323b8917e4cef08a4110d4b3113f304442343ec1417640a68c58cb56ddbb9a21

Analysis

max time kernel
150s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_740c9b1b7decde18491f9e9d4b4efb8e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.3MB
Sample261110-tgem5avyaz
SHA256 323b8917e4cef08a4110d4b3113f304442343ec1417640a68c58cb56ddbb9a21
MD5 740c9b1b7decde18491f9e9d4b4efb8e
SHA1 2e708b585c86bb2723df6f09849f9477e82c674f
SHA512 cdef0afec1728595477c6bd759394f209bcb16c1cc7f42c04682f694ab813521bafaf0b97e5ebcb2e9e00254ac3453133cfdf62692cd0e63131e144ee27b509f
SSDEEP 49152:Ll+s+BXMPJateq3qbqpHnhfWSsRyV2RRtPoLr7P+cansoSvThr3PAT82:oL3U23Ig2
TLSH
T15A264A0BA7F901F4D0BAD1798AA79517FA72785987319BDF0391465A0F23BE09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware defense_evasion discovery persistence privilege_escalation spyware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\""	OneDriveSetup.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	FileSyncConfig.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	OneDrive.Sync.Service.exe
File opened (read-only)	\??\E:	OneDrive.Sync.Service.exe
File opened (read-only)	\??\F:	OneDrive.Sync.Service.exe
File opened (read-only)	\??\E:	OneDrive.Sync.Service.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 12 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDrive.Sync.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDriveLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDriveStandaloneUpdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDriveStandaloneUpdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDrive.Sync.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDriveLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDrive.Sync.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDrive.Sync.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDriveSetup.exe

Executes dropped EXE 7 IoCs

pid	Process
1276	OneDriveSetup.exe
2488	OneDriveSetup.exe
3444	FileSyncConfig.exe
5268	OneDrive.Sync.Service.exe
5324	OneDriveLauncher.exe
5988	OneDriveStandaloneUpdater.exe
2364	OneDrive.Sync.Service.exe

Loads dropped DLL 64 IoCs

pid	Process
3444	FileSyncConfig.exe
3444	FileSyncConfig.exe
3444	FileSyncConfig.exe
3444	FileSyncConfig.exe
3444	FileSyncConfig.exe
3444	FileSyncConfig.exe
3444	FileSyncConfig.exe
3444	FileSyncConfig.exe
3444	FileSyncConfig.exe
3444	FileSyncConfig.exe
3444	FileSyncConfig.exe
3444	FileSyncConfig.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
3444	FileSyncConfig.exe
5268	OneDrive.Sync.Service.exe
3444	FileSyncConfig.exe
5324	OneDriveLauncher.exe
5324	OneDriveLauncher.exe
5324	OneDriveLauncher.exe
5324	OneDriveLauncher.exe
5324	OneDriveLauncher.exe
5324	OneDriveLauncher.exe
5324	OneDriveLauncher.exe
5324	OneDriveLauncher.exe
5324	OneDriveLauncher.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
5268	OneDrive.Sync.Service.exe
2364	OneDrive.Sync.Service.exe
2364	OneDrive.Sync.Service.exe
2364	OneDrive.Sync.Service.exe
2364	OneDrive.Sync.Service.exe

Modifies system executable filetype association 2 TTPs 3 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OneDrive.Sync.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OneDrive.Sync.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-09_740c9b1b7decde18491f9e9d4b4efb8e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-09_740c9b1b7decde18491f9e9d4b4efb8e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OneDriveStandaloneUpdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OneDrive.Sync.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OneDriveLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OneDriveLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OneDriveStandaloneUpdater.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OneDrive.Sync.Service.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDriveSetup.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\ = "SyncEngineFileInfoProvider Class"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_CLASSES\ODOPEN\DEFAULTICON	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_CLASSES\INTERFACE\{2EB31403-EBE0-41EA-AE91-A1953104EA55}\TYPELIB	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\ = "BannerNotificationHandler Class"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Interface\{4368A156-9537-48FC-B1EF-DBD015F5CD33}\ = "INucleusNativeHarnessMessaging"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\Programmable	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\Interface\{D32F7B3A-DEC8-4F44-AF28-E9B7FEB62118}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}\TypeLib	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\CLSID\{F37369D9-1C22-40A0-A997-0B4D5F7B6637}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\26.198.1011.0006\\FileCoAuth.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\ProgID\ = "FileSyncCustomStatesProvider.FileSyncCustomStatesProvider.1"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\Interface\{EB3EED27-BCC1-4E91-A65B-9C2AFB189F4F}\ProxyStubClsid32\ = "{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Interface\{10C9242E-D604-49B5-99E4-BF87945EF86C}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\Interface\{b5c25645-7426-433f-8a5f-42b7ff27a7b2}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\CLSID\{544c4c52-de0b-4d14-9510-21745381d5ca}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\26.198.1011.0006\\FileCoAuth.exe\""	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\.copilot\DefaultIcon	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe,5"	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\26.198.1011.0006\\i386\\FileSyncShell.dll"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\ = "ISyncEngineBandwidthLimiter"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\Interface\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_CLASSES\WOW6432NODE\INTERFACE\{53DE12AA-DF96-413D-A25E-C75B6528ABF2}\TYPELIB	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Interface\{2EB31403-EBE0-41EA-AE91-A1953104EA55}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\OOBERequestHandler.OOBERequestHandler.1	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Interface\{e9de26a1-51b2-47b4-b1bf-c87059cc02a7}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\TypeLib\{C9F3F6BB-3172-4CD8-9EB7-37C9BE601C87}\1.0\FLAGS\ = "0"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\CLSID\{544c4c52-de0b-4d14-9510-21745381d5ca}\ = " FileCoAuthNotifyAPI Class"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_CLASSES\INTERFACE\{8B9F14F4-9559-4A3F-B7D0-312E992B6D98}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Interface\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}\TypeLib	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\TypeLib\{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}\1.0	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\TypeLib\{F904F88C-E60D-4327-9FA2-865AD075B400}\1.0\FLAGS\ = "0"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Interface\{B54E7079-90C9-4C62-A6B8-B2834C33A04A}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\msonedrivesyncserviceclient	OneDrive.Sync.Service.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\FileSyncClient.FileSyncClient\CurVer\ = "FileSyncClient.FileSyncClient.1"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\TypeLib\{082D3FEC-D0D0-4DF6-A988-053FECE7B884}\1.0\0	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\Interface\{B5CDC0E5-9558-4899-A58B-5D894F493C1D}\ = "IKFMEnrollmentStatus"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\Interface\{AB0CD980-906C-4FBB-9A5D-9E32A3C0CB37}\ProxyStubClsid32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\VersionIndependentProgID\ = "FileSyncClient.FileSyncClient"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\ProgID	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\.whiteboard\shell\open	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_CLASSES\WOW6432NODE\INTERFACE\{2692D1F2-2C7C-4AE0-8E73-8F37736C912D}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_CLASSES\WOW6432NODE\INTERFACE\{0D4E4444-CB20-4C2B-B8B2-94E5656ECAE8}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Interface\{2B865677-AC3A-43BD-B9E7-BF6FCD3F0596}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\Interface\{2B865677-AC3A-43BD-B9E7-BF6FCD3F0596}\ProxyStubClsid32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Interface\{c1439245-96b4-47fc-b391-679386c5d40f}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\Interface\{0f872661-c863-47a4-863f-c065c182858a}\ = "IFileSyncClient4"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Interface\{2692D1F2-2C7C-4AE0-8E73-8F37736C912D}\ProxyStubClsid32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_CLASSES\WOW6432NODE\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\INPROCSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\ = "FileSync ThumbnailProvider"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\Interface	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\OneDrive.CameraRoll.Import\shell	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_CLASSES\INTERFACE\{FAC14B75-7862-4CEB-BE41-F53945A61C17}\TYPELIB	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\BannerNotificationHandler.BannerNotificationHandler\ = "BannerNotificationHandler Class"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\Interface\{2692D1F2-2C7C-4AE0-8E73-8F37736C912D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}	OneDriveSetup.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
2924	2026-11-09_740c9b1b7decde18491f9e9d4b4efb8e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
2924	2026-11-09_740c9b1b7decde18491f9e9d4b4efb8e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
2924	2026-11-09_740c9b1b7decde18491f9e9d4b4efb8e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
2924	2026-11-09_740c9b1b7decde18491f9e9d4b4efb8e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
1276	OneDriveSetup.exe
1276	OneDriveSetup.exe
1276	OneDriveSetup.exe
1276	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
2488	OneDriveSetup.exe
5988	OneDriveStandaloneUpdater.exe
5988	OneDriveStandaloneUpdater.exe
2364	OneDrive.Sync.Service.exe
2364	OneDrive.Sync.Service.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1276	OneDriveSetup.exe
Token: SeIncreaseQuotaPrivilege	2488	OneDriveSetup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 1276	2924	2026-11-09_740c9b1b7decde18491f9e9d4b4efb8e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 2488 wrote to memory of 3444	2488	OneDriveSetup.exe	96
PID 5988 wrote to memory of 2364	5988	OneDriveStandaloneUpdater.exe	104

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	OneDrive.Sync.Service.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	OneDrive.Sync.Service.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-11-09_740c9b1b7decde18491f9e9d4b4efb8e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_740c9b1b7decde18491f9e9d4b4efb8e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update /updateSource:ODSU
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1276
- - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
    C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /updateSource:ODSU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode /installWebView2 /SetPerProcessSystemDPIForceOffKey /EnableNucleusAutoStartFix /RegisterOneDriveLauncherAutoStartTask /EnableOneDriveLauncherRampDownloads /EnableDeltaBuildToTelemetryFeatureSet /ArgPerformNucleusLocalAccessRepair /PerformEdgeNucleusRepair /PerformChromeNucleusRepair /NucleusLNARepairVersion:1 /AddOD4PhotosShortcu /DisableRedirectionForShortCuts
    3⤵
    - Adds Run key to start application
    - Checks system information in the registry
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Reads the TCP/IP host and domain name from the registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\FileSyncConfig.exe
      "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\FileSyncConfig.exe"
      4⤵
      Drops desktop.ini file(s)
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:3444
  - - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\OneDrive.Sync.Service.exe
      /silentConfig
      4⤵
      Enumerates connected drives
      Checks system information in the registry
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      Modifies registry class
      System policy modification
      PID:5268

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\OneDriveLauncher.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\OneDriveLauncher.exe
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:5324

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
1⤵
- Checks system information in the registry
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\OneDrive.Sync.Service.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\OneDrive.Sync.Service.exe" /silentConfig
  2⤵
  - Enumerates connected drives
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - System policy modification
  PID:2364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Square44x44Logo.altform-unplated_targetsize-256.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\Assets\Square44x44Logo.altform-unplated_targetsize-256.png
Size 38KB
SHA256 f21d962c5327933d43c887e1d0531a116fb71cf0075126d9fd5eaa58447a055c
MD5 2e5aa4725dfa1dd1b830850a67e91de3
SHA1 f95890d18ba8f2553150b65d08df0d5a62685d48
SHA512 9b7aadc90730c839c1a33ef15f9e87f69f57d0fe68f8e618269517ad9fd43d81d4f661a7bc17f3fccb174b6a15aa1265633e98a666ad9321572c76c0661db6da
SSDEEP 768:1TybQFwVa0EWHLrrow7oZk0aQDTHYNbE52IFKRQHsaexuDDp+6WFt:V6Ha0tProw7Wk0acHdiQHmuDDp+t
TLSH
T1F603E1109E8ECB2B2B069EE295C24D120FD9B79D7CB6503D90D9CD669484AD03F327BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resources.resw

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\Copilot\Strings\HY-AM\Resources.resw
Size 221B
SHA256 1f762fa2d859cab49e93ca9ce8ef24edc4409ac75de77dc8781cb06ae4ee7f3f
MD5 19638dd07d7bb7e3429874af1375ecf9
SHA1 17843afc8c73bdf38c81e86f86c01323010690c5
SHA512 f2548e201d60cd175b5545607417716e3626f243f11ceb4e93770e07f291072a6e8a18f376e3d34d99eeb8fb135cd68d16fd37a3c3c1bf43d208be6f7da2e847
TLSH
T1EED0A710B9D4EC551476021B5C37504D99B0A7B41260B0193DE5DA473D51DD8A8E3284
MD5 SHA1 SHA512 TLSH

Submit Download

FileSyncConfig.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\FileSyncConfig.exe
Size 873KB
SHA256 65f1bdaf023a70ee2e4ddf224ff25a7980a28a996a4d85ab895af6b1ad484417
MD5 d064f5abd09211c51baaa8846c1fe40d
SHA1 35d131d5dcde36cc8ad6daffd2d9cb3a0ad80563
SHA512 5c109fec9e9ea4dbfa5ef6f0cf82a6276325b8f1256d9782760e33e924978d0acb01afed8167c909fd0a2116da4de66c04ed5e09862acd44c456b290eeef4b84
SSDEEP 12288:UAvzTJAgk47ibFzb45jvT7M8hzLPvR3zfLeoCi77YQ8hfBpR+:UkTJAgk4+pI5jvnvR3zfLeLifiBpR+
TLSH
T154153B2A62A802F9D0FAD2B8CDD74417F672B8164732D6CF02A1455D6F376E08E3BB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileSyncEvents.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\FileSyncEvents.dll
Size 138KB
SHA256 962864e0325daf36c1cd15d6f998bad8069d7ebdd6a10da80af33a82857f5f35
MD5 c1ee8434b5c2c9ef13c290f73b190eed
SHA1 331339d337344053a32c6663644063bb8c55e6d2
SHA512 88db0b251b66dbb9e61c0ac25b267e6107089076b1d8c0c51e6d52eba3f8e14298aae012fcdb40fbd3789cfd26ed26b833a8f5665a5846b6e38b55790a3e3fc8
SSDEEP 3072:2+wodKvDeuYkfFHt65oclnQNIHOB9bdjK4v:aDkEr6E9bb
TLSH
T1B3D3285B73580089D41AE1BA8AA7C907EB33BC67072197CF23A9D71E0FB36E05DB5614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileSyncFS.DLL

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\FileSyncFS.DLL
Size 1.1MB
SHA256 bd41d939113b6c6059f3112bd30c740ccc0ce78dd5dde3c6c582dacc05687c42
MD5 5dac3cb4d2dbb590e7c2648f53bedec2
SHA1 a617b9d52015c051beaf9fc4256ccf10a824cf9e
SHA512 dd5cb6dbccb13d644e9311a3d40407342c0ac36b7c8fb02f17db9dece1160162f883791761a91eb748b48e5d64b2fffe2838d55ed92ef079a730ba5064e5d998
SSDEEP 12288:ZvaSBZoV6+hJQkBOived+VDjgxfXO4GyUK/B17tnuaiYiJzPoSSC6bRM:dT/ehhJjHDjgRj/37tnuaifJztX6b+
TLSH
T154355C1AA6984169D4FDE1B98E6B8417E7B2B84B4332D7DB03E5A14E1F137D0893F720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileSyncHost.DLL

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\FileSyncHost.DLL
Size 534KB
SHA256 ae0252b0ffc4eb6d479921b38bef9e3c559aaaeffa78a87861162da1b0d7d0da
MD5 5559494cc06cb51eb1a2d1719d209686
SHA1 2515e5e125e90a62d2ca741e5321f4eba3ad95ba
SHA512 836cc63cb83fe2f5e4dfc139145215735ae273df04af61ff9b59bf7a5d2a4891d1a57cabf0b4f78f6a146b549abc9079ffa43e0d4ff4225912e7fdba6bb5554f
SSDEEP 12288:NDEy7tAhb0yvJK/qIE0QTDybsYcXLZ1ftD:NDj7YvJuqIEzyb9cX1ttD
TLSH
T140C4392AA2A803A9D1EAD2B88E674507E773BC554722D6CF03E1D55D0F37BD0993B720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileSyncSqlite3.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\FileSyncSqlite3.dll
Size 753KB
SHA256 cb336e6969f666be5aa485d904412494c43197e9a4848b8335cd9bf800bb842c
MD5 369356da9cdd436b0e28036107e626e5
SHA1 fb8bc163931bd0b6528b9e28a243c7b5e23e00e9
SHA512 87dac66838b1d707b96caeb943a6694f03449e69f5142502b4714efd2825bbf74a67c82cfb72a7272b84d014f4ca5f417be5b984b71717a7d85709d984c01eeb
SSDEEP 12288:u2kFjA2sekHmuW7mcfydvSaUWIZHM5OvjbjiYlSd4V6TSKm09H5Y0IYc:u2kFjA2seKmuqTfOvSiz5OLdllIOk5A
TLSH
T1E4F48D5AA7AD01B8E46B9279C9574617EBF2F405237087CB81908A5E7F13BF21B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileSyncTelemetryExtensions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\FileSyncTelemetryExtensions.dll
Size 1.0MB
SHA256 4a0d98279ea4033329998d25121397362808fc674758a40ffd5652b8f954fb5b
MD5 21050534cbf9fc6b23dafe9bd79807bd
SHA1 38fee9a04b950c498632eac68fe84c3dbe011727
SHA512 bd57e37a29797c6af639d9dc0ea8050cdfdcd6824c067fe5c06e3028df9492e309bef79abf57748070803eb4c5978221389d75f9c49d6ce09f45a40bbb4e8077
SSDEEP 12288:J/MKPlPVBj6rMamRGajJlF4ibzlj+xjpYYz46ZW:J/MYOMamRGa7WiB+xjW6a
TLSH
T10335842B99DBB7A4C5C88173E6745E8378EC60E873B86073D66440208E9D5F192FED63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogUploader.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogUploader.dll
Size 1.2MB
SHA256 da446efe55c88b29cfbdba20e2b15480e8afa435bca2c2daaaaf949fd0035729
MD5 ac28878986817f48eeca80e22353011c
SHA1 f041f8dc1a81f34d1c38622543fe47b42bfdd113
SHA512 2bf4dfe743d90e0611bbbf8f5255b71df86a8dd027aad412926a17092dc5a25f23e13e952a29aac1eec959951815707bdbe9480341cbd0e6257dd670d1b27480
SSDEEP 24576:RIx+Bu1fsSEGKTO3LOCxl9u3t7+j6y8b/e5Zep:u7sAQO3LOCz9AtK6/DUep
TLSH
T180456C1A66A842B9D4FAD1B8CEA7440BE773B8054732DADF02914A5D1F377D08A3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LoggingPlatform.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LoggingPlatform.dll
Size 712KB
SHA256 33246fd1a72fa554d12ca912974977431486451be6d073b436bb1a1442be8d17
MD5 55369e9349ad6650f49e919d78ee9ed6
SHA1 e3c1b579656b79633dd98aa3399b8321f626a3de
SHA512 edb7d41b83a48e4f690e5a72111516e64c6fd31d2fa2e54b191d41356f95700e55b5f4d6f5fcdf7a05d5484e59b6bb508b77d59eb23449812e5e3ff580477b64
SSDEEP 12288:uzedaGpWpndMaythnpFWtcsOREs9kdzvPK5yO59qZIGgT9cjx:uzoaGwndM8csOR1em5R9qZIGa9cd
TLSH
T140F45D2AA7A802A9D1FAD1B88D634427F7B3BC155332D6CB0391956D5F277D08A3F720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.contrast-black_scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\OneDriveMedTile.contrast-black_scale-100.png
Size 965B
SHA256 3910d0976a41bc9802e6c1460c441f0ce5bf6520b47e2e7f1237eea0342553cf
MD5 d635128a586a11b8bc6643ca430da338
SHA1 dce9874bbc095f922fb117ca0eb4633c263d3876
SHA512 45732a40485708da65970119ad31289cb7a36bc43254370effc2c1c1bec27a8932aa378aaeee4bbc6e2ee45424abf3a5dc1c457588b99df863f6dff886df6ad5
TLSH
T1521188F5477DA71EF4DC86F7206930EC455F83E6067E460D4D5035205892A0C20A07D0
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-black_scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\OneDriveMedTile.contrast-black_scale-125.png
Size 1KB
SHA256 7876f97812c78b2a6a6857b748cfcb083654b0df7a9968d28a337f553c9bb740
MD5 37d99de37e5e0a880b1e7e92af4f2414
SHA1 2f4383a6c27d03e37c27d55bf18c81f7e448df88
SHA512 435584c224d442eedd0a2d92bdcf11a8263950e04f50d4b6e5df16cb96ff44447de8cca56de09cca163355c63d5695de72c4508496c534be2309dd9cdde47090
TLSH
T17521C6EF7AEAA97FE02B303A5A5111E2411F8027C8003D096EB866B16A7936092667D0
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-black_scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\OneDriveMedTile.contrast-black_scale-150.png
Size 1KB
SHA256 49bac30adc5e19520c9aef662bf6ab7f825d17de893f49f935f52bb58231d912
MD5 f0a8471454b9457e787c5107a669704e
SHA1 d6296385e16bf20cffa7abe0b626ef650474b869
SHA512 1e81ad245b17b9f0a51cbc882f61fe852ef86b11af67fab70c21d248f1c6fae83bcf52ed9d5ddf19979d6917aab99bf5111807c028c5baec6b9b1f29f6a8713a
TLSH
T18431D8129635897FCF8D8771957D8D0562C3AD3CE75432DD1AE01A250A3A974059E0F3
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-black_scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\OneDriveMedTile.contrast-black_scale-200.png
Size 1KB
SHA256 06c80abf5996c0f80d90db0335ec7d77e756fbbea33e97b399e58eda97be5f77
MD5 dd05cf58f3f493f7eb04faf889232e3f
SHA1 8e03035ab0fce9dd0f18b3c61b43e612e393292d
SHA512 e48727ac4185c289b572f729d0f86e51d5a56e504bc89a548f80337b417741e6c0a7cb1e3aa9ff0c784482b2dc034bd0eb4bbf08c8f5707c758f3ac70fa0bdb9
TLSH
T16241E9BC99CEC426D9A24EB2839C082274A63FC744A067941AD085820E48EB48FEC596
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-black_scale-400.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\OneDriveMedTile.contrast-black_scale-400.png
Size 4KB
SHA256 0048c2fbe78c434315a40c489a6233de3eaac4877d3ab3b87f233de97ef45760
MD5 6cee6177303ddc4dc6ff243c4e066537
SHA1 c35e27cbef07f2c29e95e677e637adb2a70e4b7a
SHA512 0cada45d061bfa990265e3dbbabdb902cb2a3364564310bb611e6e4da2ab2b80910f8bdff21240c8fedd8e8acfcffa457d8aab19e443951d8a81c7dda8c19b00
SSDEEP 96:9SNbFu3l/nCJnfP8ut2UriYSdAzVGh7AX5sg6:9SxFu3pCFHnlrieVcx
TLSH
T17EA15CC7249DF17BD46BA133026C86E8B8F7399487AC36A5967132CD4B135E5CE4D102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.contrast-white_scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\OneDriveMedTile.contrast-white_scale-100.png
Size 898B
SHA256 d66500db2be2a08e1fbe3c25bfb3f8f92af7c1222ae01d983ff01f28e161a173
MD5 9fd897bb6d2d83c0c2874f0bd977532a
SHA1 d45a0a45487a3875b2ec53d5949089269f5a42c5
SHA512 99a1dcc62612b7491b275158d98074a26ff5a04b685a76ce6d810fa3c184b940922b0012d6aacc271bb67e86670cc4ca51a2c2bcda41eb9871bb2b16f5904a11
TLSH
T1C4112FC4EE8514F9CA8A8EF754976B9112322B0DAB94661BB74869B855004CC090A2FC
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-white_scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\OneDriveMedTile.contrast-white_scale-125.png
Size 1KB
SHA256 684f98e53e6508ade14997324ed729b2dbd54fc95ff0d0cf242a0af2ff87b296
MD5 8e64cb13b83fdc456f799a8d468cd4ff
SHA1 e781ed50c2247bd78f1f5c3aa1663b5e256d716d
SHA512 d4c4a7a174c8d18b4803312f6506e80d3ea23643af7cf6a28e3f374aa29668bd17b6694637a891c2c9b6353dc4378fecda80344edba4844140fbfa4a0ce4dfd8
TLSH
T1A62118E5AE5AA118D8578138C55FFCF190272807A85FFC302F8030E81600B497E36FE2
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-white_scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\OneDriveMedTile.contrast-white_scale-150.png
Size 1KB
SHA256 f1758274ecb3b62b6324055d6ebfe894fb022af30d646c26ff75245ffe07e97a
MD5 fdd4e3bb210ea902687788de2582946e
SHA1 3f54d394be273f8f7d179cff1b7238a454c561db
SHA512 a3d564f0eb98ae266752148ff78bd8438f03f78002057baf1929349e833212ac82d73a99fa2d273ca3325e95d5a9be16f5c230373684782461074a3d76536d99
TLSH
T13A2187EF17D97C14C95B4FB9E67A7AB0891F2F0424114780481901E29E3D4414AD4AD5
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-white_scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\OneDriveMedTile.contrast-white_scale-200.png
Size 1KB
SHA256 969e3c485b450ad929616ae0f64408afb25098a8e32993d92e84a6558d3ad8a3
MD5 d9a0baf2ad9f556e02055b5df310bad5
SHA1 89fd7ea535ddd01f332848e11db835be0acf31b2
SHA512 4493b500563af82b955694793a19d0e1821162f6ae6abb8fbaa4f455a41b122db753696ae357c2dae81ab0018d432b791724847946feae4a612dc647acbb3741
TLSH
T108312AC61DA939F8D918CB32C8310D58B8C22B12453357C01A2D1DDFD9B0E8C47D64E0
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveMedTile.contrast-white_scale-400.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\OneDriveMedTile.contrast-white_scale-400.png
Size 4KB
SHA256 2167f453dec79f0f053913908fb0eb74b54342f9f298dffeee339712bae851e4
MD5 387e0eaae22c86ef0f9086703675f546
SHA1 0b216d6f6c570fd2ee7e214af38671fb3e9dc7d6
SHA512 7620f497f4935317ef01cbc1e93f8396f7684f0a13d5fe08ef2f1c69450e8fe9fe9d26a0d0da2c42b685ad2293a84918a49a9e1af6c1438eea7d3d5f507ec863
SSDEEP 96:9Sj1yh70iOWgmvD5xDUQX02WIZHt9cR5CX:9Sjkh7bpvfgU0cHtU5A
TLSH
T152914C9D079CD179CE662235D98A06A92C3F3CBD268A9052950BB0B305A379167264DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\OneDriveMedTile.scale-100.png
Size 5KB
SHA256 ee57225deb5b003c11d84f099a3cfe378ada230aaa89c6d7fc6334a21ce7dc06
MD5 ff1bcb9da494dc82c33d72d254e685f0
SHA1 a53c1067d1c62d5af3fa940bcc10db919ac0cbab
SHA512 891d8dabc1edc132a8e559e635a24f9b978462a43aa5b722b58a6b0fdc1ddf00b49de29c4dd00a42d7c0597a5c1765958844b80e013712da4dbc36414429b5b6
SSDEEP 96:5SZElqpLKR080FknPAC4G08hfQu2gib3HatOB1ihWscAgd/M2veRUufqI:5SZ580FknPRt9xQww6ABsEs1gdM5Uufr
TLSH
T1F3C16D48822CDA4C96CD583CD792523D9B66FC27CA20409D6B709C636D42D8EDE4DD7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\OneDriveMedTile.scale-125.png
Size 8KB
SHA256 b3ce4ca2c3598012a7815108f0480bfb3b71b834995993a4160752a2577a3b6d
MD5 be9a752781ffaeff9d8bbeed90d45b91
SHA1 2c4e6f18b75d7dccd36a4e79003dfd75b79a2cff
SHA512 1c75d936032ce23acb4bdd8ed215c07bb7763585447443d45f760a59bd961032df9adac11b13b91140e953bea72304020cb3a65862b90fb1873dd03c63127a75
SSDEEP 192:9S3ifaS/VXPAXOS3SjNTZrqjQIbDBGSzx24piRvU3YkKvP94zbh+yc:83e/ReIroGCp2pvl4zl+yc
TLSH
T1B9029E14FBC10757C4FB767724C574B7A79BD80E6876AE2D7812E43ED089442090EBE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\OneDriveMedTile.scale-150.png
Size 10KB
SHA256 a285df7d2be2aad1ff4053c3a95ff0016e23051c48bb17bad83c9fb59d8f41d0
MD5 2b84c5e76851a95e98b474aba8152fc9
SHA1 6b3017777397b7157c27b8a4e1f8328c73f8bc05
SHA512 e7e3594f2728d9960cdd020c69b0016a7adcc2fae76cae6ad27ff10d3708f8293c7a048af3b803fac7db25e32d81be4be36364b87c72611ba56842ee7eac509a
SSDEEP 192:iaOS5WquttsnUxgluNgERWuqnpJ8knWFeTWM6r6FpKD9faobQqaI4C:io5WqfUxgcgeyJDn7TeUuao0qF4C
TLSH
T15322A0D998FDFA21DF57A17020B2CF8BDB5386480AEE96E8DF14369CA811CC86444E49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\OneDriveMedTile.scale-200.png
Size 14KB
SHA256 c655edecb76d1f95fc64c2742869e54d80f9102a0e0fb8f5824912b7a1f1d6af
MD5 908859e57528f8057da25c5b2154f065
SHA1 3d4c6cf6b05f267ea9aa43ba4a0c47464ca69d8e
SHA512 fc2671d553e28d95e34bcef7ba3eaefb8796402c322d540c05be049ab5b45d5a42e021146535172cfbbe7b90e9205a7a149aebcc5616e70313a9fe10b9de77f7
SSDEEP 384:bvfUYwHWjJy2c1DiaAeJyrliP23MIczfbTzofYR:rjNJlc1nyq2cdfbfoQR
TLSH
T18462BE80E2BDF934BCC75878E6A64F5B45034944CDC11B0AF964BF8EB289D9DA048AD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveMedTile.scale-400.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\OneDriveMedTile.scale-400.png
Size 48KB
SHA256 e472291a236bfad76c209b5785c329dbc094fbd70194c21cffd20fe32ab59a12
MD5 0969de469e60a500eb13864d1edfc318
SHA1 4d45041beca4202ad12bb660025d9b0883aba910
SHA512 631df4c5b7f9356c2f57330cb62f2605b74cb22d470792c6653ef933c7603d89ce525c03f63ac69309209b1fa565befd60873f01668afc095918733722c0f550
SSDEEP 1536:nLNY+lbWM/kXLLnecjWPSnK3q8dcUoqejbwJ0isZRN9/18:LNHlbWM/Kuz+4qUcUo1c0rZRbm
TLSH
T16A23F1E3547D873ACB60A9779ABDA0C77CB619971F71680D7A1238506B540B8FBC7023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSmallTile.scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\OneDriveSmallTile.scale-100.png
Size 1KB
SHA256 1c1975f56416589fd0aa9add4c44a87c5dfd71ca365630e40e9f64bde6f0e49c
MD5 635c7e6f9c9a77202ca96e8c68899321
SHA1 0dbc327ae14c76fafe2d5fc860eec45a7414c974
SHA512 cc7a8175fce47f3db218a9279d244d7f1391d56fc2d7e3603a558baaa555ec7d84ce27dfc5e581952a7f76d65c2ac4c4bf2b1b28c8c41cf84db84e0e4ee691c5
TLSH
T14531089FC22D50E5730F6E8F8C7F8A411897E3740287B10AB5280A30283BD294837ADB
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\OneDriveSmallTile.scale-125.png
Size 5KB
SHA256 46a6e452b5bf41b9ae867aec03f38bc5970b6c8a3128387b0b4c75cc203db9f9
MD5 3c81de4ef5b1d3aeffc440404858dcb9
SHA1 90486aeb79d47cae3d2c143b7436a6b1844d8f91
SHA512 001f9e29105e6730ca04d2ab198456a59cb3c47f83b3fc408c804789801d4760869331b63365c2357fc5e8540f79c18481c4e6696dcc4716d9fe50406eab686a
SSDEEP 96:bSB/bHKj+BNstFqpL3V8voyrt5N+q7SNvhvhqkpX+kes5YoXD9Oc/:bS5Kj+BN37Sr77SrpqO+kesvXhOc/
TLSH
T1F4B17DD230610ECA83CA9570B16B7421EFE62EC90152C1D18EB36311DF67695CFF5766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSmallTile.scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\OneDriveSmallTile.scale-150.png
Size 6KB
SHA256 4e80205d7bff5c25be88be6f21ea5e32a2edbf115cdf4f26751f2a24a3d5c3d2
MD5 14ec3144f6e63b10d1a5f84268c5e634
SHA1 d0a2668cede02a7bb7e86ec081ee0730af01e98a
SHA512 2f21b1387d5d33a0b42a2a793c432d24a17b6d39db98f6362da45885d38ce6c9a6af224d99725c1754534e950d05c56b5944b720dfa8ecf067d166605b23df25
SSDEEP 192:tSSYIgYD/JzlAbIvvfIhEWuLuAM9dzOrowSKwe:srYDJibGfp/rok
TLSH
T1DBD1AE909D4838D87BA669928237676354C83CC635A34FD8D04CF3C51E9D299FE91E71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSmallTile.scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\OneDriveSmallTile.scale-200.png
Size 9KB
SHA256 19d6b52f75aca670c722499bf04a6de7eb9eb6cccdc78f489a73d72417fcf478
MD5 1499cf8f813f3c22dd0764ef4a695367
SHA1 2ea9b463553c5d97a33832ee46b600f6d3640620
SHA512 0fc4d5f1b21b608205f082a19aabf816cf503df1b8650fcc83a3d0d208b4651bf999afb0927b4d3a248e501aa656495108c646bdc073839d88ea1554e70d3c88
SSDEEP 192:OSJRFyoZ4ZzqBpnJa42GYFmk4iQ14eFFKOl082BYpKTK4odOHrEN06WPBS:xL31JKGOpnhebpl05BY4TVoW4WPk
TLSH
T1F122AD4653BB7182A092A4EF351385A504F10EDDCD8945B3DC8478E39D8E2CB25BA78A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSmallTile.scale-400.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\OneDriveSmallTile.scale-400.png
Size 22KB
SHA256 ce53878af8d98b9e2e94374841d4be37c6942e6bccde660d05b86d051ef5f078
MD5 8fe69f9883b3959993c5069c8612ee57
SHA1 9bb5a5d31cb99039e8671735ef6130dff7be9f02
SHA512 e6348fc499af5a5aad8cfb2e1c0aed8644afbd91a19ac671819f4e8f060d33fef0153eb19ce773c979e15718c8a3e857922163ada71324496fdcd88558548d85
SSDEEP 384:w07l8gzGyVUmGiQKyz0uPLXt5mQUl2gEIusi10jTnanX3Ucym1pHs:NewG4BQKI0yqZ2IuHMsTU
TLSH
T1B9A2D0A969E4D89F1D05721F0737997EE13764C860317809EDD8D7D91632A2BDE10BC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PhotosSquare150x150Logo.scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\PhotosSquare150x150Logo.scale-100.png
Size 21KB
SHA256 7b31060527478a8e3ee7910d83fdda8ca59ab4376fe068fd8b0009489551debe
MD5 9b093b69ad431049b6f75c61bc2cb47e
SHA1 ec476e7d39bbc5e12bcdf5cf4033fd2ea1210570
SHA512 2e9770ae2800b855855d36073a45cc37ec8dfe5822de3d131aadec41edd3e8449e5a7c96e53105ae116fcdd5234394cc039ed4151bd843bb4098f7d62861e09e
SSDEEP 384:3eqAVfTs4W1mMejENSftmljruxRV2BDBewtwUyWGXOvhsF9WCRQo4QSyDFCKEfgi:3evs4WgqEF4PuxRQtEw6UOO5s3J2oPF8
TLSH
T1E0A2D04096135DBED428767AB9077EF2952687603DB27FEE9435B2C285D0B8E8173806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PhotosSquare150x150Logo.scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\PhotosSquare150x150Logo.scale-125.png
Size 33KB
SHA256 6bff72c20aa952b48b297f0086e87f79879ef065923954ae034e82685f013982
MD5 b0968e1a37138d0ac00f815089738093
SHA1 8d234f182695e6da33e09b86c20fe01562a7bd7f
SHA512 b0fbdff94ce3e31e3e6135613b0f0641d9aa6fb5c42f60f3128150e6232fddd6986700f6a82ff88067ce63defb2498c67291f808370132ce01765a0dc3bd4771
SSDEEP 768:6/uz+lpnxBbSP0lH3vY2FSoInuMFZd0Qwe55MXQXt:zzQpxBGwH/VFSLnuMvd0Qwe55MXct
TLSH
T125E2F142E7B13160607DEAF80E40EDF8A1785A73AA616653F771408E5EC9B91B0F0BB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PhotosSquare150x150Logo.scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\PhotosSquare150x150Logo.scale-200.png
Size 73KB
SHA256 303d1b92d5e84db12c62c59bafdaeb511817f9a96052e0ab4440749ca31e5107
MD5 6087a47f5fe97fcb701e9a10f36f37c8
SHA1 85c7b5c10d394664794b3e3301cc678163d92c4a
SHA512 0777a1be01c914e14ca498ddca78f08638612d57d8a0be6f32a623f3538b88f490a5393a79e2775220fc23b5772f5c1e1a5ec223d854605d924bb5ef71b7e79e
SSDEEP 1536:uiDRN10qtk5i+sBjW4iVt39yL27bazCgk2Nfx12q6ag6pIn52BW9wYSF2:uivk8+Oj0Vt39yL+WzCqxkqrguIHSY
TLSH
T1CB7302302602A897147625ED2A5D3E8EAB0DD1223035E0EB1835F5E9F03D7344FDB396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PhotosSquare44x44Logo.altform-lightunplated_targetsize-16.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\PhotosSquare44x44Logo.altform-lightunplated_targetsize-16.png
Size 768B
SHA256 4fe026cd0890165668f2c0597992dd0b79e996496bc125a7beb4c4680d0d3227
MD5 f6590c79cb6bcf344d4a070f9296bf39
SHA1 e34651210440834f9c904b3444b6588e3e23549b
SHA512 ff62528fda15203ae4a73e4e9dc3d3a03c06897e4f028aa882a0bb39a3be6c9323564a27e9cf174a64fbe7e68a362bd79446ad7a759550944919be0215518404
TLSH
T15D01C547ADB3A100C016583C03C22810AD3061E939DE21CEAF0FF4C42C0827400BCD11
MD5 SHA1 SHA512 TLSH

Submit Download

PhotosSquare44x44Logo.altform-lightunplated_targetsize-24.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\PhotosSquare44x44Logo.altform-lightunplated_targetsize-24.png
Size 1KB
SHA256 33ee6f7430e34325f95f9b24679d602c31821587b1310b43e47aa1d6a4334f30
MD5 02a871b84bdff02f079102c4c24a87a8
SHA1 aa622fb6bb1d42a5a1b6089de853e2a175713184
SHA512 7ccc8ede9bce4a9f8f3537cb3f2bb78cacfdb00d99f7e3bc418e2838c501803e7ff248975de29c4d58956c09a421a7987726b55797db8fc2061b31ceb7f98c4b
TLSH
T15B31E9D3BB80482D035EA2B9516259F8A22433FFB0397A843E566D798424CA0658C2EF
MD5 SHA1 SHA512 TLSH

Submit Download

PhotosSquare44x44Logo.altform-lightunplated_targetsize-32.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\PhotosSquare44x44Logo.altform-lightunplated_targetsize-32.png
Size 1KB
SHA256 9b047e84ca4555b15c9676a39279877367ef130fb2a91e4d255f7624392e3273
MD5 2bd2ac8d930e5aa88cd8742344c33fd8
SHA1 5ef60efb32886ef6f5b08c615cb5e9e5168732bc
SHA512 d5aef1e7e16d07ef9999e3ae90d17863ccfa7b9e68cdeae10f3018c55861b7524cf4bd8d7622203b705b2824934f5856144245c4a086e048cc9a692693118ccb
TLSH
T10941F8D2E3CDAA74505EC0B1E762245B51287EB1AEB06088B732D1263D7D2E17660722
MD5 SHA1 SHA512 TLSH

Submit Download

PhotosSquare44x44Logo.altform-lightunplated_targetsize-48.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\PhotosSquare44x44Logo.altform-lightunplated_targetsize-48.png
Size 3KB
SHA256 3f8517132701d52a31520148564d5150ff77ac83943d0ff5a746599f01d5e0b1
MD5 17d124cd703886af6bf0fb9e14f61617
SHA1 aad99008c094d88b9804205b0a8206de99cc0aa0
SHA512 fb94e685f84c026f31e84f6864c4cffc2f7f9057b2458e010c65bd940bd123fd780f96fd7c54fc0804485bfc3063a041c6d78543f61ec31552f5e3ce3bfaa5cb
TLSH
T118818DE2AE95E318D391BD1562D320B75B3C18D2AFDA868ECFD71B8D337089C0D05619
MD5 SHA1 SHA512 TLSH

Submit Download

PhotosSquare44x44Logo.scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\PhotosSquare44x44Logo.scale-100.png
Size 2KB
SHA256 6b137a3b7ea0be5358c0428acf8081d3cfe613b72951d21e42c9e404a6cfd66e
MD5 e33e1eb44e3b8918b44cb8c0014b930a
SHA1 a21f82a9c9bee2e46da9ff7420fbcd4b8d02bb54
SHA512 1383486ce6d10577efae908d74f2ba23d767614ebfbca362d7187d3aa93520143e723656d351a9ff278d7990c8afb6bfb604fd96cead1ac413b96daf38ad8ddb
TLSH
T131516C561EFA3ACDB3EC19BB68F73665A3B59F6A8050D3C517801154B008F82F010DB0
MD5 SHA1 SHA512 TLSH

Submit Download

PhotosSquare44x44Logo.scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\PhotosSquare44x44Logo.scale-125.png
Size 4KB
SHA256 34ebc8f9b3b1477dc09aa418e98cc9c6edaee0002fa1603af4db3b3f58f75776
MD5 c8c9c52412edc1d5c42f5cb29c5b3c38
SHA1 ced4b78dfe5827f7f334bd7c65071d26b1356a3c
SHA512 be2436f272bf1dae75ed50dfa98153b141680cc409f108d50b7cecdf5e8816c63450f249d295028ae94e6eef49827eb74063c8579392259ad6feaeb1f26308a9
SSDEEP 96:+l0ZULvnYch90Co08aWp7/BAB8TiwhT2iZ16jhz:4UQ+C98XqWTzRP0jhz
TLSH
T197816FD0F4D07AD3932EC7CF4D84AA01A6A8D3676DA18AD9F80E4375516CCDD0999020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PhotosSquare44x44Logo.scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\PhotosSquare44x44Logo.scale-150.png
Size 5KB
SHA256 ed32c01317c12d117d84c9394f22e4036ad65b38d62127f075a6b25d1d5adc25
MD5 5da55d446dd60be2efdc067f606c1ead
SHA1 640745e3c64be27dbc33a8ebe923b81b1f64434f
SHA512 fb57c43a7d5e882aeb8f5615e0890a62556c9bd29ed19b1f7a7dc10115075f0a7125d3d9d8bbcdec9a20c4746cfedf52fe4f4373cc99048c2f623bfddd7a4a9a
SSDEEP 96:f7ml2Fakphsm8JZWH+WQT7k/YUSLKBOowXDQdzujtiRvhYnjoprPHR+PN1gSH7zR:fRawhszJMHsUhMVXDQdzujUasrPHR+PF
TLSH
T11CB18FC9331E54FE5C5BB1EF8EE306E2467171E1821D5DF6A6027D785E52811B90D094
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PhotosSquare44x44Logo.scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\PhotosSquare44x44Logo.scale-200.png
Size 8KB
SHA256 c6c927733060f9a181d4c725d70dfd422c48e6137ee07e58e87dbc56542dfaea
MD5 63aee050bfc9283b110223951ae1f7c9
SHA1 939f20bdae68de9e868025b0e7db297b3c649d0c
SHA512 eda6d9fc7ecaae0712615122297c9b9dca5931805c5daad3d61c12fe6f09664c3b35b2cc4551fadd76e1ae36153c412b1cd427bf2d44b4200bf18e59093e947b
SSDEEP 192:oxb/m2xY5CvRs7ipuI/quKSmJuj7TYUiQh:oN/LYEpsU/sUDNh
TLSH
T17C029FF87754E7975AC449E6720E63A0ED6A4BEA400B27CAEF94339A53875B00945311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PhotosSquare44x44Logo.scale-400.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\PhotosSquare44x44Logo.scale-400.png
Size 29KB
SHA256 a10d09f50fe80ba4ae6f9e8bce85b960d1c6b657a74c7dba8d767c70838bdd95
MD5 f5290484a9642b7c7783a324700000aa
SHA1 1d1983e84fb4e7add1fdd9410310f149e6f51506
SHA512 e3040045b39dedefbdc0735843979065a1aaae7d548b82adbcaf6e5ea38433f3319a6fc6542f7b81b1d036116d2a6687e24a185721117f1260f944d6b11d645c
SSDEEP 768:O1ik9L7gzQUWB/L3LnCkdwqYBrhQ1OZcH5wTOSzVsDMZ48:Ock9OerLCkdKBQ/wTJzI8
TLSH
T140D2F1C73ABDC0D03E4F623194D014045720726F6FEA318679BE8D272AA7305BE6AC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PhotosStoreLogo.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\PhotosStoreLogo.png
Size 58KB
SHA256 73f63a98f6721664516f8dd8043e8cb31a1345335f124ddfefaaa9fb83b2980a
MD5 9ac786330ea209f7d02415385a66a515
SHA1 09d8199787e04915e70baa2a1ef033b7b1d7b6f1
SHA512 5cfc0367fd7cc7f27fe249b3472aa309de0ba4fd2adedc631691c618c9f6ed3acb49652c0f51e21cd4793cb06c96672f8a4e939e8cecad2e881f66ee1b11386e
SSDEEP 1536:NC6QgPrENrCeg+cco6fQY9COxLssI0kl2Hgk9:NVIrng+PoQQ5iYsIAHgy
TLSH
T1DA4302F4F3DAE2647223BE6E1B43A3518A76218748914A754A360478CF47E770797F88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resources.pri

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\LogoImages\Resources.pri
Size 18.1MB
SHA256 e666f311a75efea5ed9a8ecfd59f43c30ce3acaeb976dc2679b0c5f53ada2967
MD5 e8380c63d231010a3ceb1a2e62d03140
SHA1 2ebb54f5b25f7228acea194fb07a0ea3284717cc
SHA512 b6cb09f9e602de9dbf8f4e0408f3ab72545f0a2f0e35c8206268ff58301e48cee203d82e74581ababcaba747864e3926c447ac7552b16a3e464533a31956fce9
SSDEEP 49152:45Ha9zdQxa21dr0LOCd74LBd/HEw4EHrEe+fr6ykfrZpTXj2qOkIqcQ:wwsjx
TLSH
T11A175301E3FB0248F2F36B717EBA496598B7BE525930C07E42049A4E1B72B855BE5373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\MSVCP140.dll
Size 530KB
SHA256 68bbe3982ff90c40188e19e8949c48b296be5b25bc37d95729089a704078455b
MD5 b4611a61da98e94259211c508b332d43
SHA1 3d294c9d81141383d52eb6f7333606c8b4d04264
SHA512 8420d67110407c0a741dea8fdaee99c187b20e0f4d7c258dcee3e2e677f6bb5cf3dec90e18cd65a1a82c4aeb1853d234bcca311f4045b56b7d5918c4db825306
SSDEEP 12288:r0MrE03u1mHWV/I3HVbQEKZm+jWodEEV7B:r0p1F/IpQEKZm+jWodEENB
TLSH
T1E5C41A23F75906A0E195E3B8A1838702D7F1BC598323E3C742EB955E2F577D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.SharePoint.Calc.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\Microsoft.SharePoint.Calc.dll
Size 913KB
SHA256 4c1b662509cdf712004e85e8d6e8bc4b97b1f877c0deba61a627644398af42ce
MD5 75d76f55a3fdee471818b979c12bd97c
SHA1 ee8e53b945930ec16b47e1997804614b1810e4fd
SHA512 b5e1b0681c68cf7d10b7dbc0848e04f120977b35ce153c4cc0764295f56c1b5215953345f9e0ee08904bfe2743c9062ce792d78a53d3ba7769f80543c5df5d5f
SSDEEP 12288:18WCtV5SsZ1cVbjOURbvJ4J+uDvRGeo+BlSglLKhJkHgZBe0I7mqur:9UrSsrKbjOUwzR1tlSgEJkHgZCE
TLSH
T18015AF0EA2AA49EADC26D13C8557850BFBB17411971087CF06A4FA9B7F2B3F01D39719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ODResult.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\ODResult.dll
Size 49KB
SHA256 60363f89fb54bff10d66118bb444c2b04df082bef34980d36e5a8ed8c92954c6
MD5 44a8930db9cfe7aff604dfe3a9df06e1
SHA1 21d915c4136c6c78b33568da3c3c25331d70abab
SHA512 a0d05c9fbb1224e2441ccbe29fef154bdea2844e204af1c8e03a26da3d0010aa3378a1a04236dd2ee0ed4af2f0d1c0910ec6e08b8d3f228ab55f4d235d243cb3
SSDEEP 768:CbvfmdF71+Z6HtvIr2f8szHrjUunB80caOJu5rbHIYrr9zmcUM:Crfm7R7GKzzHrpWvaOJu5rEQBzNR
TLSH
T10F33096ACD2A501BD70DDCB4C6478C0AEE72BCC78BD1A5D75B405CD60D66BD4AB3E202
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDrive.App.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\OneDrive.App.exe
Size 1.0MB
SHA256 ea10f00bc515b6c2a62c9784abae6276411220671a45a3fc247c8dac2a4ce80b
MD5 efc5c6f4da56ae58aa733f13c0bdc7d9
SHA1 d33dd9c72fc5c4e8da4d95da868fdaa82611382c
SHA512 c331c3eaf1ab60ca668d428b4796131a56f6c1237cb29aacf4cd847903896b612303054e552cb99c366150e14ac0fb244df71542cb12e2b52e1ee3ce63ca5e77
SSDEEP 24576:LGQpLUbZE833/ldcktTo9QE4lU+aQgokHog55TZ:VpLUbZEwljtToQED+gvHFZ
TLSH
T118358D5DA6AC41F9D0B6E178CDA24413E6B2BC165731D2CF03A1669D3F376E08E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDrive.Sync.Service.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\OneDrive.Sync.Service.dll
Size 49.6MB
SHA256 1d00f0de31505f91592761fb9eb75d4fb3729255cedb2bc30e13804f202d5987
MD5 09c4ebd568045812e0a84c321110b45d
SHA1 9bafb5991830bcdfaccedd9b5459dd0bee384aa8
SHA512 6ec6b4e30bb2a3ae9781b2aed52fb099c29c61d34f3a5b8d509a2a677c911d4b9919ad6cc0094fe9e5eca942d23448c85cc72183679e56638c3561564ba0fb86
SSDEEP 393216:wAklWVGLlzYuxChy46Y1wSX9fqy8TPvN9Zojdes:ZklWVGLl/Chy46Y1wSw7TPvqH
TLSH
T16FB75C1BB24D41C1C49AF1B86D57D923FB32784A43A1A3A312DBE3271FDB848667B750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDrive.Sync.Service.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\OneDrive.Sync.Service.exe
Size 947KB
SHA256 abb505f2b215138ab931945d6c8af44edb86bd1e7bf402669e826a936203ff6c
MD5 5822f72a3c3e5df191256728e62de51a
SHA1 46be895b4d99e9211ce106bcfdd9cc1dfb6cbb43
SHA512 3cfc154e2dab8aef12a27557da7a74b321533137424a0e27ab93f555a3e8798e4bc77aba075d79150341ce5a90e8e469107e43eac2c2c60d3414e998fc2d4804
SSDEEP 12288:wz/KhOoQ5E/HxoTHgEaQtmOmsDM9WXCyjM7CL/rg3KWgoJl:wz/LK/HxobgEaQtmONMIXClmLzzWgof
TLSH
T1CA258D5DA6AC42F9D0B6D178C9924507EBB2BC165731C7CF03A1169E3F276E08E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDrive.VisualElementsManifest.xml

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\OneDrive.VisualElementsManifest.xml
Size 344B
SHA256 d21077ad0c29a4c939b8c25f1186e2b542d054bb787b1d3210e9cab48ec3080c
MD5 5ae2d05d894d1a55d9a1e4f593c68969
SHA1 a983584f58d68552e639601538af960a34fa1da7
SHA512 152949f5b661980f33608a0804dd8c43d70e056ae0336e409006e764664496fef6e60daa09fecb8d74523d3e7928c0dbd5d8272d8be1cf276852d88370954adc
TLSH
T13EE02688B16841C263D369B5643399CD329D329FC3C905C296A145B62154CCC4D8B18E
MD5 SHA1 SHA512 TLSH

Submit Download

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\OneDrive.exe
Size 4.5MB
SHA256 85d57e4fa8e43beb1f3c1687513256c0dbfa19130aa0e9d533fbf1692774f5c5
MD5 57b24100b96de9a1b07d31025fcc65f4
SHA1 a1330555ce994817cfd5375e5448dea39d4d3782
SHA512 c9be41ca196c835ffb3f230dfcc2fa937e7b96d24bedff68fa153e0057f3f6c4466844cea8b418e53d487ef1b65c8890a3cc8db554d82018e8ee8824ce4d2036
SSDEEP 98304:Zez/hpwBP/OlsLzFmNfW6FJKxxfZA4AnyxpELRSKE+RA:cPGpELcoRA
TLSH
T169268DD6BE88F5E4C0A48834B906D57DD673BC7A4B12468732D7FB1F2A37180452B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveLauncher.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\OneDriveLauncher.exe
Size 857KB
SHA256 fd873e352625a85916e0adc910983b05f1f78fdb4248ed603d7f628d072a66db
MD5 8159e07b3b1fa032588075ed70a85b9f
SHA1 af536a42411392257929ea1e85093586eab16e57
SHA512 5afad79ad9204c3a1837b2b5d040f6d38d7658c23f488549d8dfb76fbfafc9fa9449e4fd8dad57ea7b45247e79de4fbae6676ffa18c1be7e474c153572947e6d
SSDEEP 12288:keDsGvZVueqLOfCebjpW1SsWv7GfUgFMrbbyOvqyW91:kCTvZVuXebtiSs9frF2vyOv7W91
TLSH
T16B154C6AA6A802F5D0F6D3B8CD974407E6B3B8564B32D5CF0291815D6F376E08D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveStandaloneUpdater.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\OneDriveStandaloneUpdater.exe
Size 4.3MB
SHA256 9c8033ec408ae65f3d2dac25f910856fe4b37fc01a9491f084dd62c9bf12fceb
MD5 e8bbffb6665968056225aae00a7b9d3b
SHA1 b2615e1da6f8870a03746c003aadf180664745c6
SHA512 1d38ffd9c0f9c9383c656cda64fc3b4be53e22efe480349bd40ac94d92929c18a18207c8e7acb3f5671d3c9ecde4b9cf6816cc22cd0bbcdb89bb11496dc685bb
SSDEEP 49152:C+KSERpxR5dapHICpMXAOgTtYVIYwjaZZs6DdWEBRc/PtlzMTKQ8LE+zQy:8FIlpX
TLSH
T11B265A0BA7F901F4D0BBD2798AA78517FA727819873197DF0291465A1F23BE09E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveTelemetryStable.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\OneDriveTelemetryStable.dll
Size 2.4MB
SHA256 d36c3f733cbe4be8c612b81d28cbb21a9df475f5b21b98035019072cb7547b7c
MD5 c8d66a70dc41eaff3dbbe8bbe9e02593
SHA1 b3bc36d49956b9ec79bfaa26da3e0d5cb6b8ffaa
SHA512 1532f0147b66256bc5d930912e44e4273cbb5d05aaf3247eceff5d2a7ea96234ae5fee1b4c4c12846a28ae7417ac5e83a258a0c0372fa57b08164d5b0406059f
SSDEEP 49152:XAC2yktrf4rhXXchOQ4SCTBheKW7kzdUT6ita:5csX+s
TLSH
T1F4B54A4BE6B941E4C5BBD13C8A576A17FAB2785A473097DB4691464B0F23BF0DA3E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telemetry.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\Telemetry.dll
Size 1.1MB
SHA256 2b186888ef815e449f0a607807471eba21461ae4864c2940c73b358340b668ff
MD5 099f6717a463d93aa4dbea3ce4f9a33a
SHA1 21f0b0464cf60f9b79159b7a6cbabf89bfc75bbc
SHA512 bab773b86525aaa7980fd022dd4a953ad9853e1d3fa8e80a6e3357dd1db80aa3b4106f2d0a748563b60869f80f55080fc9fb7285bd0f51771fb086749b59098d
SSDEEP 12288:QXOj+QsEkGDiH9oTL+ufdOLPnAGXgF7oTx/BrSwczQCZZNDPXca:Bj+lEkXdoTWLPAKgFoTx/JzGrNLXT
TLSH
T1BC355B0563E47FB5E19BE0B9F6724503E5F2F4385322A2FF45DA59240E27AC04A35BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateRingSettings.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\UpdateRingSettings.dll
Size 777KB
SHA256 9222068a08a784161242e16836404ab5ca764ec21d761d7adda15b6e25f17e42
MD5 856280708f638f2ec688625d94077747
SHA1 a96e9982620ca94f4eded2870d256ca3658c4553
SHA512 378bd2f11286953350f838aff803eb60271abd9e4e429b426d1af1e1e3079d701ceab9913419f87b2e562f9e92c200f8e63d741a6d90bc262827c2445844b1aa
SSDEEP 12288:E22iFkbkFrxs7r5qSKE9blCisjz9O4oi3mQba4N1tEhfQu9YK5:EJ+kbkFrC38SK6UO4oi3mQba4N12acYO
TLSH
T1F7053B1EA6FC02A9E1B7D1B88EE34517E672BC155732DACF0291855E0F277E0893B721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nso-ZA.json

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\WebAssets\static\strings\nso-ZA.json
Size 74KB
SHA256 62c42d0d97e3aa0934a2c9b94d253387743860540563b3a4532096eea1396428
MD5 65eaeb6b5ba4951225745b5926e41605
SHA1 1fc6628bbec7479652461ce46875c2125fd4ed26
SHA512 d878260d28aefa5e83a3088ac1bb4a4e7fa71867f1e518c6f5dae07b09c3e0538f4294a7bfd5d07cddada110e3eba2b9f267d2e2c9eb734e9bd26f12b0ddd04b
SSDEEP 768:g+QANv67/Y6BWnmZrphs3p5ObqnDVy9q8nEpFVDur2KEfT7zxoO:gMz6BWnmZrDsZtnDy2fOO
TLSH
T12D73A52F8600097700D5A543BD5269A235114F2F6380345D2FEB721E339EEAB72F766E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_atomic_wait.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\msvcp140_atomic_wait.dll
Size 37KB
SHA256 667b6cd4bd6760c4ec8ea8b860ade274bf1448c4d9c502ed3d6b8f4f6bb6a930
MD5 35c5bb1a995f650deb0083a43ebd0cee
SHA1 3cf059d42e43410161c08b581c2c7f8c11299c5b
SHA512 eaf167540338d6da7a1f2c21361bc9601f19939b764ea7dfc3d22d369a4c67d5f6479a17b879a341d18596ec50dbd29a4794afee4b87927bc699df8559a41247
SSDEEP 768:dPMo5RIqKYwIYPhpLSQl4wFhGbHQDZ9zZ4h:COR+lPhQQl4wTGsD7zZw
TLSH
T178039D46A7780082F5AB8735C496A60BE676B7E14750CBDF0361F54D0FA3BD1BA34B08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

localizable.json

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\nso-ZA\localizable.json
Size 4B
SHA256 e3566b3a06430868d71e9287dfd6c6c520a3da027aabea01951d407ee131dc2f
MD5 c443b04d0fc26b0a5a4573a78e0082a1
SHA1 3c957535345645dce7190b85eb10b39da96b2518
SHA512 7bbf6dac485c9e59d02edabc91ff5b15bc1319cef6905c0077ee16e3b1f572b61bff85f2400bc0f5b4aeab0260bd5d68787d72c7a688d79192952f7957a44de3
MD5 SHA1 SHA512

Submit Download

od4-localizable.json

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\nso-ZA\od4-localizable.json
Size 179KB
SHA256 ad8093883c02f6cc218bef464ae500cc44490212511884336964c8d67fca7365
MD5 ee62f84aacdfd1c172e3b948f16ab356
SHA1 14683dde72e5fae1cd63d5e37b9b3fc05a6fc45a
SHA512 9914a5ba0031a7eef00d163e157bfbf52472fbd00ca2fa564231e192e8d3cc38289a7ccac858b339e072a7819fab5986cac1ab62d4f678017cc6ddb2b3c39756
SSDEEP 1536:fmsUN+1P0I4NkZ8mDo8EL/BX000pvjWLXVZJ9kxlu3v:+F6Z8mHEL/BXsYYE
TLSH
T12D04917BA1808B7304316253BD4D19E277120B5F42B28D9F34BF614D9286E6BB3A77E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\vcruntime140.dll
Size 110KB
SHA256 8dcbe5b815686c9b935520637b0004e947f4c4973cff3d6794586336da8a53f6
MD5 c1f94de5fe621a8c091996b6a7ab822e
SHA1 5a323db12714fb2f565f94e9dba11566d7322179
SHA512 46ed4b038c7fa511cbeec5bd943c6ca1a723b18ea0612c931e7c970d73f1fd6c32fce894a1b1eabbf8552a2fd1aa395519a9534b4493723afb739ed575d33309
SSDEEP 1536:s9pCUgtBAVcxStMXcfG8VwfmpcGLOI5EvMvecbeQ6N7vpl91z9:MyA+3EOfmpcGSL8ecbeQ6NTpP1x
TLSH
T128B3690272B802FBD16ED278C1929E67E7B6B40587609BDF07EA46660F63BE05D3D341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\26.198.1011.0006\vcruntime140_1.dll
Size 36KB
SHA256 9655189cb8c29159875a55beabbd4b3bec1982003f9a4d09640119414c2c3eca
MD5 c36d9594f44593cb20362a39783a50f5
SHA1 2c9ce5a96393edd644b681d09da55050a43821aa
SHA512 5f90e2b44597c5196d83739ff5a87144b9b3b3707eed524770b9d74c97d079a69dffcc023c378456866f04b479ca379b40f5b888d952d0bf83315ab2cdb68f43
SSDEEP 768:YezSkbhNfI4fWLZySXdPWD/0bHycTrjZ9zV/:TYZyqPWD/0GQzt
TLSH
T13EF26C4293B85096E8AB8AB0C4975F17FE39F69157A093CB1FE4960C1E937D0933D326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Media.db

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Business1\settings\Microsoft.Media.db
Size 300KB
SHA256 b212811a023eb1294cfd73d1afd563820d6570d647fed9ca7eaab96845f12e01
MD5 bf0d33111b1ffe441c5fd0ec8c0dd6ef
SHA1 e8abc87602a957744482f15c25ccfd4ee6fa58d5
SHA512 7db01d9c8858fd60a6d87edd9f72d43de1e344d7f8aeecc6fe0a49be1a6c716d374bd9b31810dc12767a84caeb618710c7d789cea88f262bfd5f746582d3a1d2
SSDEEP 768:qpxPbQowWO3YrpEPbgdENy/d8uVu5AIUxwBVxw:qpxPboOpEPbAENyV8uVuNqo
TLSH
T19F64851BEB48AE32D2D771369CF60553A7191C4F4EA26EA17EEC01C81F4685C9038F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.CommonMediaCache.db

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.CommonMediaCache.db
Size 68KB
SHA256 aad240efb95de0559fd3c4336a30c212b11e154d91ff4e7d939ea3e3654b1bae
MD5 9691773f85477eafc4bc2d1f1e0e62a3
SHA1 0cf8e2a2f0c28662e5d24a81e4885b739da0b7db
SHA512 4f4c43c6d17ad49512e156f7adfcb54db58b3c5f5790cdb46cb8a40aa3c0d29a3fc98f016ff63183b3153c255e9fb29fd65d7114e8e19591875bd227005fe16a
SSDEEP 96:v8tsm8npn1rZPnTgSn9l2ggJoXBfOlC8:vxN7Bz
TLSH
T14D632DCB0993AB20CD8C7274C7A32510AB39068FCBD27972BE7380A55F4851C64F9DA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.ListSync.Thumbnails.db

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.ListSync.Thumbnails.db
Size 832KB
SHA256 9c44c9ef6471f38c66c6a0970c8b41357bf1e5cc75b70d4883fc7cb19936520b
MD5 a61344bb0404c465c0a2d00292c14efa
SHA1 5852eee1a651a9a27d35a83df6a3af5e912940b2
SHA512 bb0632841f57c8c0719c51db1fad311d358089ac0c502a6aa768a112f4d68c52efd52e068daf5bf15f6a81ad0cdd736cce72d149d927ddd27cd94bbd80bd6722
SSDEEP 96:Dq7Am5non0gw+qn6n20nunoeQncf1n7xRLvUHRfOJJnGnGnnWnOa4Arzo3CnzEdN:yfBvIsdJ
TLSH
T13905EC8D2E106B01C0A25170DDD35A1A7B39A76F0612AD9A3DBC1071CF6939CF8B17E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.ListSync.Thumbnails.db

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.ListSync.Thumbnails.db
Size 832KB
SHA256 dddf48378f0c60f4c82273dff7388198355025bffb5c1c9b3193637b9d535740
MD5 726ceb029ae813496c40a62df8560c9f
SHA1 71e5b4d93b1c5e03f98fa0d80e4f1d63aef4a6b6
SHA512 99151b81176423bc73e219c11a141ffd959d243f069185ae128a4c56cbfca39aa34e4ed4d6cf5f9bf81f55b1e650d6a75271e22e474afc0ccbc63fa2f0aa72ac
SSDEEP 96:Da7Am5non0gw+qn6n20nunoeQncf1n7xRLvUHRfOJJnGnGnnWnOa4Arzo3CnzEdN:CfBvIsdJ
TLSH
T1BF05ED8D2E106B00C0A25070DDD35A1A7B39A76F0612AD9A3DBC1071CF6939CF8B17E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.ListSync.Thumbnails.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.ListSync.Thumbnails.db-wal
Size 64KB
SHA256 c63f50f1f463c64e439c19d80b2854c3c91de371d33469532438cddaf345b2ba
MD5 a401b3febb3d00dc99caeb97f28e9d8f
SHA1 f5427ab6209adb547e2d74c257f63375b056a4cb
SHA512 7ad1459d7bec3284bf11d533b3a07dbf996ddb32d67be37d1801832ad6d5dba2147472123f70aea4e85d198bfcbfb1656d56e8ee31178798adb25bde7c0c845f
SSDEEP 6:K8ekZEeka+jmt2Q4d+U5net5l+j+GQ4d+n:K8euEefImJKnMl+un
TLSH
T1C753A735CF058416D81118753B0227B19F1D802081566805C1702D2263091A6CA85646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.LocalContent.db

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.LocalContent.db
Size 376KB
SHA256 c04d00cdcd798acd5df836d464227f8091a2aaaa37643e3aa6013027af4b8cac
MD5 b98e082282e36cf7ce61a07b250ce482
SHA1 d9bba6a5a67269af1877f294ae4b78c387e9bb7b
SHA512 1fe9ee0b79f413a9bf682fcf833369b8c499c52f176612f6a2cac4bfbad0ca78c45bd491659dec85da9a4c086ad2ea9c93c643b585c8d8f75dae7ef4b88b8f44
SSDEEP 1536:0NFa61DkECvdMiQsIyBOrUB6hqkvVf3Oo9OORO61u1kCVCaGWeayrpkbetvdBXVk:0NFa6alH60c2Hwi
TLSH
T1178442A93641F33AE9D973B1ACE2C4913232B11F4EA1DA0078DD15449F476CE9E7E6C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.LocalContent.db

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.LocalContent.db
Size 376KB
SHA256 0abd6c158b96a5fc7eeca6dc64b05718cb4792b11ce57f82eaa86e050a1e46b8
MD5 021ac51313b8244d3d5c082fb1a0fffe
SHA1 48520ef5ed64d4f4b8521b8a8c44c214d19bc8b7
SHA512 f604a8ce8fa36ceb29d0037bc81da7bc368418e4cfc0c7c140eb6e83a130422cdd6b2f26c03413576767b53b8ee9f12cce795dc0086fa55b10d33843c7ae0201
SSDEEP 1536:9NFa61DkECvdMiQsIyBOrUB6hqkvVf3Oo9OORO61u1kCVCaGWeayrpkbetvdBXVk:9NFa6alH60c2Hwi
TLSH
T1018442A93641F33AE9D973B1ACE2C4913132B11F4EA1DA0078DD15449F476CE9E7E6C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.LocalContent.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\Common\settings\Microsoft.LocalContent.db-wal
Size 36KB
SHA256 bee4e48530d7544858af566c57bc991c0ed0915dd59cae7448e2c690df786cb1
MD5 cbd2f392aa7aaaad4f1abdb80268c81d
SHA1 c812109494da95116ff7a31a7a2fb6164e18433f
SHA512 5847b44777df5070f1233b21742210e38ed0173f5f5cb1f29571706e87827243af967ca5f9e4e0eae35ad2c0d075c515464012f6aa9c84c6eacaf882a89ccad8
SSDEEP 12:K6u4nZEokdVnjSdarhePo/dQ9rUQV2lAlz:K6u4OokdVnjSdarhClrJflz
TLSH
T1D3F24F93CC34BEF2C84D343EA42671BDE66163BDB28E44B6B1C2A66411B8900156F14D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.ListSync.Settings.db

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ListSync\UnAuthenticated\settings\Microsoft.ListSync.Settings.db
Size 16KB
SHA256 7b5b9e3a35252d0ce1b3e8e7aff5d102304cd42a935e7c8108322ebe1a3ec49c
MD5 8a0d603964c190d9d2420c819e117802
SHA1 724d3517057e22bd694f3a5e9559e8d2ea18baf8
SHA512 5ea7967160788549fc16a3879c16096a0d4b1be5a40587148c1aac8024c8143c3696b7a85febbaabf82cf90e00c1a1b1784fca181aa0ab3447b768ed8f1eda36
SSDEEP 12:T4lbLwMGdymz3biyyZO22abBX1ty+Sddblq:ThpRSL2osrlq
TLSH
T1C27259A3960488BBC12603BDD4A243051731024E7321C6F3B87D010BAF42AC85D372FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveSmallTile.contrast-black_scale-100.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png
Size 563B
SHA256 5b9b49b6af48eb7551c3dd2a62a6a49ae6740b2b49010bb5b006cf85b4e54f44
MD5 5b30085b5e50938bf98cb35640fb1c6f
SHA1 a6f4ddb0368b532341e5046a1bbe0a4007f3f393
SHA512 b75226fa58382975a52e556de1ed34e84a834d47a9048d1e6f4855702730a9ee78cf3d05b9e8f90ea18b81a57ab1763b15649d92da36626f5a803fa509f2412a
TLSH
T19CF096F002035D1CCF9FC2B71AFF53D7B25D52C400212C0C34923039982C0CAB10A550
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.contrast-black_scale-125.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png
Size 874B
SHA256 37a6ca2212efeb34d8905ea08c81bd6f4cf884e4d009c245927618dd61e50537
MD5 40060690ed4e89bfaa4cdf6b62bf10c1
SHA1 8a501642ae3ca2fca8b5a9fbeb09642faf64d920
SHA512 b1bcf0ad4c5db86479c6933fdc877df6291908677d1fff58c07d09b3afdc762f1ec42e34f5f3fffb2b42cdd79204a702d5abf97f9373b8a5f55c3f99283b621e
TLSH
T1D71186F39E6CF34DE96E68B7A486C095BBBD5B1761140105C8622E3D9051CCDCC42E6C
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.contrast-black_scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png
Size 962B
SHA256 c191a3138fdc51ccc4eaf8979f44fc4cff3ab96593e21371845cd7967971efbc
MD5 b5c1fe27b4496370dd116258600d79d3
SHA1 a0e4573c1e8dd3b9c711e2ef60ce8fb90c2c51b0
SHA512 4b649ca9557a66a1e2a859b7ef2eaca770004d5f2a030228c1579339dbaac7c23b23537c0dae04b2c7736c6a1f7bcb0b4ccaaa2e83ed2ad3c3e4bf2b73d6f446
TLSH
T1201184CDDB06B8D5C1059F7A50232DB2F1270F9D2F479AA37BC608005B6989996B1E24
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.contrast-black_scale-200.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png
Size 1KB
SHA256 ee2b6b8103ac0dd5ad593e6b5106df0e8e5f1459682cfc6349d803c5802c2dd7
MD5 94f7df106a5a9d491c28101f5b729e70
SHA1 0ae47dbafacff9b6fd0119cb30d5d32236894bef
SHA512 2922593a29f11675d4d3ee0d78ca3e5fea92b8a151090afef293f2139f39c8fffe0a585f83ccf7a5800ff5cfabcefe834e4ead37b511746c52a729544e59c170
TLSH
T16A211A9BBC583EB0C57EDFB60B99FC7103030AC4018868880D0BB4AA1272426AB43701
MD5 SHA1 SHA512 TLSH

Submit Download

OneDriveSmallTile.contrast-black_scale-400.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png
Size 2KB
SHA256 82d5e6a7643d34d618c7fd2cd38c63a360230a72211619c2ca8d70514b6eff6b
MD5 70bd5f9c5c78011d2a39d358911909e3
SHA1 ec4da9b9eac67be2483558114fb768b68f6b1a08
SHA512 015aeb96f0e8e09208d71e35fe2ff487ab5c583d0d9810012a3380b88eab1a549faa63b5a14cdc1397caa63a72edf3bdcad78b1db5594f3e293011d37b1ddfb8
TLSH
T122512CDC5D2321F6ECE188B8842EBD40BE5358F48E271401A4819832D579E51DF95C07
MD5 SHA1 SHA512 TLSH

Submit Download

PhotosSquare150x150Logo.scale-150.png

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\PhotosSquare150x150Logo.scale-150.png
Size 46KB
SHA256 997e35af34bbb97f0a55cd8f9d0f8a1a11016f9f145e54b4b4c5b98201620f93
MD5 38f7db353cc68a436784fa0e8adacd3a
SHA1 0a6c70874ec65b425beb97e054ce355f3b654fd7
SHA512 515ca46114c4c4dc855ea87127a0e92aa1ded19c7c82293fd53348225787cb1c5156adfb5257cc0a01fb11950d587041122e7b0dda09c6072b622724502e8446
SSDEEP 768:mfdB1q4mlTY0mhiwuWqsrJy2uJXM3cxJ5hNdixma/p1BKcCJLrhQGVfdf68:mlG4mlSPuuJy2udQqta/pKVjV1C8
TLSH
T11823029FF0D4B4BF06466B3DA521A4AE2407DC2D0268C5F8BBF5A33D5BE83B5A044D50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ECSConfig.json

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\ECSConfig.json
Size 5KB
SHA256 99cde3d79c06b40e60591ab679b480b43beefcc53ea02aa705fa4216c79c7333
MD5 f4ff82033ba434464375a4d5af8ccd1c
SHA1 7a9b4225ec646c12108314ac65e2f8af90655032
SHA512 faabeffeae3a729d34022c40588350c0d4bd0f37bf46e2075291e35a083fb220683ff96470e2b3ecf44d2d492a72cf2fcfd8344a4df25c2a906c27c84c92177e
SSDEEP 96:egTska3KCanXTcOgd0DbryA/LWrS/9NMDZM5h96l4mQcB8i:egCa4MEDP4mQcBf
TLSH
T118C1A6D83AA846F6E592C1094F6EFF583CFF147754AA5968B4EC02083079BA7634385B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PreSignInSettingsConfig.json

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\PreSignInSettingsConfig.json
Size 103KB
SHA256 8d94b7cd57072d21b6d50ce9034a4cc325689ced87606a9933129e81649d79da
MD5 0d66cf97940ce1b933855fcd88e66a18
SHA1 5c7b8692fbe17eae9b230dc091926bb6404f089b
SHA512 09ec885bd8df93c1a28f85e1d150004b9ab4a5bdf8f3d0e5e0effdca8bdf7db0bbee533d9f886961602ef350f5a456b7e4e431403a972215b85dae52db701090
SSDEEP 768:WEeIBl+UaPNGZwXJnXU9mLzo922ma++8JDcE4rRXyhUPGNbqLxStzJ8RW/E/+5wc:Wh9zJnXUQYAOEgPGns8vco4EdFkAR
TLSH
T1D5A3EA4E2008B7AFE316AD5A7D6B69861C21746E3852CFCEE0CDC26C6E44DC4734A5B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Update.xml

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\Update.xml
Size 1KB
SHA256 68707e0c49ec3b52a0e4ae0c5fcf6942cc450e928949048689959804b9e481f9
MD5 79cd1c3a396036abce3e6a1ba279b88b
SHA1 a3a0780e67263bd87747f71432cd7192e2604d1e
SHA512 42c0f1d46dd0015480198bc69aec64ab9e11103edea12cec16271ffc60af69b769b63a6c5fe52d23735c49d065d5fda523309fc54f7978d78c24407020d51029
TLSH
T1703124C320D0F7734B54D5EC8346E9ADE3317AAF5D29241979A3006B3F5A2C8A10B0AF
MD5 SHA1 SHA512 TLSH

Submit Download

telemetry-dll-ramp-value.txt

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\telemetry-dll-ramp-value.txt
Size 12B
SHA256 291644a1204c9b0e460c04ff50292382476ad19a9296c12ced5768f9fa76eadd
MD5 938803969367c4063aba4ff7460ab4a7
SHA1 91ca0fe11d6910f01e157d48da36e24fa41418e5
SHA512 76b8566410a839167fe5c2e0626828b0549ea2ff8849a3bae1dfccc947fbc63811b273d07c4c48c215061949ac4a28385cdeb566d587940205170b25fd33f073
MD5 SHA1 SHA512

Submit Download

OD4UpdateRingSettingsCompactCache.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\OD4UpdateRingSettingsCompactCache.txt.tmp
Size 10KB
SHA256 2db147f2acb0fde2f605edb5ef956dfd7887009939c0008f044e84496c0b0b3d
MD5 8c7514fb460479f417903ec1f9f7a79a
SHA1 23daa758692848205bf1d71b19ec2a77e2aeba3b
SHA512 5b0253ddad8270d618af5cfd31627a6d160493e2205a2a2159be2c60d9b33867e9f7ee6eeb5d6f763845fbbd14a0acfc29a9ed8618c6d8bbb7e07d8841697b7d
SSDEEP 192:F92mTxTnzx4EY5QtlN1Mk4cB/PgF/XcdDthSI9T6pc6s235OL92mTxTnzx4EHF:F92m9Tzx4rQVbdhipm23o92m9Tzx4OF
TLSH
T1112240F09CF5DBE5EBE68C4DF0DE363746B48C334BA6815347A360868C37619C05A8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wct154F.tmp

Path C:\Users\Admin\AppData\Local\Temp\wct154F.tmp
Size 5KB
SHA256 ce633275246a513d4e9d5190921ee987ade8e49e1b28ad19d537a2d37510e889
MD5 c203325f107cd0b7a2bbd2405c1f3e3f
SHA1 0fb7e35004517519976b0d50a638e29c4f400111
SHA512 0caf59ba9cb353602f49c5c9223f11bb486379e241578bfc0a84fd9c68747f61f052d0dbc7cd1f83c09f6840c1c2577ddac2da4c89ba7b1f79fb9fb45b90602c
SSDEEP 96:egTskQ3KCanXTcOgd0DbVxyA/LWlK/9NzuDZM5h96l4mQcB8i:egoa4MFuDP4mQcBf
TLSH
T179C1C7D83AA855F6E592C1094F6AFF183CFF147754AB5968B4EC02083079BA7634385B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wctF1D8.tmp

Path C:\Users\Admin\AppData\Local\Temp\wctF1D8.tmp
Size 5KB
SHA256 12a4c816f8679a3f1d80e4b08a463969abf977d05357464bd01543deed7aaa3c
MD5 ce2861883a42df95262dc6ec755f4b37
SHA1 b1f5a7ef8f9a00f5d97a07d1db9166091f21ff39
SHA512 1337c0fdac4967c1f9edb47dfb06273986920ed0223e1174405ed88e6ff199bd83838d61be73b6cf56d8ae852ee6cbf4b42af028cdbbdcbea9a90ab9c171a4fd
SSDEEP 96:egTskQ3KCanXTcOgd0DbVxyA/LWlk/9NzuDZM5h96l4mQcB8i:egoa4MXuDP4mQcBf
TLSH
T116C1C7D83AA855F6E592C1094F6AFF183CFF147754AB5968B4EC02083078BA7634385B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\OneDrive\desktop.ini
Size 96B
SHA256 f625a1050e8ba6df4de974c2acc572e1e637a3429bf2ee1449c552999a6c7268
MD5 2b98cc2afc1d0907c7066453643faac3
SHA1 864b3477bba5fb913b0e017f7bc087c3c6af95c4
SHA512 9e2eecf1715378f44539cc79c718bcfd9181728e9f2330e34d228badd482ce48a8b916275a0d063dfbcdcadcde25be82c43fea44aea0393ecf3385095550c6e2
TLSH
T19EB01221804AC925D05AD00F1452490490A50C0F9E09BF049300C40405C5F8CFCC92C7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5268-3885-0x000001A8FA5D0000-0x000001A8FAC13000-memory.dmp

Download