B48C69FB4A0539E50C9581F570B54413CF7244EE
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.contrast-black_scale-400.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png
Size 3KB
SHA256 3a7ef7c0bda402fdaff19a479d6c18577c436a5f4e188da4c058a42ef09a7633
MD5 3c29933ab3beda6803c4b704fba48c53
SHA1 056fe7770a2ba171a54bd60b3c29c4fbb6d42f0c
SHA512 09408a000a6fa8046649c61ccef36afa1046869506f019f739f67f5c1c05d2e313b95a60bd43d9be882688df1610ad7979dd9d1f16a2170959b526ebd89b8ef7
TLSH
T1FA713BBDD64272D5A936C35FBEC459BD9981430D6FB2F14008D24AF7238CC567084AF2
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSetup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
Size 40.2MB
SHA256 e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9
MD5 fb4aa59c92c9b3263eb07e07b91568b5
SHA1 6071a3e3c4338b90d892a8416b6a92fbfe25bb67
SHA512 60aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace
SSDEEP 786432:YMwQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59w:YpQcWxDMPnN+dk65gGUjku4vNjLjw
TLSH
T170972212ABD88075F2B79270697A63B5867ABD703F36C5CF62843A5E1B30DC19931723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.xml

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\update.xml
Size 726B
SHA256 36a6bd38a8a6f5a75b73caffae5ae66dfabcaefd83da65b493fa881ea8a64e7d
MD5 53244e542ddf6d280a2b03e28f0646b7
SHA1 d9925f810a95880c92974549deead18d56f19c37
SHA512 4aa71d92ea2c46df86565d97aac75395371d3e17877ab252a297b84dca2ab251d50aaffc62eab9961f0df48de6f12be04a1f4a2cbde75b9ae7bcce6eb5450c62
TLSH
T13601CBD640B0BD3687A01C9CA71EB5BCFB33335F1E9A9511B041601F2E9A6CCE50F0A2
MD5 SHA1 SHA512 TLSH

Submit Download

assertInformation.ini

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\assertInformation.ini
Size 308B
SHA256 90b4a8b1d9809e2969eb78f39a9667072c00e8534fcf987285ba6c28e2bd2432
MD5 280b5afd845bd6385d91217d861a0c18
SHA1 34e8dbb457e6ad55b4a508c1729c8d5cdac5f6b0
SHA512 a458ca0f84be319fc256018a1abf7fb9d14a48b0f7ad992ecb940ec7d8cfc7820d76e5d2f06841d184b948923d50a3669d72867fafdc328146049d4fc5e5a525
TLSH
T1D3E06293AEE82485A17FBD046AB000519B8330251C7EE92DD2D3221ED1F0644E83B351
MD5 SHA1 SHA512 TLSH

Submit Download

logUploaderSettings.ini

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings.ini
Size 38B
SHA256 884d272d16605590e511ae50c88842a8ce203a864f56061a3c554f8f8265866e
MD5 cc04d6015cd4395c9b980b280254156e
SHA1 87b176f1330dc08d4ffabe3f7e77da4121c8e749
SHA512 d3cb7853b69649c673814d5738247b5fbaaae5bb7b84e4c7b3ff5c4f1b1a85fc7261a35f0282d79076a9c862e5e1021d31a318d8b2e5a74b80500cb222642940
MD5 SHA1 SHA512

Submit Download

PreSignInSettingsConfig.json

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.json
Size 63KB
SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
MD5 e516a60bc980095e8d156b1a99ab5eee
SHA1 238e243ffc12d4e012fd020c9822703109b987f6
SHA512 9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58
SSDEEP 384:poaSLGTSy3S0XuMU9mCzHS7vpvpJGV6Hu/i49Pji7iJI5TZCP56vS1xDR+dBUFvT:WryF7U9mCzHS7vu/xV2iP56vcDR+P0T
TLSH
T18A53DD9E2108B66FE215AD5A7EABA9861C31746E3842CFCDF1CDC26C5F40DC4334A5A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DeviceHealthSummaryConfiguration.ini

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.ini
Size 77B
SHA256 b5995fca6b821e41f3d8de422ccf9fe32ee490e39110a100735699f209b820a0
MD5 0c5f6017142ff4ff268bc984c0a43470
SHA1 0798e0ada21e93fbde4f5dd061c51f203fab166e
SHA512 3e2861befef8b073a9fb59fc2f7b00ea51b10d98bb563eb543e9f2f7ffd17ebc3c8a41067d34f9a64a5541e66b7bfe3fed08e8d98caf5bae357d092cdd1ffe5c
TLSH
T140A0126006150356013995AB1031804A04B843C490440114202A3211091C24814B3035
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e375c4d9ed54eb5a025058ae61a9ca9e7afe60544e0ec7f7a08da078505350d5
MD5 6172c35a34a010772c65482794f5491d
SHA1 bd5363b2ed026f54e70c6d2275a251260ec97238
SHA512 e709e829221acfe3491845f69b824573d88f4e985a1491a6f80760cbd58fe55b9d1a92b7b4585e16ce90cf4bd128c13982583e97a078c8d5f985a17af8225e3d
TLSH
T1AA412858BAE91148B7B72F5AAFF6A8AD483BBD732E06855E00110D4F0A22B40C871733
MD5 SHA1 SHA512 TLSH

Submit Download

21.220.1024[1].json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EQ5O6WBF\21.220.1024[1].json
Size 5KB
SHA256 822e6f4160f27ed96ccb7a6ada70a368eddaacf059ebe75c9f2e3ab426b77220
MD5 d80d4770e82fe3e7676ffd725bd0d04d
SHA1 769a60c6e30048362023b57e1b06b1322fc9d0dd
SHA512 c7aa0fd940d0830fbe443f92f5b81bc493a43bff74ded9e55abdf6e8b53ef195d9b27bd52a0708a1d96a5a5e2a33e47d0432c6cd99ea14e3e56d95ae734251cd
SSDEEP 96:eI2skSVKCagXTcOgjDbryA/LWkp/9NfaDZMih96l4mQcB8o:eIT0njoDe4mQcB5
TLSH
T1CFB1B6D83AA855F6D5D2C1084F6AFF183CFF147754AB5964B4EC02083079BA7634385B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21.220.1024[1].json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FOWD993E\21.220.1024[1].json
Size 5KB
SHA256 cdef4d5c90717ec9055713cea3f8e96e34d5a298ef039ad960f84b74044585dd
MD5 b07de197107cdc158d5927903c8aee41
SHA1 9fc5cf33215a25302353486f328304b43308d367
SHA512 f5b2399bf1acd13da1308626a3f47fe5496332fd7d6de259376cd6610fa06c4a7a267e2630ee6567c9e57cded44209590e8643265401b4a548e31ac5ecf3ec9a
SSDEEP 96:eI2skSVKCaVXTcOgjDbryA/LW8HE/9NfaDZMih96l4mQcB8b:eIT0ij7De4mQcBi
TLSH
T10DB1C7D83AA846F6D592C1084F6EFF183CFF147754AB5968B4EC02083079BA7A34385B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21.220.1024[1].json

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LM36AMZP\21.220.1024[1].json
Size 5KB
SHA256 a7c62e43e34b9f9289f999c5e7fe025179f81f976d485db36cca2bc186195e87
MD5 bcdeb669166e26068c5d79d380ed6dab
SHA1 4a483995b9ff9b5ebb0c90ea2c10d0f48fdf5eb4
SHA512 3565927f47743bbc42c074a3b2a052c8928fc64cecccebd4934370e0df6f0c94122414b1d2fc06fc61755b43ac0cdf76d764be634c400d795bcc91cf428be8d2
SSDEEP 96:eI2skSVKCanXTcOgjDbryA/LWG+L/9NfaDZMih96l4mQcB8i:eIT04jx3De4mQcBf
TLSH
T123B1A5D83AA856F6E592C1094F6AFF183CFF147754AB5968B4EC02083079BA7634385B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29a3e670-edb1-415e-abc1-2fa816ccbf5d.tmp

Path C:\Users\Admin\AppData\Local\Temp\29a3e670-edb1-415e-abc1-2fa816ccbf5d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

4379ef3d-84d3-40b6-b0e3-b37bbdaa398b.tmp

Path C:\Users\Admin\AppData\Local\Temp\4379ef3d-84d3-40b6-b0e3-b37bbdaa398b.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aria-debug-5192.log

Path C:\Users\Admin\AppData\Local\Temp\aria-debug-5192.log
Size 470B
SHA256 ce555b4fa30cc7c62e04fdc593d3ac2592ced836898115987f335ec678519135
MD5 da8983b4ea0f5bef37ab04b0d5a27468
SHA1 30232fd9cf505c0cc7f33c7c4a49b942e4bd4abd
SHA512 abb4b3bedd3cec23a805b32080e89ecd1cb92704b056ee675068845ba9eb5511272528ba6f1c657e14ceb80f6eec4f93ca63b024a30be83c99a879cd05049c90
TLSH
T1CDF09E8A0A6F4C63C24B32B3F5639AE328D5D67FB2D40744861D832820473C86243C80
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir788_793204151\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir788_85641908\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c75ede36-9f94-49fd-a550-7c269afd690b.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir788_85641908\c75ede36-9f94-49fd-a550-7c269afd690b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpE67E.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpE67E.tmp
Size 35.9MB
SHA256 bbc70091b3834af5413b9658b07269badd4cae8d96724bf1f7919f6aab595009
MD5 5b16ef80abd2b4ace517c4e98f4ff551
SHA1 438806a0256e075239aa8bbec9ba3d3fb634af55
SHA512 69a22b063ab92ca7e941b826400c62be41ae0317143387c8aa8c727b5c9ee3528ddd4014de22a2a2e2cbae801cb041fe477d68d2684353cdf6c83d7ee97c43d4
SSDEEP 786432:QDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59C:OxDMPnN+dk65gGUjku4vNjLjC
TLSH
T13E873351A4E6C6BCEEF3E4B321EF5255E75103B5D2BEC03F2AD86E443592B98803462D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download