ec39cc24fd028e8ca5e514e06c2fe291bc07f6109cbf787ef2a9768c13fbbf3f

Analysis

max time kernel
149s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-07_4a72276a8041a53e07925b2fdd043354_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.3MB
Sample261107-ry6f3afb77
SHA256 ec39cc24fd028e8ca5e514e06c2fe291bc07f6109cbf787ef2a9768c13fbbf3f
MD5 4a72276a8041a53e07925b2fdd043354
SHA1 c27b19ee428f9428e80745ab33e138ae282fd0b4
SHA512 b5caca155e0d96288cf5a2fabcfd3280ac7cc5fac44b90cd3b229f0cec740ae10b0f0f533938f7e19070b5f48ed51bfd6fc100cef5ca3f674bd767bb7e11ed9c
SSDEEP 49152:wl+s+BXMPJateq3qbqpHnhfWSsRyV2RRtPoLr7P+cansoivTxr3POT8A:fL3UG3mgA
TLSH
T139264A0BA7F901F4D0BAD1798AA79517FA72785987319BDF0391465A0F23BE09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware defense_evasion discovery persistence privilege_escalation spyware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\""	OneDriveSetup.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	FileSyncConfig.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	OneDrive.Sync.Service.exe
File opened (read-only)	\??\E:	OneDrive.Sync.Service.exe
File opened (read-only)	\??\F:	OneDrive.Sync.Service.exe
File opened (read-only)	\??\E:	OneDrive.Sync.Service.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 12 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDrive.Sync.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDrive.Sync.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDriveStandaloneUpdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDriveLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDrive.Sync.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDriveStandaloneUpdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDriveLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDrive.Sync.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDriveSetup.exe

Executes dropped EXE 7 IoCs

pid	Process
3820	OneDriveSetup.exe
2204	OneDriveSetup.exe
1248	FileSyncConfig.exe
5936	OneDrive.Sync.Service.exe
3460	OneDriveStandaloneUpdater.exe
4520	OneDriveLauncher.exe
3380	OneDrive.Sync.Service.exe

Loads dropped DLL 64 IoCs

pid	Process
1248	FileSyncConfig.exe
1248	FileSyncConfig.exe
1248	FileSyncConfig.exe
1248	FileSyncConfig.exe
1248	FileSyncConfig.exe
1248	FileSyncConfig.exe
1248	FileSyncConfig.exe
1248	FileSyncConfig.exe
1248	FileSyncConfig.exe
1248	FileSyncConfig.exe
1248	FileSyncConfig.exe
1248	FileSyncConfig.exe
1248	FileSyncConfig.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
4520	OneDriveLauncher.exe
4520	OneDriveLauncher.exe
4520	OneDriveLauncher.exe
4520	OneDriveLauncher.exe
4520	OneDriveLauncher.exe
4520	OneDriveLauncher.exe
4520	OneDriveLauncher.exe
4520	OneDriveLauncher.exe
4520	OneDriveLauncher.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
5936	OneDrive.Sync.Service.exe
3380	OneDrive.Sync.Service.exe

Modifies system executable filetype association 2 TTPs 3 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDriveSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OneDriveStandaloneUpdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OneDriveStandaloneUpdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OneDrive.Sync.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-07_4a72276a8041a53e07925b2fdd043354_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OneDriveLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OneDrive.Sync.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OneDrive.Sync.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-07_4a72276a8041a53e07925b2fdd043354_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OneDriveLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OneDrive.Sync.Service.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDriveSetup.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_CLASSES\SYNCENGINEFILEINFOPROVIDER.SYNCENGINEFILEINFOPROVIDER.1\CLSID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Interface\{2FF96428-73F3-4E3A-9C40-AF2D855AEB0F}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Interface\{C47B67D4-BA96-44BC-AB9E-1CAC8EEA9E93}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\Interface\{D32F7B3A-DEC8-4F44-AF28-E9B7FEB62118}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\Interface\{944903E8-B03F-43A0-8341-872200D2DA9C}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Interface\{466F31F7-9892-477E-B189-FA5C59DE3603}\ = "ISyncEngineHoldFile"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Interface\{5d65dd0d-81bf-4ff4-aeea-6effb445cb3f}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_CLASSES\WOW6432NODE\INTERFACE\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\Interface\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}\TypeLib	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}\ = "IFileSyncClient5"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\26.195.1006.0007\\i386\\FileSyncShell.dll"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\ = "NucleusToastActivator Class"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\msonedrivesyncserviceclient\URL Protocol	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Interface\{13987a48-a837-465d-b6be-8302db0e4ce6}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\Interface\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\Interface\{c1439245-96b4-47fc-b391-679386c5d40f}\ = "IFileUploader"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\TypeLib	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\ = "IGetSpaceUsedCallback"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Interface\{31508CC7-9BC7-494B-9D0F-7B1C7F144182}\ = "IContextMenuHandler"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\CLSID\{0827D883-485C-4D62-BA2C-A332DBF3D4B0}\LocalServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\Interface\{e40cef71-c060-48bf-832d-3adc3e5985a6}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Interface\{9D613F8A-B30E-4938-8490-CB5677701EBF}\TypeLib	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Interface\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}\TypeLib	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\ = "ErrorOverlayHandler2 Class"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\TypeLib\ = "{638805C3-4BA3-4AC8-8AAC-71A0BA2BC284}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\OneDrive.CameraRoll.Import\shell	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\ = "ShareHandler Class"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Directory\Background\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\TypeLib\ = "{638805C3-4BA3-4AC8-8AAC-71A0BA2BC284}"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\Interface\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\TypeLib\{082D3FEC-D0D0-4DF6-A988-053FECE7B884}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\BannerNotificationHandler.BannerNotificationHandler.1\CLSID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\Interface\{50487D09-FFA9-45E1-8DF5-D457F646CD83}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\Interface\{1b7aed4f-fcaf-4da4-8795-c03e635d8edc}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\Interface\{466F31F7-9892-477E-B189-FA5C59DE3603}\ = "ISyncEngineHoldFile"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_CLASSES\WOW6432NODE\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\PROGID	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_CLASSES\INTERFACE\{EA23A664-A558-4548-A8FE-A6B94D37C3CF}\TYPELIB	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\SyncEngineEnumeratorProvider.SyncEngineEnumeratorProvider.1\CLSID\ = "{3A308EFE-656D-46BB-9963-0A41C0D6BCA2}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\ = "StorageProviderUriSource Class"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Interface\{B5E5EE2E-E012-4FC8-BCE0-C956AF66C4F3}\ = "IKFMEventSourceFactory"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\VersionIndependentProgID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Interface\{B5E5EE2E-E012-4FC8-BCE0-C956AF66C4F3}\ProxyStubClsid32\ = "{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\TypeLib\{F904F88C-E60D-4327-9FA2-865AD075B400}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\26.195.1006.0007\\OneDrive.Sync.Service.dll\\2"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Interface\{d8c80ebb-099c-4208-afa3-fbc4d11f8a3c}\TypeLib	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\grvopen\shell	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\msonedrivesyncserviceclient\shell\open\command	OneDrive.Sync.Service.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_CLASSES\INTERFACE\{B5C25645-7426-433F-8A5F-42B7FF27A7B2}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_CLASSES\INTERFACE\{FAC14B75-7862-4CEB-BE41-F53945A61C17}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Interface\{50487D09-FFA9-45E1-8DF5-D457F646CD83}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Interface\{ACDB5DB0-C9D5-461C-BAAA-5DCE0B980E40}\ = "ILaunchUXInterface"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\WOW6432Node\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\TypeLib\{C9F3F6BB-3172-4CD8-9EB7-37C9BE601C87}\1.0\ = "FileSyncShell 1.0 Type Library"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\ = "FileSyncCustomStatesProvider Class"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Interface\{e40cef71-c060-48bf-832d-3adc3e5985a6}\ = " IFileCoAuthNotify"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\msonedrivesyncserviceclient\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\26.195.1006.0007\\OneDrive.Sync.Service.exe\" /protocol:\"%1\""	OneDrive.Sync.Service.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_CLASSES\WOW6432NODE\INTERFACE\{C1439245-96B4-47FC-B391-679386C5D40F}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_CLASSES\WOW6432NODE\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LOCALSERVER32	OneDriveSetup.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
4104	2026-11-07_4a72276a8041a53e07925b2fdd043354_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
4104	2026-11-07_4a72276a8041a53e07925b2fdd043354_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
4104	2026-11-07_4a72276a8041a53e07925b2fdd043354_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
4104	2026-11-07_4a72276a8041a53e07925b2fdd043354_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
3820	OneDriveSetup.exe
3820	OneDriveSetup.exe
3820	OneDriveSetup.exe
3820	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
2204	OneDriveSetup.exe
3460	OneDriveStandaloneUpdater.exe
3460	OneDriveStandaloneUpdater.exe
3380	OneDrive.Sync.Service.exe
3380	OneDrive.Sync.Service.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3820	OneDriveSetup.exe
Token: SeIncreaseQuotaPrivilege	2204	OneDriveSetup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 3820	4104	2026-11-07_4a72276a8041a53e07925b2fdd043354_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 2204 wrote to memory of 1248	2204	OneDriveSetup.exe	96
PID 3460 wrote to memory of 3380	3460	OneDriveStandaloneUpdater.exe	104

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	OneDrive.Sync.Service.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	OneDrive.Sync.Service.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-11-07_4a72276a8041a53e07925b2fdd043354_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_4a72276a8041a53e07925b2fdd043354_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update /updateSource:ODSU
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3820
- - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
    C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /updateSource:ODSU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix /RegisterOneDriveLauncherAutoStartTask /EnableOneDriveLauncherRampDownloads /EnableDeltaBuildToTelemetryFeatureSet /ArgPerformNucleusLocalAccessRepair /PerformEdgeNucleusRepair /PerformChromeNucleusRepair /NucleusLNARepairVersion:1 /AddOD4PhotosShortcu /DisableRedirectionForShortCuts
    3⤵
    - Adds Run key to start application
    - Checks system information in the registry
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Reads the TCP/IP host and domain name from the registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2204
  - - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\FileSyncConfig.exe
      "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\FileSyncConfig.exe"
      4⤵
      Drops desktop.ini file(s)
      Executes dropped EXE
      Loads dropped DLL
      PID:1248
  - - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\OneDrive.Sync.Service.exe
      /silentConfig
      4⤵
      Enumerates connected drives
      Checks system information in the registry
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      Modifies registry class
      System policy modification
      PID:5936

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\OneDrive.Sync.Service.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\OneDrive.Sync.Service.exe" /silentConfig
  2⤵
  - Enumerates connected drives
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - System policy modification
  PID:3380

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\OneDriveLauncher.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\OneDriveLauncher.exe
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:4520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Square44x44Logo.altform-unplated_targetsize-256.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\Assets\Square44x44Logo.altform-unplated_targetsize-256.png
Size 38KB
SHA256 f21d962c5327933d43c887e1d0531a116fb71cf0075126d9fd5eaa58447a055c
MD5 2e5aa4725dfa1dd1b830850a67e91de3
SHA1 f95890d18ba8f2553150b65d08df0d5a62685d48
SHA512 9b7aadc90730c839c1a33ef15f9e87f69f57d0fe68f8e618269517ad9fd43d81d4f661a7bc17f3fccb174b6a15aa1265633e98a666ad9321572c76c0661db6da
SSDEEP 768:1TybQFwVa0EWHLrrow7oZk0aQDTHYNbE52IFKRQHsaexuDDp+6WFt:V6Ha0tProw7Wk0acHdiQHmuDDp+t
TLSH
T1F603E1109E8ECB2B2B069EE295C24D120FD9B79D7CB6503D90D9CD669484AD03F327BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resources.resw

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\Copilot\Strings\HY-AM\Resources.resw
Size 221B
SHA256 1f762fa2d859cab49e93ca9ce8ef24edc4409ac75de77dc8781cb06ae4ee7f3f
MD5 19638dd07d7bb7e3429874af1375ecf9
SHA1 17843afc8c73bdf38c81e86f86c01323010690c5
SHA512 f2548e201d60cd175b5545607417716e3626f243f11ceb4e93770e07f291072a6e8a18f376e3d34d99eeb8fb135cd68d16fd37a3c3c1bf43d208be6f7da2e847
TLSH
T1EED0A710B9D4EC551476021B5C37504D99B0A7B41260B0193DE5DA473D51DD8A8E3284
MD5 SHA1 SHA512 TLSH

Submit Download

FileSyncConfig.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\FileSyncConfig.exe
Size 873KB
SHA256 29cce16473c478b9108bcc0193f6a3be6277299dbf54f70d8c20f853bfb3b7e6
MD5 024d0ce1d12e42ffda2e48aa386588dd
SHA1 e0bbf6ae48d9dd4e15e422d4f3f480ea5e07e73a
SHA512 a4c7cd3135a96cb8cc2eacd7b34938f97cc552436a075d71e9d4401095860200969da66571d5ac86ebab9e06c72282744faf2b4a4406871a5e5ba4430c45df92
SSDEEP 12288:eAvDPTJQdp48PcDix6jWILMcTfLvv83zjLToKi77UQ8hospRQ:ekTJQdp4qwa6jWMv83zjLTDifRspRQ
TLSH
T1B7154B2A62E802F9D0FAD2B8CDD74417F672B8164732D6DF02A1455D2F276E08E3BB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileSyncEvents.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\FileSyncEvents.dll
Size 138KB
SHA256 8e1473a616510f4bc82c7084f50c059c148b3e3a0c249ba10d1a0c18e4bbd92a
MD5 b92b9cb8322b9124bee060cf33b98c34
SHA1 d795d2c486e96eed05f29524b22ad94a681ef6e7
SHA512 63ffe8b809d1d70fcd2a4ba3d6c3a5afb5c1e019f8c060491327be5da7755254b1a24f3e98427bd9a9a1ecc1028dc64b2d7d9e1800fbdc65bcf570db8f73546b
SSDEEP 3072:++wodKvDeuYkfFHt65oclnCxIHKB9bF960:CDkEr6W9b5
TLSH
T1CBD3295B735800C9E41AE1BA8A97C907EB33B867072197CF23A9D71E4FB36E05DB5214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileSyncFS.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\FileSyncFS.dll
Size 1.1MB
SHA256 1899dccc4e6d0cde61fd5959d49b179f9e29f86d1219b5e6a25b96616618cc41
MD5 7f7210de0f9c7abe9383e0f061caf8d9
SHA1 98e2f6050cf93fc31644c42a2a3d73daa8f13425
SHA512 245e638628afa6c989470d53112b89ece517769965e5e6c4a2d2e5d8fe8b21fa86cf55153de4751cd38d28fe0cd3580da1ca4f5095fd09a571d0d93d34f175f6
SSDEEP 12288:/vaSBZoV6+hJQkBOived+VDjLxIXO4GyUK/B17tnuaiYiJjzkSSSubRx:3T/ehhJjHDjLcj/37tnuaifJj1DubX
TLSH
T1F3355C1AA6984169D4FDE1B98E6B8417E7B2B84B4332D7DB03E5A14E1F137D0893F720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileSyncHost.DLL

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\FileSyncHost.DLL
Size 534KB
SHA256 a1b4ce4dec10e05e7d502d2b622ff42f01cf3cd2dd44a57b9bdbfb253241fcbc
MD5 87fb7c7806a5385582da1afe0de4de86
SHA1 0a4b65447d5ee0275ca2114db3c41e91a3b3a108
SHA512 4cda57167becb4b66eed78b7442705e836393f0de61f7b9f0caed4b7e1bda8919d0d38e147377c9d417166492d9200d71eceaed7bca1204ad227e67e9802946d
SSDEEP 6144:/u6wEy7cVo+ZbY2iLFAPpb0yvBDKwA/8Xo8Y+oxjwAJK0y0FKc2e8tNybTQqDyDE:2DEy7tAhb0yvJK/qIE0QTDybsYcJZ1i7
TLSH
T11DC4392AA2A803A9D1EAD2B88E674507E773BC554722D6CF03E1D55D0F37BD0993B720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileSyncSessions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\FileSyncSessions.dll
Size 6.2MB
SHA256 fb780cf75e7d2c696ad572a639d8fb3de438a7222274450dd4d9f2f952240a86
MD5 e75b39aaaa3d263328feb882fc195dfc
SHA1 1a5d3fd824742e155f33c518dfa8b5ddd847138d
SHA512 bd04996ab3aab02c302fa539ef1ec3e8e79fd907cb1c929e7f6156b468fcb1e94e427d2cad5eb1fd1e7c63cd9032cf7dfa2fcb3fcd548bb2c7996a8a93933273
SSDEEP 98304:3/j6+i5nNo+iQEJ6ua76Am8yxHFETNCcTLN9:rKp6/aoHFETNCcTLN9
TLSH
T1E166A055729812A5C0FAD1FDCF1BC427E672789B433296D707A4EA270FA77A0873E610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileSyncSqlite3.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\FileSyncSqlite3.dll
Size 753KB
SHA256 80ee5d910dacba3695ee2c811d74d4034b50c22a3a395d41dd911cd926ff6c70
MD5 58be504733ac903e3e9aa922df22402b
SHA1 1616118c39face26a1b47a6e9c52c075dbbe7fa6
SHA512 ada05aa961d67bb815ff695b1dc611af1610dfdf09621742b29995476125aae974d012e6fea842c2b855981a493e2cb113dc87b7343f20fb84a1705607ad4fb2
SSDEEP 12288:l2kFjA2sekHmuW7mcfydvSaUWIZHM5OvjbjiYlSd4V6TSKm09HLYKIY2P:l2kFjA2seKmuqTfOvSiz5OLdllIOkLu
TLSH
T168F48D5AA7AD01B8E46B9279C9574617EBF2F405237087CB81908A5E7F13BF21B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileSyncTelemetryExtensions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\FileSyncTelemetryExtensions.dll
Size 1.0MB
SHA256 db3ec00165bdf3cb6eae4cdc9a4dc9bffb21a698ae8d936f2720c0c6bb576e36
MD5 64b2c873d1cb0166eabd3c35d9afa078
SHA1 2bc3fcbd0e43f7a3d66911fae6da76a06a3dac5f
SHA512 9b4940d898a68d7f0b59b968a779ab7ebb7f01b58d480223a81de56e750a12db82a2e862738c73429c96bb59670fdf67a95b2e80b567bccad0d7af4bf0a08b86
SSDEEP 12288:L/MKPlPVBj6rMamRGajJlF4ibzlj+xjpYYz46Sw:L/MYOMamRGa7WiB+xjW6x
TLSH
T1CE35842B99DBB7A4C5C88173E6745E8378EC60E873B86073D66440208E9D5F192FED63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogUploader.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogUploader.dll
Size 1.2MB
SHA256 8abae152afd68461077a612b5df2e3e345bde03db3f8ad8da21117a26996cc84
MD5 5e87ab3fc6d580878003a3277f33ea7e
SHA1 96fa7970ded74764a3ee2e19bb33e89f11ddad77
SHA512 65b6869780e48483f4df7b36d65d434f5dd5a9cbdcea947bc3c7799950bf1ad6f062bd130af2436d2c0ada1ef3ddc633f2999fc863c17ab61d9cf6057c026d57
SSDEEP 24576:r1hG84dDY11kclSMqizVr1NY3tkLtRy+MPc+id:hMMdsMqizVZN6tGRx6C
TLSH
T168456C1AA6A842B9D4FAD1B8CEA7441BE773B8054732DADF02914D5D0F377D08A3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LoggingPlatform.DLL

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LoggingPlatform.DLL
Size 712KB
SHA256 0ae011db047c403c90b45f48f469c59c3be929a40e04be71af807e0b0b2e0f28
MD5 a65f82fb8aaf86ca9f0411cf564a2f47
SHA1 267a03c7727f49335762f0b1047e9821a5e7b387
SHA512 42e90589141f5e63aaafe23f0f1bfeb8ac9971e3c6f9f2fed81b9933f3a41554333b41e0b1144ae3741a65cc7d023cdc2045c6ee76f4adee128a6812b6578522
SSDEEP 12288:PzedaYpWpndMaythnpFWtcsOREs9kdzvPK5yO59qxIlgC9cdG:PzoaYwndM8csOR1em5R9qxIlv9c8
TLSH
T1C1F45D2AA7A802A9D1FAD1B88D634427F7B3BC155332D6CB0391956D5F277D08A3F720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.contrast-black_scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveMedTile.contrast-black_scale-100.png
Size 965B
SHA256 3910d0976a41bc9802e6c1460c441f0ce5bf6520b47e2e7f1237eea0342553cf
MD5 d635128a586a11b8bc6643ca430da338
SHA1 dce9874bbc095f922fb117ca0eb4633c263d3876
SHA512 45732a40485708da65970119ad31289cb7a36bc43254370effc2c1c1bec27a8932aa378aaeee4bbc6e2ee45424abf3a5dc1c457588b99df863f6dff886df6ad5
TLSH
T1521188F5477DA71EF4DC86F7206930EC455F83E6067E460D4D5035205892A0C20A07D0
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-black_scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveMedTile.contrast-black_scale-125.png
Size 1KB
SHA256 7876f97812c78b2a6a6857b748cfcb083654b0df7a9968d28a337f553c9bb740
MD5 37d99de37e5e0a880b1e7e92af4f2414
SHA1 2f4383a6c27d03e37c27d55bf18c81f7e448df88
SHA512 435584c224d442eedd0a2d92bdcf11a8263950e04f50d4b6e5df16cb96ff44447de8cca56de09cca163355c63d5695de72c4508496c534be2309dd9cdde47090
TLSH
T17521C6EF7AEAA97FE02B303A5A5111E2411F8027C8003D096EB866B16A7936092667D0
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-black_scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveMedTile.contrast-black_scale-150.png
Size 1KB
SHA256 49bac30adc5e19520c9aef662bf6ab7f825d17de893f49f935f52bb58231d912
MD5 f0a8471454b9457e787c5107a669704e
SHA1 d6296385e16bf20cffa7abe0b626ef650474b869
SHA512 1e81ad245b17b9f0a51cbc882f61fe852ef86b11af67fab70c21d248f1c6fae83bcf52ed9d5ddf19979d6917aab99bf5111807c028c5baec6b9b1f29f6a8713a
TLSH
T18431D8129635897FCF8D8771957D8D0562C3AD3CE75432DD1AE01A250A3A974059E0F3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-black_scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveMedTile.contrast-black_scale-200.png
Size 1KB
SHA256 06c80abf5996c0f80d90db0335ec7d77e756fbbea33e97b399e58eda97be5f77
MD5 dd05cf58f3f493f7eb04faf889232e3f
SHA1 8e03035ab0fce9dd0f18b3c61b43e612e393292d
SHA512 e48727ac4185c289b572f729d0f86e51d5a56e504bc89a548f80337b417741e6c0a7cb1e3aa9ff0c784482b2dc034bd0eb4bbf08c8f5707c758f3ac70fa0bdb9
TLSH
T16241E9BC99CEC426D9A24EB2839C082274A63FC744A067941AD085820E48EB48FEC596
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-black_scale-400.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveMedTile.contrast-black_scale-400.png
Size 4KB
SHA256 0048c2fbe78c434315a40c489a6233de3eaac4877d3ab3b87f233de97ef45760
MD5 6cee6177303ddc4dc6ff243c4e066537
SHA1 c35e27cbef07f2c29e95e677e637adb2a70e4b7a
SHA512 0cada45d061bfa990265e3dbbabdb902cb2a3364564310bb611e6e4da2ab2b80910f8bdff21240c8fedd8e8acfcffa457d8aab19e443951d8a81c7dda8c19b00
SSDEEP 96:9SNbFu3l/nCJnfP8ut2UriYSdAzVGh7AX5sg6:9SxFu3pCFHnlrieVcx
TLSH
T17EA15CC7249DF17BD46BA133026C86E8B8F7399487AC36A5967132CD4B135E5CE4D102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.contrast-white_scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveMedTile.contrast-white_scale-100.png
Size 898B
SHA256 d66500db2be2a08e1fbe3c25bfb3f8f92af7c1222ae01d983ff01f28e161a173
MD5 9fd897bb6d2d83c0c2874f0bd977532a
SHA1 d45a0a45487a3875b2ec53d5949089269f5a42c5
SHA512 99a1dcc62612b7491b275158d98074a26ff5a04b685a76ce6d810fa3c184b940922b0012d6aacc271bb67e86670cc4ca51a2c2bcda41eb9871bb2b16f5904a11
TLSH
T1C4112FC4EE8514F9CA8A8EF754976B9112322B0DAB94661BB74869B855004CC090A2FC
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-white_scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveMedTile.contrast-white_scale-125.png
Size 1KB
SHA256 684f98e53e6508ade14997324ed729b2dbd54fc95ff0d0cf242a0af2ff87b296
MD5 8e64cb13b83fdc456f799a8d468cd4ff
SHA1 e781ed50c2247bd78f1f5c3aa1663b5e256d716d
SHA512 d4c4a7a174c8d18b4803312f6506e80d3ea23643af7cf6a28e3f374aa29668bd17b6694637a891c2c9b6353dc4378fecda80344edba4844140fbfa4a0ce4dfd8
TLSH
T1A62118E5AE5AA118D8578138C55FFCF190272807A85FFC302F8030E81600B497E36FE2
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-white_scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveMedTile.contrast-white_scale-150.png
Size 1KB
SHA256 f1758274ecb3b62b6324055d6ebfe894fb022af30d646c26ff75245ffe07e97a
MD5 fdd4e3bb210ea902687788de2582946e
SHA1 3f54d394be273f8f7d179cff1b7238a454c561db
SHA512 a3d564f0eb98ae266752148ff78bd8438f03f78002057baf1929349e833212ac82d73a99fa2d273ca3325e95d5a9be16f5c230373684782461074a3d76536d99
TLSH
T13A2187EF17D97C14C95B4FB9E67A7AB0891F2F0424114780481901E29E3D4414AD4AD5
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-white_scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveMedTile.contrast-white_scale-200.png
Size 1KB
SHA256 969e3c485b450ad929616ae0f64408afb25098a8e32993d92e84a6558d3ad8a3
MD5 d9a0baf2ad9f556e02055b5df310bad5
SHA1 89fd7ea535ddd01f332848e11db835be0acf31b2
SHA512 4493b500563af82b955694793a19d0e1821162f6ae6abb8fbaa4f455a41b122db753696ae357c2dae81ab0018d432b791724847946feae4a612dc647acbb3741
TLSH
T108312AC61DA939F8D918CB32C8310D58B8C22B12453357C01A2D1DDFD9B0E8C47D64E0
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-white_scale-400.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveMedTile.contrast-white_scale-400.png
Size 4KB
SHA256 2167f453dec79f0f053913908fb0eb74b54342f9f298dffeee339712bae851e4
MD5 387e0eaae22c86ef0f9086703675f546
SHA1 0b216d6f6c570fd2ee7e214af38671fb3e9dc7d6
SHA512 7620f497f4935317ef01cbc1e93f8396f7684f0a13d5fe08ef2f1c69450e8fe9fe9d26a0d0da2c42b685ad2293a84918a49a9e1af6c1438eea7d3d5f507ec863
SSDEEP 96:9Sj1yh70iOWgmvD5xDUQX02WIZHt9cR5CX:9Sjkh7bpvfgU0cHtU5A
TLSH
T152914C9D079CD179CE662235D98A06A92C3F3CBD268A9052950BB0B305A379167264DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveMedTile.scale-100.png
Size 5KB
SHA256 ee57225deb5b003c11d84f099a3cfe378ada230aaa89c6d7fc6334a21ce7dc06
MD5 ff1bcb9da494dc82c33d72d254e685f0
SHA1 a53c1067d1c62d5af3fa940bcc10db919ac0cbab
SHA512 891d8dabc1edc132a8e559e635a24f9b978462a43aa5b722b58a6b0fdc1ddf00b49de29c4dd00a42d7c0597a5c1765958844b80e013712da4dbc36414429b5b6
SSDEEP 96:5SZElqpLKR080FknPAC4G08hfQu2gib3HatOB1ihWscAgd/M2veRUufqI:5SZ580FknPRt9xQww6ABsEs1gdM5Uufr
TLSH
T1F3C16D48822CDA4C96CD583CD792523D9B66FC27CA20409D6B709C636D42D8EDE4DD7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveMedTile.scale-125.png
Size 8KB
SHA256 b3ce4ca2c3598012a7815108f0480bfb3b71b834995993a4160752a2577a3b6d
MD5 be9a752781ffaeff9d8bbeed90d45b91
SHA1 2c4e6f18b75d7dccd36a4e79003dfd75b79a2cff
SHA512 1c75d936032ce23acb4bdd8ed215c07bb7763585447443d45f760a59bd961032df9adac11b13b91140e953bea72304020cb3a65862b90fb1873dd03c63127a75
SSDEEP 192:9S3ifaS/VXPAXOS3SjNTZrqjQIbDBGSzx24piRvU3YkKvP94zbh+yc:83e/ReIroGCp2pvl4zl+yc
TLSH
T1B9029E14FBC10757C4FB767724C574B7A79BD80E6876AE2D7812E43ED089442090EBE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveMedTile.scale-150.png
Size 10KB
SHA256 a285df7d2be2aad1ff4053c3a95ff0016e23051c48bb17bad83c9fb59d8f41d0
MD5 2b84c5e76851a95e98b474aba8152fc9
SHA1 6b3017777397b7157c27b8a4e1f8328c73f8bc05
SHA512 e7e3594f2728d9960cdd020c69b0016a7adcc2fae76cae6ad27ff10d3708f8293c7a048af3b803fac7db25e32d81be4be36364b87c72611ba56842ee7eac509a
SSDEEP 192:iaOS5WquttsnUxgluNgERWuqnpJ8knWFeTWM6r6FpKD9faobQqaI4C:io5WqfUxgcgeyJDn7TeUuao0qF4C
TLSH
T15322A0D998FDFA21DF57A17020B2CF8BDB5386480AEE96E8DF14369CA811CC86444E49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveMedTile.scale-200.png
Size 14KB
SHA256 c655edecb76d1f95fc64c2742869e54d80f9102a0e0fb8f5824912b7a1f1d6af
MD5 908859e57528f8057da25c5b2154f065
SHA1 3d4c6cf6b05f267ea9aa43ba4a0c47464ca69d8e
SHA512 fc2671d553e28d95e34bcef7ba3eaefb8796402c322d540c05be049ab5b45d5a42e021146535172cfbbe7b90e9205a7a149aebcc5616e70313a9fe10b9de77f7
SSDEEP 384:bvfUYwHWjJy2c1DiaAeJyrliP23MIczfbTzofYR:rjNJlc1nyq2cdfbfoQR
TLSH
T18462BE80E2BDF934BCC75878E6A64F5B45034944CDC11B0AF964BF8EB289D9DA048AD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.scale-400.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveMedTile.scale-400.png
Size 48KB
SHA256 e472291a236bfad76c209b5785c329dbc094fbd70194c21cffd20fe32ab59a12
MD5 0969de469e60a500eb13864d1edfc318
SHA1 4d45041beca4202ad12bb660025d9b0883aba910
SHA512 631df4c5b7f9356c2f57330cb62f2605b74cb22d470792c6653ef933c7603d89ce525c03f63ac69309209b1fa565befd60873f01668afc095918733722c0f550
SSDEEP 1536:nLNY+lbWM/kXLLnecjWPSnK3q8dcUoqejbwJ0isZRN9/18:LNHlbWM/Kuz+4qUcUo1c0rZRbm
TLSH
T16A23F1E3547D873ACB60A9779ABDA0C77CB619971F71680D7A1238506B540B8FBC7023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSmallTile.contrast-black_scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png
Size 563B
SHA256 5b9b49b6af48eb7551c3dd2a62a6a49ae6740b2b49010bb5b006cf85b4e54f44
MD5 5b30085b5e50938bf98cb35640fb1c6f
SHA1 a6f4ddb0368b532341e5046a1bbe0a4007f3f393
SHA512 b75226fa58382975a52e556de1ed34e84a834d47a9048d1e6f4855702730a9ee78cf3d05b9e8f90ea18b81a57ab1763b15649d92da36626f5a803fa509f2412a
TLSH
T19CF096F002035D1CCF9FC2B71AFF53D7B25D52C400212C0C34923039982C0CAB10A550
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.contrast-black_scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png
Size 874B
SHA256 37a6ca2212efeb34d8905ea08c81bd6f4cf884e4d009c245927618dd61e50537
MD5 40060690ed4e89bfaa4cdf6b62bf10c1
SHA1 8a501642ae3ca2fca8b5a9fbeb09642faf64d920
SHA512 b1bcf0ad4c5db86479c6933fdc877df6291908677d1fff58c07d09b3afdc762f1ec42e34f5f3fffb2b42cdd79204a702d5abf97f9373b8a5f55c3f99283b621e
TLSH
T1D71186F39E6CF34DE96E68B7A486C095BBBD5B1761140105C8622E3D9051CCDCC42E6C
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.contrast-black_scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png
Size 962B
SHA256 c191a3138fdc51ccc4eaf8979f44fc4cff3ab96593e21371845cd7967971efbc
MD5 b5c1fe27b4496370dd116258600d79d3
SHA1 a0e4573c1e8dd3b9c711e2ef60ce8fb90c2c51b0
SHA512 4b649ca9557a66a1e2a859b7ef2eaca770004d5f2a030228c1579339dbaac7c23b23537c0dae04b2c7736c6a1f7bcb0b4ccaaa2e83ed2ad3c3e4bf2b73d6f446
TLSH
T1201184CDDB06B8D5C1059F7A50232DB2F1270F9D2F479AA37BC608005B6989996B1E24
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.contrast-black_scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png
Size 1KB
SHA256 ee2b6b8103ac0dd5ad593e6b5106df0e8e5f1459682cfc6349d803c5802c2dd7
MD5 94f7df106a5a9d491c28101f5b729e70
SHA1 0ae47dbafacff9b6fd0119cb30d5d32236894bef
SHA512 2922593a29f11675d4d3ee0d78ca3e5fea92b8a151090afef293f2139f39c8fffe0a585f83ccf7a5800ff5cfabcefe834e4ead37b511746c52a729544e59c170
TLSH
T16A211A9BBC583EB0C57EDFB60B99FC7103030AC4018868880D0BB4AA1272426AB43701
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.contrast-black_scale-400.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png
Size 2KB
SHA256 82d5e6a7643d34d618c7fd2cd38c63a360230a72211619c2ca8d70514b6eff6b
MD5 70bd5f9c5c78011d2a39d358911909e3
SHA1 ec4da9b9eac67be2483558114fb768b68f6b1a08
SHA512 015aeb96f0e8e09208d71e35fe2ff487ab5c583d0d9810012a3380b88eab1a549faa63b5a14cdc1397caa63a72edf3bdcad78b1db5594f3e293011d37b1ddfb8
TLSH
T122512CDC5D2321F6ECE188B8842EBD40BE5358F48E271401A4819832D579E51DF95C07
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveSmallTile.scale-100.png
Size 1KB
SHA256 1c1975f56416589fd0aa9add4c44a87c5dfd71ca365630e40e9f64bde6f0e49c
MD5 635c7e6f9c9a77202ca96e8c68899321
SHA1 0dbc327ae14c76fafe2d5fc860eec45a7414c974
SHA512 cc7a8175fce47f3db218a9279d244d7f1391d56fc2d7e3603a558baaa555ec7d84ce27dfc5e581952a7f76d65c2ac4c4bf2b1b28c8c41cf84db84e0e4ee691c5
TLSH
T14531089FC22D50E5730F6E8F8C7F8A411897E3740287B10AB5280A30283BD294837ADB
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveSmallTile.scale-125.png
Size 5KB
SHA256 46a6e452b5bf41b9ae867aec03f38bc5970b6c8a3128387b0b4c75cc203db9f9
MD5 3c81de4ef5b1d3aeffc440404858dcb9
SHA1 90486aeb79d47cae3d2c143b7436a6b1844d8f91
SHA512 001f9e29105e6730ca04d2ab198456a59cb3c47f83b3fc408c804789801d4760869331b63365c2357fc5e8540f79c18481c4e6696dcc4716d9fe50406eab686a
SSDEEP 96:bSB/bHKj+BNstFqpL3V8voyrt5N+q7SNvhvhqkpX+kes5YoXD9Oc/:bS5Kj+BN37Sr77SrpqO+kesvXhOc/
TLSH
T1F4B17DD230610ECA83CA9570B16B7421EFE62EC90152C1D18EB36311DF67695CFF5766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSmallTile.scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveSmallTile.scale-150.png
Size 6KB
SHA256 4e80205d7bff5c25be88be6f21ea5e32a2edbf115cdf4f26751f2a24a3d5c3d2
MD5 14ec3144f6e63b10d1a5f84268c5e634
SHA1 d0a2668cede02a7bb7e86ec081ee0730af01e98a
SHA512 2f21b1387d5d33a0b42a2a793c432d24a17b6d39db98f6362da45885d38ce6c9a6af224d99725c1754534e950d05c56b5944b720dfa8ecf067d166605b23df25
SSDEEP 192:tSSYIgYD/JzlAbIvvfIhEWuLuAM9dzOrowSKwe:srYDJibGfp/rok
TLSH
T1DBD1AE909D4838D87BA669928237676354C83CC635A34FD8D04CF3C51E9D299FE91E71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSmallTile.scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveSmallTile.scale-200.png
Size 9KB
SHA256 19d6b52f75aca670c722499bf04a6de7eb9eb6cccdc78f489a73d72417fcf478
MD5 1499cf8f813f3c22dd0764ef4a695367
SHA1 2ea9b463553c5d97a33832ee46b600f6d3640620
SHA512 0fc4d5f1b21b608205f082a19aabf816cf503df1b8650fcc83a3d0d208b4651bf999afb0927b4d3a248e501aa656495108c646bdc073839d88ea1554e70d3c88
SSDEEP 192:OSJRFyoZ4ZzqBpnJa42GYFmk4iQ14eFFKOl082BYpKTK4odOHrEN06WPBS:xL31JKGOpnhebpl05BY4TVoW4WPk
TLSH
T1F122AD4653BB7182A092A4EF351385A504F10EDDCD8945B3DC8478E39D8E2CB25BA78A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSmallTile.scale-400.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\OneDriveSmallTile.scale-400.png
Size 22KB
SHA256 ce53878af8d98b9e2e94374841d4be37c6942e6bccde660d05b86d051ef5f078
MD5 8fe69f9883b3959993c5069c8612ee57
SHA1 9bb5a5d31cb99039e8671735ef6130dff7be9f02
SHA512 e6348fc499af5a5aad8cfb2e1c0aed8644afbd91a19ac671819f4e8f060d33fef0153eb19ce773c979e15718c8a3e857922163ada71324496fdcd88558548d85
SSDEEP 384:w07l8gzGyVUmGiQKyz0uPLXt5mQUl2gEIusi10jTnanX3Ucym1pHs:NewG4BQKI0yqZ2IuHMsTU
TLSH
T1B9A2D0A969E4D89F1D05721F0737997EE13764C860317809EDD8D7D91632A2BDE10BC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PhotosSquare150x150Logo.scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\PhotosSquare150x150Logo.scale-100.png
Size 21KB
SHA256 7b31060527478a8e3ee7910d83fdda8ca59ab4376fe068fd8b0009489551debe
MD5 9b093b69ad431049b6f75c61bc2cb47e
SHA1 ec476e7d39bbc5e12bcdf5cf4033fd2ea1210570
SHA512 2e9770ae2800b855855d36073a45cc37ec8dfe5822de3d131aadec41edd3e8449e5a7c96e53105ae116fcdd5234394cc039ed4151bd843bb4098f7d62861e09e
SSDEEP 384:3eqAVfTs4W1mMejENSftmljruxRV2BDBewtwUyWGXOvhsF9WCRQo4QSyDFCKEfgi:3evs4WgqEF4PuxRQtEw6UOO5s3J2oPF8
TLSH
T1E0A2D04096135DBED428767AB9077EF2952687603DB27FEE9435B2C285D0B8E8173806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PhotosSquare150x150Logo.scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\PhotosSquare150x150Logo.scale-125.png
Size 33KB
SHA256 6bff72c20aa952b48b297f0086e87f79879ef065923954ae034e82685f013982
MD5 b0968e1a37138d0ac00f815089738093
SHA1 8d234f182695e6da33e09b86c20fe01562a7bd7f
SHA512 b0fbdff94ce3e31e3e6135613b0f0641d9aa6fb5c42f60f3128150e6232fddd6986700f6a82ff88067ce63defb2498c67291f808370132ce01765a0dc3bd4771
SSDEEP 768:6/uz+lpnxBbSP0lH3vY2FSoInuMFZd0Qwe55MXQXt:zzQpxBGwH/VFSLnuMvd0Qwe55MXct
TLSH
T125E2F142E7B13160607DEAF80E40EDF8A1785A73AA616653F771408E5EC9B91B0F0BB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PhotosSquare150x150Logo.scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\PhotosSquare150x150Logo.scale-150.png
Size 46KB
SHA256 997e35af34bbb97f0a55cd8f9d0f8a1a11016f9f145e54b4b4c5b98201620f93
MD5 38f7db353cc68a436784fa0e8adacd3a
SHA1 0a6c70874ec65b425beb97e054ce355f3b654fd7
SHA512 515ca46114c4c4dc855ea87127a0e92aa1ded19c7c82293fd53348225787cb1c5156adfb5257cc0a01fb11950d587041122e7b0dda09c6072b622724502e8446
SSDEEP 768:mfdB1q4mlTY0mhiwuWqsrJy2uJXM3cxJ5hNdixma/p1BKcCJLrhQGVfdf68:mlG4mlSPuuJy2udQqta/pKVjV1C8
TLSH
T11823029FF0D4B4BF06466B3DA521A4AE2407DC2D0268C5F8BBF5A33D5BE83B5A044D50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PhotosSquare150x150Logo.scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\PhotosSquare150x150Logo.scale-200.png
Size 73KB
SHA256 303d1b92d5e84db12c62c59bafdaeb511817f9a96052e0ab4440749ca31e5107
MD5 6087a47f5fe97fcb701e9a10f36f37c8
SHA1 85c7b5c10d394664794b3e3301cc678163d92c4a
SHA512 0777a1be01c914e14ca498ddca78f08638612d57d8a0be6f32a623f3538b88f490a5393a79e2775220fc23b5772f5c1e1a5ec223d854605d924bb5ef71b7e79e
SSDEEP 1536:uiDRN10qtk5i+sBjW4iVt39yL27bazCgk2Nfx12q6ag6pIn52BW9wYSF2:uivk8+Oj0Vt39yL+WzCqxkqrguIHSY
TLSH
T1CB7302302602A897147625ED2A5D3E8EAB0DD1223035E0EB1835F5E9F03D7344FDB396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PhotosSquare44x44Logo.altform-lightunplated_targetsize-16.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\PhotosSquare44x44Logo.altform-lightunplated_targetsize-16.png
Size 768B
SHA256 4fe026cd0890165668f2c0597992dd0b79e996496bc125a7beb4c4680d0d3227
MD5 f6590c79cb6bcf344d4a070f9296bf39
SHA1 e34651210440834f9c904b3444b6588e3e23549b
SHA512 ff62528fda15203ae4a73e4e9dc3d3a03c06897e4f028aa882a0bb39a3be6c9323564a27e9cf174a64fbe7e68a362bd79446ad7a759550944919be0215518404
TLSH
T15D01C547ADB3A100C016583C03C22810AD3061E939DE21CEAF0FF4C42C0827400BCD11
MD5 SHA1 SHA512 TLSH

Submit Download

PhotosSquare44x44Logo.altform-lightunplated_targetsize-24.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\PhotosSquare44x44Logo.altform-lightunplated_targetsize-24.png
Size 1KB
SHA256 33ee6f7430e34325f95f9b24679d602c31821587b1310b43e47aa1d6a4334f30
MD5 02a871b84bdff02f079102c4c24a87a8
SHA1 aa622fb6bb1d42a5a1b6089de853e2a175713184
SHA512 7ccc8ede9bce4a9f8f3537cb3f2bb78cacfdb00d99f7e3bc418e2838c501803e7ff248975de29c4d58956c09a421a7987726b55797db8fc2061b31ceb7f98c4b
TLSH
T15B31E9D3BB80482D035EA2B9516259F8A22433FFB0397A843E566D798424CA0658C2EF
MD5 SHA1 SHA512 TLSH

Submit Download

PhotosSquare44x44Logo.altform-lightunplated_targetsize-32.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\PhotosSquare44x44Logo.altform-lightunplated_targetsize-32.png
Size 1KB
SHA256 9b047e84ca4555b15c9676a39279877367ef130fb2a91e4d255f7624392e3273
MD5 2bd2ac8d930e5aa88cd8742344c33fd8
SHA1 5ef60efb32886ef6f5b08c615cb5e9e5168732bc
SHA512 d5aef1e7e16d07ef9999e3ae90d17863ccfa7b9e68cdeae10f3018c55861b7524cf4bd8d7622203b705b2824934f5856144245c4a086e048cc9a692693118ccb
TLSH
T10941F8D2E3CDAA74505EC0B1E762245B51287EB1AEB06088B732D1263D7D2E17660722
MD5 SHA1 SHA512 TLSH

Submit Download

PhotosSquare44x44Logo.altform-lightunplated_targetsize-48.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\PhotosSquare44x44Logo.altform-lightunplated_targetsize-48.png
Size 3KB
SHA256 3f8517132701d52a31520148564d5150ff77ac83943d0ff5a746599f01d5e0b1
MD5 17d124cd703886af6bf0fb9e14f61617
SHA1 aad99008c094d88b9804205b0a8206de99cc0aa0
SHA512 fb94e685f84c026f31e84f6864c4cffc2f7f9057b2458e010c65bd940bd123fd780f96fd7c54fc0804485bfc3063a041c6d78543f61ec31552f5e3ce3bfaa5cb
TLSH
T118818DE2AE95E318D391BD1562D320B75B3C18D2AFDA868ECFD71B8D337089C0D05619
MD5 SHA1 SHA512 TLSH

Submit Download

PhotosSquare44x44Logo.scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\PhotosSquare44x44Logo.scale-100.png
Size 2KB
SHA256 6b137a3b7ea0be5358c0428acf8081d3cfe613b72951d21e42c9e404a6cfd66e
MD5 e33e1eb44e3b8918b44cb8c0014b930a
SHA1 a21f82a9c9bee2e46da9ff7420fbcd4b8d02bb54
SHA512 1383486ce6d10577efae908d74f2ba23d767614ebfbca362d7187d3aa93520143e723656d351a9ff278d7990c8afb6bfb604fd96cead1ac413b96daf38ad8ddb
TLSH
T131516C561EFA3ACDB3EC19BB68F73665A3B59F6A8050D3C517801154B008F82F010DB0
MD5 SHA1 SHA512 TLSH

Submit Download

PhotosSquare44x44Logo.scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\PhotosSquare44x44Logo.scale-125.png
Size 4KB
SHA256 34ebc8f9b3b1477dc09aa418e98cc9c6edaee0002fa1603af4db3b3f58f75776
MD5 c8c9c52412edc1d5c42f5cb29c5b3c38
SHA1 ced4b78dfe5827f7f334bd7c65071d26b1356a3c
SHA512 be2436f272bf1dae75ed50dfa98153b141680cc409f108d50b7cecdf5e8816c63450f249d295028ae94e6eef49827eb74063c8579392259ad6feaeb1f26308a9
SSDEEP 96:+l0ZULvnYch90Co08aWp7/BAB8TiwhT2iZ16jhz:4UQ+C98XqWTzRP0jhz
TLSH
T197816FD0F4D07AD3932EC7CF4D84AA01A6A8D3676DA18AD9F80E4375516CCDD0999020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PhotosSquare44x44Logo.scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\PhotosSquare44x44Logo.scale-150.png
Size 5KB
SHA256 ed32c01317c12d117d84c9394f22e4036ad65b38d62127f075a6b25d1d5adc25
MD5 5da55d446dd60be2efdc067f606c1ead
SHA1 640745e3c64be27dbc33a8ebe923b81b1f64434f
SHA512 fb57c43a7d5e882aeb8f5615e0890a62556c9bd29ed19b1f7a7dc10115075f0a7125d3d9d8bbcdec9a20c4746cfedf52fe4f4373cc99048c2f623bfddd7a4a9a
SSDEEP 96:f7ml2Fakphsm8JZWH+WQT7k/YUSLKBOowXDQdzujtiRvhYnjoprPHR+PN1gSH7zR:fRawhszJMHsUhMVXDQdzujUasrPHR+PF
TLSH
T11CB18FC9331E54FE5C5BB1EF8EE306E2467171E1821D5DF6A6027D785E52811B90D094
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PhotosSquare44x44Logo.scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\PhotosSquare44x44Logo.scale-200.png
Size 8KB
SHA256 c6c927733060f9a181d4c725d70dfd422c48e6137ee07e58e87dbc56542dfaea
MD5 63aee050bfc9283b110223951ae1f7c9
SHA1 939f20bdae68de9e868025b0e7db297b3c649d0c
SHA512 eda6d9fc7ecaae0712615122297c9b9dca5931805c5daad3d61c12fe6f09664c3b35b2cc4551fadd76e1ae36153c412b1cd427bf2d44b4200bf18e59093e947b
SSDEEP 192:oxb/m2xY5CvRs7ipuI/quKSmJuj7TYUiQh:oN/LYEpsU/sUDNh
TLSH
T17C029FF87754E7975AC449E6720E63A0ED6A4BEA400B27CAEF94339A53875B00945311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PhotosSquare44x44Logo.scale-400.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\PhotosSquare44x44Logo.scale-400.png
Size 29KB
SHA256 a10d09f50fe80ba4ae6f9e8bce85b960d1c6b657a74c7dba8d767c70838bdd95
MD5 f5290484a9642b7c7783a324700000aa
SHA1 1d1983e84fb4e7add1fdd9410310f149e6f51506
SHA512 e3040045b39dedefbdc0735843979065a1aaae7d548b82adbcaf6e5ea38433f3319a6fc6542f7b81b1d036116d2a6687e24a185721117f1260f944d6b11d645c
SSDEEP 768:O1ik9L7gzQUWB/L3LnCkdwqYBrhQ1OZcH5wTOSzVsDMZ48:Ock9OerLCkdKBQ/wTJzI8
TLSH
T140D2F1C73ABDC0D03E4F623194D014045720726F6FEA318679BE8D272AA7305BE6AC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PhotosStoreLogo.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\PhotosStoreLogo.png
Size 58KB
SHA256 73f63a98f6721664516f8dd8043e8cb31a1345335f124ddfefaaa9fb83b2980a
MD5 9ac786330ea209f7d02415385a66a515
SHA1 09d8199787e04915e70baa2a1ef033b7b1d7b6f1
SHA512 5cfc0367fd7cc7f27fe249b3472aa309de0ba4fd2adedc631691c618c9f6ed3acb49652c0f51e21cd4793cb06c96672f8a4e939e8cecad2e881f66ee1b11386e
SSDEEP 1536:NC6QgPrENrCeg+cco6fQY9COxLssI0kl2Hgk9:NVIrng+PoQQ5iYsIAHgy
TLSH
T1DA4302F4F3DAE2647223BE6E1B43A3518A76218748914A754A360478CF47E770797F88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resources.pri

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\LogoImages\Resources.pri
Size 18.1MB
SHA256 e666f311a75efea5ed9a8ecfd59f43c30ce3acaeb976dc2679b0c5f53ada2967
MD5 e8380c63d231010a3ceb1a2e62d03140
SHA1 2ebb54f5b25f7228acea194fb07a0ea3284717cc
SHA512 b6cb09f9e602de9dbf8f4e0408f3ab72545f0a2f0e35c8206268ff58301e48cee203d82e74581ababcaba747864e3926c447ac7552b16a3e464533a31956fce9
SSDEEP 49152:45Ha9zdQxa21dr0LOCd74LBd/HEw4EHrEe+fr6ykfrZpTXj2qOkIqcQ:wwsjx
TLSH
T11A175301E3FB0248F2F36B717EBA496598B7BE525930C07E42049A4E1B72B855BE5373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.SharePoint.Calc.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\Microsoft.SharePoint.Calc.dll
Size 913KB
SHA256 42d865afcc100d51ebedfdf3a3fe1d2833e91d6ae636319dc78c01d2bd363fbd
MD5 96501c4d61f4684f3f1335591002f6db
SHA1 79d39ca6b844e503e28e21fbfa12865f0729331b
SHA512 d2b6f84bb777537d51598e520b8f9c420355f7627ec557e32013b7ce4315b7216276de0a30c697e58b826d51266ca36e7c7f0833f624f7e44e55243fa8cccca3
SSDEEP 12288:08WCtV5SsZ1cVbjOURbvJ4J+uDvRGeo+BlSglLKhJkHgZBe0I7mq1P:YUrSsrKbjOUwzR1tlSgEJkHgZC3
TLSH
T1E215AF0EA2AA49EEDC26D13C8557850BFBB17411971087CF06A4BA9B7F2B3F01D39719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ODResult.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\ODResult.dll
Size 49KB
SHA256 82d9db1f099522c4fd727ae092b4af2b946585c29bafd90b12b7e3a4c3373434
MD5 3e5099c48f21c3d19fd7f7bf4368555e
SHA1 15b2a49e0d382cf6a92b4c2915c423c41637fe79
SHA512 ba0f4c6af4067f9a3daf47ed8d7c72d89672fec7d917b6fb1e904ba251e11d9b6a24338397d97bad979f16fc1ac1f908727b1ddc4e51a55f325663c18fbbafbf
SSDEEP 768:CRvfmdF71+Z6HtvIr2f8szHrjUunB80caOJu5MbH0brjZ9zD:Cdfm7R7GKzzHrpWvaOJu5MgHzD
TLSH
T12033096ACD26501BD70DDCB4CA478C06EE32BCC78BD1A5D76B405CD60D66BD4AB3E202
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDrive.App.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\OneDrive.App.exe
Size 1.0MB
SHA256 758aa40227b4868b179758b3cd52bc9d1922455a5d822acbdfd976c718a3309c
MD5 a16ea5ae35be94837c5fbc2e5a59e7c8
SHA1 cc5810165d29d6000be0d8da3b56d5854ce8b6f3
SHA512 ba3592f815143106f2f0030e4eb933621c67825b6ed2d6d2e4f057f5485dd797c3b68f311cb7d7c3e7d1fa550e11ee851fed71a0f73e931575929fa8794f23fa
SSDEEP 24576:MGQpLUbZE833/ldcktTo9QE4lU+yigokHog55T2:ipLUbZEwljtToQED+WvHF2
TLSH
T196358D59B6AC41F9D0B6E178CDA24413E6B2BC165731D2CF03A1669D3F376E08E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDrive.Sync.Service.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\OneDrive.Sync.Service.dll
Size 49.6MB
SHA256 a9d5401a29206a1977314be9831494e82c95b03e31ce9e63b34dc1d33ea9f744
MD5 cd29a57413aabf7943afb9f11350c0c7
SHA1 56843eb766003df2d1a8f2150f0297c18b5013c9
SHA512 b9be7cd60cb846264962aa4546acf009730c8eeff1c0f57f5be2fa3a80221ee3ba05c2d22f6d0d21e77dd0bdc50254726c37f4e60cfeb61edbc8efd9ecb4e8ac
SSDEEP 393216:ICUuIV770ANSpItDpJvBqTKfslkTCxn5ocVn:ICUuIVjQp4DpJvBq0slkTCxbVn
TLSH
T170B74B0BB20D41C5C09AF1B8695BD923FB32B84A43A1A39316DBD3271FDB948667F750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDrive.Sync.Service.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\OneDrive.Sync.Service.exe
Size 947KB
SHA256 c05be3ba2336b372f30d2f47f4b4c311780a02ef6b462e41766c2274919c5604
MD5 4286e58b359390417cc0e0bebe650f20
SHA1 691a2ea862337823f8f84af2b9547b723a460261
SHA512 c393c291bffbe5e23adb84643bf89b73976fc7ea10238bb2c0c3ccb9fa51d18c2d0bc3ee990eae5f94cce9c73d51e8b683385ab7124251b80d92c571aa157487
SSDEEP 12288:Yz/KhOoQ5E/HxoTHgEaQtmOmsDM9WXCyjM7CLYig358goJ8:Yz/LK/HxobgEaQtmONMIXClmLzE8gom
TLSH
T1E1257D5DA6AC42F9D0B6D178C9924507EBB2BC165731C7CF03A1169E3F276E08E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDrive.VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\OneDrive.VisualElementsManifest.xml
Size 344B
SHA256 d21077ad0c29a4c939b8c25f1186e2b542d054bb787b1d3210e9cab48ec3080c
MD5 5ae2d05d894d1a55d9a1e4f593c68969
SHA1 a983584f58d68552e639601538af960a34fa1da7
SHA512 152949f5b661980f33608a0804dd8c43d70e056ae0336e409006e764664496fef6e60daa09fecb8d74523d3e7928c0dbd5d8272d8be1cf276852d88370954adc
TLSH
T13EE02688B16841C263D369B5643399CD329D329FC3C905C296A145B62154CCC4D8B18E
MD5 SHA1 SHA512 TLSH

Submit Download

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\OneDrive.exe
Size 4.5MB
SHA256 6cc330604c30ed94b74e71ffd27d55d1bcf750aa9845cd641be5f19f9148c031
MD5 67e33a15be1e7f9c8bd9c92c1c17f1d4
SHA1 3985d9014a4783a4e93b918aec8f55cbf2c81756
SHA512 b371766d28851ccc76153645006841ddd73e9c4d28c3ae7b8c1a64f3f182c16090dc85c9aab907b4796f3082aca0e89a428dc5c1bd29c083b37d526fe3de859b
SSDEEP 98304:MezZhpwBP/OlsLzFmNfW6FJKxxfZA4AnyxpELRSKE+R3:FZGpELcoR3
TLSH
T11A268DD6BE88F5E4C0A48834B906D57DD673BC7A4B12468732D7FB1F2A37180452B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveLauncher.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\OneDriveLauncher.exe
Size 857KB
SHA256 36b86543b9f4a90f647cc6979faab3e2ff9446deb30b321cda1a92999edb8e94
MD5 a7af0d8bad70af014442c77bf7212e21
SHA1 e1ca31bb02740edd12612ad0826ba6fc2208aa65
SHA512 163f13aa8cfcd785c699eddd9bbaadc8253b84713f6411f307feffe38d2f793d04e58e241cc7c197912f8eb77250f84342ec975b74ca5652ffb477ec51685f2e
SSDEEP 12288:9qiFaVXkrVcTA5nhdG8umArB7DpF4gH4F/zQklWG3:YiFoXy5nbbumAnFJ4F/zQ2W0
TLSH
T16E153C2AA7E842F5D1F6D2B8CD934417E673B8154B32D5CF02A1816D6F376E08D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\OneDriveStandaloneUpdater.exe
Size 4.3MB
SHA256 48291f22396486284638af384aa4447d719c9c07134d4702d8099ab38a692c42
MD5 c84a4c754875e0828d3a223299703a8d
SHA1 e33d6956b6e2c790d06687ca5bdeb829f171322b
SHA512 332ba4f6add59e180644e7bf37f8e57e754a772789c73b4ca987d9357c6e64346e971470dab847aab24a8b799211f5602e8d722810605d37c6cd0ae6e48c23bb
SSDEEP 49152:3+KSERpxR5dapHICpMXAOgTtYVIYwjaZZs6DdWEBRc/PtlpMTmY8LE+vQs:nFIlX5
TLSH
T1C3265A0BA7F901F4D0BBD2798AA78517FA727819873197DF0291465A1F23BE09E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveTelemetryStable.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\OneDriveTelemetryStable.dll
Size 2.4MB
SHA256 7ddabd601cb763889545e804e5541304b0826e523c6095f717ca39c382fc69ff
MD5 f4d55fd9e53cd9eceba82fb35bc72f20
SHA1 e5f2c661b0a22233f60cea16bf9aefde6f0f4a67
SHA512 fd1e499aec8c1775dc93b062f0f21eaf911cf0a4602527142e01ee59e175b1040be26f1484bb2b5c630b80e15308bb26bc312f823163c93713ff5d1c74dd3c25
SSDEEP 49152:eVdKgZud+Lgz/mJSXEWvvQpX6dv8c1mNJzjTqow1Mp:kI0WKfvw1M
TLSH
T134B5495BE6B541E4C5BBD13C8A57A617FAB2B85A433097DB4790464B0F23BF09A3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telemetry.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\Telemetry.dll
Size 1.1MB
SHA256 5f615dc207fdb6b406a9e2035cfcfbe60e5037625608615b8626d3046e3e850e
MD5 794e74d3fb7396dd4b638b2ff8ea5139
SHA1 13eb34d5bb04a6df480c45e8a7992115b8ba69c1
SHA512 617f82c8d9b3b13bc23c3c88c5636d75bc0584efc5da9af890bd99dbbadecbc59fabb22132dd7fc4639f3e36eb37b1ece611842ee76a37733995fcd18a8a6c66
SSDEEP 12288:DvOj+QsEkGDiH9oTL+ufdOLPnAGXgF7oTx/BrSwczaaZZND9Xcj:6j+lEkXdoTWLPAKgFoTx/JzkrNJXO
TLSH
T1BA355B0563E47FB5E19BE0B9F6724503E5F2F4385322A2FF45DA59240E27AC04A35BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateRingSettings.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\UpdateRingSettings.dll
Size 777KB
SHA256 ad2e3c0d24cbe12fac1764a74f89925e9293fcf2a57b85671865e1c746a5c91c
MD5 0b0ce36c3157d50ced4d05cb6c1e169a
SHA1 808e238c3d7ca4bd1e53e721d3ffd62deaf7ab13
SHA512 8e726088f03facdfa879ad69aed757aa180ea08e8801d26335ca09d5862815284d097787d8564a06934d068273562b663ac6466e93dbe2351f1fc5cbcb405575
SSDEEP 12288:322iFkbkFrxs7r5qSKE9blCisjz9O4oi3mQbA4N137hfQuDYKi:3J+kbkFrC38SK6UO4oi3mQbA4N1rayYF
TLSH
T1EA054B1EA6FC02A9E0B7D1B88EE34517E672BC155732DACF0291855E0F277E0893B721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nso-ZA.json

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\WebAssets\static\strings\nso-ZA.json
Size 73KB
SHA256 9e7d9b97fef9c7e514ec9ee798a8ece7dc6dfe6ebf5bed2bf4a9a59cd9fe3c92
MD5 e7e4465e4074e3b433fbe0a8ea953203
SHA1 e6c4d9d5f52ac03b3225ea13ef85dfe7a674d1fa
SHA512 d649180d53c20435f21ffdb010e0f105fc26463446367a1fe1033852bccd38ea9fded8e41854cdb3d7bd3de1cf93ff02182f02844825b6f612072446e3f28e42
SSDEEP 768:g+QANv67/Y6BWnmZrphsjp5ObqnDVy9q8nEpFVDur2KEfT7zxoO:gMz6BWnmZrDsVtnDy2fOO
TLSH
T1F373A52F8600097700D5A543BD5269A235114F2F6390345D2FEB721E339EEAB72F766E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exif.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\exif.dll
Size 255KB
SHA256 89c20cbf2d0f129f25e36c4232ba1b9a12ad3b3763d32015e817f9254c54de3b
MD5 4e718344b6e50229cbc678f7f507fbb3
SHA1 bfa034e2db7c75f18bc274701c28516659779f35
SHA512 d514c787335806b55e52a5c2ba3d966246c0b7da587a3fba726c27c4566b09524b7706b6a2f1f55d46f5f133fd211b57c1a3697019b1f3306598c0ec07372a5c
SSDEEP 3072:PYexp8QhUhUpmU/4D7bJCOPvLCKkoOrzmVxSEP:PYKp8QmhSmU/4dCOHLCfmVj
TLSH
T15F441847B7801D73D94245388A9B4302A3B0F966C3B2D3DB569841B8AF077E69F772C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\msvcp140.dll
Size 530KB
SHA256 6e643e45ac1fdf592d1218e08fdc9a4347d537c1a9e4e518fc57affa0dd46d03
MD5 3d99b428dc0ca82459d6f4a27bb694b3
SHA1 7f84b800e66315fa734c4f0fc0a7aa9d362105cc
SHA512 48697db33b6122cd0814ebfd29f870044e4497adf316397c8c16e17edeb67aa7bf4c38c8a23b1dbb4d1cbf8d6c686b371cd6ab47ecb18c06d4d3219a7819c263
SSDEEP 12288:S0MrE03u1mHWV/I3HVbQEKZm+jWodEEV7N:S0p1F/IpQEKZm+jWodEENN
TLSH
T186C41A23F75906A0E195E3B8A1838302D7F1BC598323E3C752EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_atomic_wait.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\msvcp140_atomic_wait.dll
Size 37KB
SHA256 82bac06a166552813b0997ea115dd0f9fac99d5a250b1c6ae16469e35a5661c8
MD5 f309672e6e55046d26ed99a1ef2b98a1
SHA1 d350869ee401228cc7375ef3c095bec5b294c972
SHA512 f843eeaade10646fcb28d87d4146d176b7b2523d394f7951e61145d033ff02cda0d9dcb46599df49bbced33bd3e2118480e34dd56284ef38bf65bc0331639041
SSDEEP 768:YPMo5RIqKYwIYPhpLSQl4wFhGbHQDr9zd7:ZOR+lPhQQl4wTGsDBzN
TLSH
T160039D45A76C1082F5AB8734C5A6A60BE6B6B7F10720CBDF0361E64D0F93BD1BA35709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

localizable.json

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\nso-ZA\localizable.json
Size 4B
SHA256 e3566b3a06430868d71e9287dfd6c6c520a3da027aabea01951d407ee131dc2f
MD5 c443b04d0fc26b0a5a4573a78e0082a1
SHA1 3c957535345645dce7190b85eb10b39da96b2518
SHA512 7bbf6dac485c9e59d02edabc91ff5b15bc1319cef6905c0077ee16e3b1f572b61bff85f2400bc0f5b4aeab0260bd5d68787d72c7a688d79192952f7957a44de3
MD5 SHA1 SHA512

Submit Download

od4-localizable.json

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\nso-ZA\od4-localizable.json
Size 179KB
SHA256 ad8093883c02f6cc218bef464ae500cc44490212511884336964c8d67fca7365
MD5 ee62f84aacdfd1c172e3b948f16ab356
SHA1 14683dde72e5fae1cd63d5e37b9b3fc05a6fc45a
SHA512 9914a5ba0031a7eef00d163e157bfbf52472fbd00ca2fa564231e192e8d3cc38289a7ccac858b339e072a7819fab5986cac1ab62d4f678017cc6ddb2b3c39756
SSDEEP 1536:fmsUN+1P0I4NkZ8mDo8EL/BX000pvjWLXVZJ9kxlu3v:+F6Z8mHEL/BXsYYE
TLSH
T12D04917BA1808B7304316253BD4D19E277120B5F42B28D9F34BF614D9286E6BB3A77E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\vcruntime140.dll
Size 110KB
SHA256 c8ad76f8e8fb1dac0027f0dff7a0cb48327e19cc58b1c27433fd0faa77570700
MD5 e08d306018ca020705999b3d45c8164d
SHA1 50f8d27e8f1e1ede4b5acf7094a8c1f9db383591
SHA512 a1437e59ba2a01a3ef61fe8220d925da3eee68d4e3d4def3854c0975cdb0715f731e8a6d2b9578f5d24bcd3ef8fc94513d9010623d74309da69697380d97e37e
SSDEEP 1536:V9pCUgtBAVcxStMXcfG8VwfmpcGLOI5EvMvecbeQ6N7vNdzr:5yA+3EOfmpcGSL8ecbeQ6NTNd/
TLSH
T145B35A0272B802FBD16FD278C1929E67E7B6B40587609BDF07AA46660F63BE05D3D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.195.1006.0007\vcruntime140_1.dll
Size 36KB
SHA256 eda3bc9315d5a5cae45d83d817db5b62f719987f93b297de6e0454bdc48e2c6a
MD5 a33711cb4403b0e18a27877fa9e50154
SHA1 a0da9b05901bb90452134973567a398168923244
SHA512 3c436ffa7846fd2a43e7e3645f720fc2ac10467d549fcddc350217c03a765239671c23e4ff51135d0b707234b6b08c3c0607348ded93525abbb438e31a534cba
SSDEEP 768:DezSkbhNfI4fWLZySXdPWD/0bHyc0rjZ9z0:4YZyqPWD/0G9z0
TLSH
T157F27C42A3B85096E8AB8670C4975F17FE39F69157A093CB1FE4960C1E537D0A33D326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Media.db

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Business1\settings\Microsoft.Media.db
Size 300KB
SHA256 b9e79083539e98ad306c08f94420e160d98058f75cf23b1b620cd4a170e58a5e
MD5 00727544e30e988a313e5683f1d4f15f
SHA1 c5b5248e93b833fd1b06d3696cf71cb7341d2e5c
SHA512 87ca6a9e2ae534b448d63b759863f8ced77b95c4d0ebf56c858d8a06b0e5d39709cd7ee3513ecdcfa5c2e6986180e9415e6265017f8d407c2f68fda7525d2eff
SSDEEP 768:apxPbQowWO3YrpEPbbdwNy/d8uVu5AIUxwBVxw:apxPboOpEPbZwNyV8uVuNqo
TLSH
T12864851BEB48AE32D2D771769CF60553A7191C4F4EA26EA17EEC01C81F4685C9038F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Media.db

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Business1\settings\Microsoft.Media.db
Size 300KB
SHA256 cdb1ceaaf867a618f3691f42aacb78e791697f47a4ea65508fc523b97128cc22
MD5 fa88c69b66d553792d95554f73509b4e
SHA1 0c4e2008a72363ce3e0ca4a72bda1fac43e60c60
SHA512 f8e6c33558c52e4043095ab4ad7ea089b86b245631eb9e5e1074d667be0e9d5ec5a6af3bff3e01e231c502930f50fb0be12a19197f9dcaee28df9f8b2b2b08f3
SSDEEP 768:qpxPbQowWO3YrpEPbbdwNy/d8uVu5AIUxwBVxw:qpxPboOpEPbZwNyV8uVuNqo
TLSH
T14964851BEB48AE32D2D771369CF60553A7191C4F4EA26EA17EEC01C81F4685C9038F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.CommonMediaCache.db

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.CommonMediaCache.db
Size 68KB
SHA256 2277d55efeac92c147ae228e6f37157ad5e2945bee9244344acc1aed50881dcf
MD5 15d9f0e98d2718f8e280484527188395
SHA1 20a5b2884fc9c4e310e1457685f05ea3458cafce
SHA512 d546f8364b0a79dbc5e585e5479e647cd789025e560a203f389f37b1e73a704ae9fd5fd250f688ce35f7356d564b9b2941a49957add906a21e2db94e3a0d4798
SSDEEP 48:T0183sfdvr8npn1rZp+nTVuSP5iFsqNauggJota8BfOa83YOCBOnP:C83sl8npn1rZ4nTgSlqjggJoXBfOlC8
TLSH
T1AC632DCB0993AB20CD8C7274C7A32410AB39168FCBC27972BE7380A55F4851C64F9DA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.CommonMediaCache.db

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.CommonMediaCache.db
Size 68KB
SHA256 aad240efb95de0559fd3c4336a30c212b11e154d91ff4e7d939ea3e3654b1bae
MD5 9691773f85477eafc4bc2d1f1e0e62a3
SHA1 0cf8e2a2f0c28662e5d24a81e4885b739da0b7db
SHA512 4f4c43c6d17ad49512e156f7adfcb54db58b3c5f5790cdb46cb8a40aa3c0d29a3fc98f016ff63183b3153c255e9fb29fd65d7114e8e19591875bd227005fe16a
SSDEEP 96:v8tsm8npn1rZPnTgSn9l2ggJoXBfOlC8:vxN7Bz
TLSH
T14D632DCB0993AB20CD8C7274C7A32510AB39068FCBD27972BE7380A55F4851C64F9DA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.ListSync.Thumbnails.db

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.ListSync.Thumbnails.db
Size 832KB
SHA256 536ffda0df7777427e82176b7f3d6b0fb4b99056993a5d884a0210f5e24287b5
MD5 7ccdfe9d7c82a55824ad5d9c3cc4da59
SHA1 061df6e040d8b39efbd839715374abaa5c92545c
SHA512 e0eb172b6573111b42dc4b7080717978a7eb4e6e62474e27ad5fd480eb33c690873e6fad19a4a3064be3ac8883c41c66009c066e010689e9c5a50bd4131cc0f1
SSDEEP 96:DAim5non0gw+qn6n20nun8eQns1n7xRLvUHRfOJJnGnGnnWnOa4Arzo3CnzEd1nD:UBvIsdJ
TLSH
T1C605EC8D2E106B01C1A25170DDD35A1A7B39A76F0612AD9A3DBC1071CF6929CF8B17E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.ListSync.Thumbnails.db

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.ListSync.Thumbnails.db
Size 832KB
SHA256 68b908da62b33a57be9a5f1b83a7892d63342fbce8a08de16c627d89b3f813fa
MD5 4d93adeb13a4f6176b9e7d613c3c5329
SHA1 82b3e7e6452e054f9697a0a62da7109faa3a27bd
SHA512 f46d45650d68a1a2c1e725b7c9c31c296b5c7c1d7767a71d87b23ebf4cce1d3f368067b6b75c831c51beded63ce49ddb7e9b748f636c777f20ab63ec22baad30
SSDEEP 96:Dwim5non0gw+qn6n20nun8eQns1n7xRLvUHRfOJJnGnGnnWnOa4Arzo3CnzEd1nc:kBvIsdJ
TLSH
T1DF05FDCD2E10AB01C1A25070DDD35A197B39A76F0662AD9A3DBC1071CF6929CF8B17E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.ListSync.Thumbnails.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.ListSync.Thumbnails.db-wal
Size 64KB
SHA256 866af42f87e176544864526360c9e90e1a52500457eaf0012d592d5aae5aab7a
MD5 6f215bc0888af6f2c7516ffd5447782e
SHA1 ef0ec3fdd1064e1f8fefb2cc66755200255ae2d5
SHA512 353ee20a04ccf721f3b977c8a60bd438c795a44bb0a9b34ed213bf829bac9eaf311983ae78671dd8ac8ffc16413aa50441040bdd7708c7f93ba691e832e4b5cd
SSDEEP 3:Ol1aZTeTJ+wZTs3eCl+EUdAD4fHEB90RNKxUpUQUlvZuoctAH94+UZLAD4fHEB9x:K4Zql+wZjmt2Q4d+Up7Ud1t++GQ4d+n
TLSH
T1DA53C9798F4185A6EB1269B967052F702F54D02092BAAD158B203886831A569DAC5B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.LocalContent.db

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.LocalContent.db
Size 376KB
SHA256 c04d00cdcd798acd5df836d464227f8091a2aaaa37643e3aa6013027af4b8cac
MD5 b98e082282e36cf7ce61a07b250ce482
SHA1 d9bba6a5a67269af1877f294ae4b78c387e9bb7b
SHA512 1fe9ee0b79f413a9bf682fcf833369b8c499c52f176612f6a2cac4bfbad0ca78c45bd491659dec85da9a4c086ad2ea9c93c643b585c8d8f75dae7ef4b88b8f44
SSDEEP 1536:0NFa61DkECvdMiQsIyBOrUB6hqkvVf3Oo9OORO61u1kCVCaGWeayrpkbetvdBXVk:0NFa6alH60c2Hwi
TLSH
T1178442A93641F33AE9D973B1ACE2C4913232B11F4EA1DA0078DD15449F476CE9E7E6C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.LocalContent.db

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.LocalContent.db
Size 376KB
SHA256 0abd6c158b96a5fc7eeca6dc64b05718cb4792b11ce57f82eaa86e050a1e46b8
MD5 021ac51313b8244d3d5c082fb1a0fffe
SHA1 48520ef5ed64d4f4b8521b8a8c44c214d19bc8b7
SHA512 f604a8ce8fa36ceb29d0037bc81da7bc368418e4cfc0c7c140eb6e83a130422cdd6b2f26c03413576767b53b8ee9f12cce795dc0086fa55b10d33843c7ae0201
SSDEEP 1536:9NFa61DkECvdMiQsIyBOrUB6hqkvVf3Oo9OORO61u1kCVCaGWeayrpkbetvdBXVk:9NFa6alH60c2Hwi
TLSH
T1018442A93641F33AE9D973B1ACE2C4913132B11F4EA1DA0078DD15449F476CE9E7E6C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.LocalContent.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.LocalContent.db-wal
Size 36KB
SHA256 f51f78c35565fc134df4e235733a838c687c49f68d07fd548601e022d740e8e9
MD5 72887f902cfffb1725db0aa34b66a302
SHA1 ea3b80cd3679e3bf0f7bf1e69dde104af2337fe0
SHA512 f33f34cbe359d8112f15516ad0af266ab545ff4b3bf20b7f0e0b7493fbad3289f2b8f12c763b8bd26510d8d42974f40c50c9f22e34441bb1bb23f39ec319ab82
SSDEEP 12:KKflxKfrxrjxKtCZLlxKVEVwxKXCwxKUmqHrxKcFPrxKvdQ9rrxKI8uQV2jxKZoK:KoQx/gCDYEVwkd5r5prvrrgqIlz
TLSH
T19EF290C5CC349CD2C85C223CA66C71FCC55963BE3A0EE0F201C986AC6294942176ED8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.ListSync.Settings.db

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\UnAuthenticated\settings\Microsoft.ListSync.Settings.db
Size 16KB
SHA256 97a0539814bc6f0c80fdeeaddfc5482f25be73e4d0e1fce1a905567b01ed7ae6
MD5 fc8c2ccefe02fc58fc9c82de64854a9c
SHA1 b61af38c9ea73ff65bcbd042c20be836f338ccea
SHA512 6fd039bd959a22a861d6b73cb2eefeab303f776297166ec2c14c0028258e34c1da94db61c9907e3a8dfde7f4b0bc6ecac2b61ac724334806654dcb5d76f59cc7
SSDEEP 12:T4lbLwMGdymz3biyyZO22abBX1ty2Bifx2blq:ThpRSL2os2Bifx6lq
TLSH
T10C7259A3420988BBC611037DD06243151B31060EB322C6F3B9BD511B9F42AC85E272EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NucleusUpdateRingConfig.json

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\settings\NucleusUpdateRingConfig.json
Size 103KB
SHA256 8d94b7cd57072d21b6d50ce9034a4cc325689ced87606a9933129e81649d79da
MD5 0d66cf97940ce1b933855fcd88e66a18
SHA1 5c7b8692fbe17eae9b230dc091926bb6404f089b
SHA512 09ec885bd8df93c1a28f85e1d150004b9ab4a5bdf8f3d0e5e0effdca8bdf7db0bbee533d9f886961602ef350f5a456b7e4e431403a972215b85dae52db701090
SSDEEP 768:WEeIBl+UaPNGZwXJnXU9mLzo922ma++8JDcE4rRXyhUPGNbqLxStzJ8RW/E/+5wc:Wh9zJnXUQYAOEgPGns8vco4EdFkAR
TLSH
T1D5A3EA4E2008B7AFE316AD5A7D6B69861C21746E3852CFCEE0CDC26C6E44DC4734A5B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Update.xml

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\Update.xml
Size 1KB
SHA256 5c105334cf7b16c557dd62bd9a27e5368dfaf33eb27b3b5a492b98113a4c747b
MD5 eeb02985be81c560b8573a4fafa60f30
SHA1 8bbee09a3d1274056869b8e929098bfc6a3d5931
SHA512 6c5f5d3186ea0096ce16f9cdd55f6c70bed317471843a48e61a2a42f327064641ee9e7e68d2b4b3ad79e05e29a2b70acbed7e65ced9932949dd42a3c6c74f13c
TLSH
T10E311ED261E0F233579048EC8746B8A9E3313A6F1F98212D70A3914A2FE54D9E9130AE
MD5 SHA1 SHA512 TLSH

Submit Download

telemetry-dll-ramp-value.txt

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\telemetry-dll-ramp-value.txt
Size 12B
SHA256 291644a1204c9b0e460c04ff50292382476ad19a9296c12ced5768f9fa76eadd
MD5 938803969367c4063aba4ff7460ab4a7
SHA1 91ca0fe11d6910f01e157d48da36e24fa41418e5
SHA512 76b8566410a839167fe5c2e0626828b0549ea2ff8849a3bae1dfccc947fbc63811b273d07c4c48c215061949ac4a28385cdeb566d587940205170b25fd33f073
MD5 SHA1 SHA512

Submit Download

OD4UpdateRingSettingsCompactCache.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\OD4UpdateRingSettingsCompactCache.txt.tmp
Size 10KB
SHA256 da33b6416bce74cf4612f18a3ce42eb57bb1754ac324fd918da81fb3ea2bbf04
MD5 0482e8d3c250b787dd1c62b8c45dead9
SHA1 3ed09b7bfb45f2b951581a9ab6a3080b273b8113
SHA512 c95de1f4a04c8a21d4ab67db9ad67405c8b03ece1f1fde2fee70977a451408668832a142683d2a9d44163d3c80c2146043bc0f578916903c392ab1893dbd6899
SSDEEP 192:F92mTxTnzx4Ei5rtHN1Mk4cB/PgF/XcdDthSIST6pc6F235OL92mTxTnzx4EHF:F92m9Tzx4FrHbdhNpD23o92m9Tzx4OF
TLSH
T1F52250F09CF5DBE5EBE68C4DF0DE363746B48C334BA6815347A3A0868C37619C05A8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\OneDrive\desktop.ini
Size 96B
SHA256 f625a1050e8ba6df4de974c2acc572e1e637a3429bf2ee1449c552999a6c7268
MD5 2b98cc2afc1d0907c7066453643faac3
SHA1 864b3477bba5fb913b0e017f7bc087c3c6af95c4
SHA512 9e2eecf1715378f44539cc79c718bcfd9181728e9f2330e34d228badd482ce48a8b916275a0d063dfbcdcadcde25be82c43fea44aea0393ecf3385095550c6e2
TLSH
T19EB01221804AC925D05AD00F1452490490A50C0F9E09BF049300C40405C5F8CFCC92C7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3380-3944-0x000001B352180000-0x000001B3523C5000-memory.dmp

Download

memory/3380-3945-0x000001B357170000-0x000001B357DEB000-memory.dmp

Download

memory/5936-3844-0x00000248DE400000-0x00000248DE5EF000-memory.dmp

Download