Overview

overview

7

Static

static

1

script.vbs

windows7-x64

1

script.vbs

windows10-2004-x64

7

Analysis

  • max time kernel
    560s
  • max time network
    503s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-07-2024 13:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    script.vbs

  • Size

    1KB

  • MD5

    45c4cc84643d2187b897af10ef28c00d

  • SHA1

    0ce82132d7311a18f1473c32164258757125aa52

  • SHA256

    b1c8beebe331d458d9c2e57d2f198c0943398abe5fa18f264ef80a4861557c57

  • SHA512

    f5551f72134262851aac9eebb0340b2200c6eef7db05538c67051a79c8814f79092ff809292215e6d86f0b09a273a35f76150155181e216f55a98579de815f04

Score
7/10
microsoftdiscoverypersistencephishingprivilege_escalation

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 39 IoCs
  • Modifies system executable filetype association 2 TTPs 7 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 6 IoCs

    System information is often read in order to detect sandboxing environments.

  • Detected potential entity reuse from brand microsoft.
    phishingmicrosoft
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 38 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
    1⤵
      PID:4052
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\WaitDismount.vbs"
      1⤵
        PID:3404
      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
        "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
        1⤵
        • Modifies system executable filetype association
        • Checks processor information in registry
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2912
        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
          "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart
          2⤵
          • Executes dropped EXE
          • Checks system information in the registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1032
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
            C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Checks system information in the registry
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4856
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
              "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies registry class
              PID:1928
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
              /updateInstalled /background
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies system executable filetype association
              • Checks system information in the registry
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:4928
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:3200
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\DebugStop.vbs"
          1⤵
            PID:860
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k UnistackSvcGroup
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1928
          • C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe
            "C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe" -ServerName:App.AppX20qnn98vxw5bhxrjtb1f6rggecb2k15a.mca
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:1388
          • C:\Windows\system32\wwahost.exe
            "C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
            1⤵
            • Checks SCSI registry key(s)
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2780
          • C:\Windows\system32\AUDIODG.EXE
            C:\Windows\system32\AUDIODG.EXE 0x2f8 0x30c
            1⤵
              PID:3228

            Network

            MITRE ATT&CK Matrix ATT&CK v13

            Initial Access

            Execution

            Persistence

            Event Triggered Execution

            2
            T1546

            Change Default File Association

            1
            T1546.001

            Component Object Model Hijacking

            1
            T1546.015

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Privilege Escalation

            Event Triggered Execution

            2
            T1546

            Change Default File Association

            1
            T1546.001

            Component Object Model Hijacking

            1
            T1546.015

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Defense Evasion

            Modify Registry

            3
            T1112

            Credential Access

            Discovery

            Query Registry

            5
            T1012

            System Information Discovery

            5
            T1082

            Peripheral Device Discovery

            1
            T1120

            Lateral Movement

            Collection

            Exfiltration

            Command and Control

            Impact

            Resource Development

            Reconnaissance

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
              Filesize

              553KB

              MD5

              57bd9bd545af2b0f2ce14a33ca57ece9

              SHA1

              15b4b5afff9abba2de64cbd4f0989f1b2fbc4bf1

              SHA256

              a3a4b648e4dcf3a4e5f7d13cc3d21b0353e496da75f83246cc8a15fada463bdf

              SHA512

              d134f9881312ddbd0d61f39fd62af5443a4947d3de010fef3b0f6ebf17829bd4c2f13f6299d2a7aad35c868bb451ef6991c5093c2809e6be791f05f137324b39

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-125.png
              Filesize

              1KB

              MD5

              b83ac69831fd735d5f3811cc214c7c43

              SHA1

              5b549067fdd64dcb425b88fabe1b1ca46a9a8124

              SHA256

              cbdcf248f8a0fcd583b475562a7cdcb58f8d01236c7d06e4cdbfe28e08b2a185

              SHA512

              4b2ee6b3987c048ab7cc827879b38fb3c216dab8e794239d189d1ba71122a74fdaa90336e2ea33abd06ba04f37ded967eb98fd742a02463b6eb68ab917155600

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-150.png
              Filesize

              2KB

              MD5

              771bc7583fe704745a763cd3f46d75d2

              SHA1

              e38f9d7466eefc6d3d2aaa327f1bd42c5a5c7752

              SHA256

              36a6aad9a9947ab3f6ac6af900192f5a55870d798bca70c46770ccf2108fd62d

              SHA512

              959ea603abec708895b7f4ef0639c3f2d270cfdd38d77ac9bab8289918cbd4dbac3c36c11bb52c6f01b0adae597b647bb784bba513d77875979270f4962b7884

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-200.png
              Filesize

              2KB

              MD5

              09773d7bb374aeec469367708fcfe442

              SHA1

              2bfb6905321c0c1fd35e1b1161d2a7663e5203d6

              SHA256

              67d1bb54fcb19c174de1936d08b5dbdb31b98cfdd280bcc5122fb0693675e4f2

              SHA512

              f500ea4a87a24437b60b0dc3ec69fcc5edbc39c2967743ddb41093b824d0845ffddd2df420a12e17e4594df39f63adad5abb69a29f8456fed03045a6b42388bc

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-400.png
              Filesize

              6KB

              MD5

              e01cdbbd97eebc41c63a280f65db28e9

              SHA1

              1c2657880dd1ea10caf86bd08312cd832a967be1

              SHA256

              5cb8fd670585de8a7fc0ceede164847522d287ef17cd48806831ea18a0ceac1f

              SHA512

              ffd928e289dc0e36fa406f0416fb07c2eb0f3725a9cdbb27225439d75b8582d68705ec508e3c4af1fc4982d06d70ef868cafbfc73a637724dee7f34828d14850

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-100.png
              Filesize

              2KB

              MD5

              19876b66df75a2c358c37be528f76991

              SHA1

              181cab3db89f416f343bae9699bf868920240c8b

              SHA256

              a024fc5dbe0973fd9267229da4ebfd8fc41d73ca27a2055715aafe0efb4f3425

              SHA512

              78610a040bbbb026a165a5a50dfbaf4208ebef7407660eea1a20e95c30d0d42ef1d13f647802a2f0638443ae2253c49945ebe018c3499ddbf00cfdb1db42ced1

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-125.png
              Filesize

              3KB

              MD5

              8347d6f79f819fcf91e0c9d3791d6861

              SHA1

              5591cf408f0adaa3b86a5a30b0112863ec3d6d28

              SHA256

              e8b30bfcee8041f1a70e61ca46764416fd1df2e6086ba4c280bfa2220c226750

              SHA512

              9f658bc77131f4ac4f730ed56a44a406e09a3ceec215b7a0b2ed42d019d8b13d89ab117affb547a5107b5a84feb330329dc15e14644f2b52122acb063f2ba550

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-150.png
              Filesize

              3KB

              MD5

              de5ba8348a73164c66750f70f4b59663

              SHA1

              1d7a04b74bd36ecac2f5dae6921465fc27812fec

              SHA256

              a0bbe33b798c3adac36396e877908874cffaadb240244095c68dff840dcbbf73

              SHA512

              85197e0b13a1ae48f51660525557cceaeed7d893dd081939f62e6e8921bb036c6501d3bb41250649048a286ff6bac6c9c1a426d2f58f3e3b41521db26ef6a17c

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-200.png
              Filesize

              4KB

              MD5

              f1c75409c9a1b823e846cc746903e12c

              SHA1

              f0e1f0cf35369544d88d8a2785570f55f6024779

              SHA256

              fba9104432cbb8ebbd45c18ef1ba46a45dd374773e5aa37d411bb023ded8efd6

              SHA512

              ed72eb547e0c03776f32e07191ce7022d08d4bcc66e7abca4772cdd8c22d8e7a423577805a4925c5e804ed6c15395f3df8aac7af62f1129e4982685d7e46bd85

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-400.png
              Filesize

              8KB

              MD5

              adbbeb01272c8d8b14977481108400d6

              SHA1

              1cc6868eec36764b249de193f0ce44787ba9dd45

              SHA256

              9250ef25efc2a9765cf1126524256fdfc963c8687edfdc4a2ecde50d748ada85

              SHA512

              c15951cf2dc076ed508665cd7dac2251c8966c1550b78549b926e98c01899ad825535001bd65eeb2f8680cd6753cd47e95606ecf453919f5827ed12bca062887

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-100.png
              Filesize

              2KB

              MD5

              57a6876000151c4303f99e9a05ab4265

              SHA1

              1a63d3dd2b8bdc0061660d4add5a5b9af0ff0794

              SHA256

              8acbdd41252595b7410ca2ed438d6d8ede10bd17fe3a18705eedc65f46e4c1c4

              SHA512

              c6a2a9124bc6bcf70d2977aaca7e3060380a4d9428a624cc6e5624c75ebb6d6993c6186651d4e54edf32f3491d413714ef97a4cdc42bae94045cd804f0ad7cba

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-125.png
              Filesize

              4KB

              MD5

              d03b7edafe4cb7889418f28af439c9c1

              SHA1

              16822a2ab6a15dda520f28472f6eeddb27f81178

              SHA256

              a5294e3c7cd855815f8d916849d87bd2357f5165eb4372f248fdf8b988601665

              SHA512

              59d99f0b9a7813b28bae3ea1ae5bdbbf0d87d32ff621ff20cbe1b900c52bb480c722dd428578dea5d5351cc36f1fa56b2c1712f2724344f026fe534232812962

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-150.png
              Filesize

              5KB

              MD5

              a23c55ae34e1b8d81aa34514ea792540

              SHA1

              3b539dfb299d00b93525144fd2afd7dd9ba4ccbf

              SHA256

              3df4590386671e0d6fee7108e457eb805370a189f5fdfeaf2f2c32d5adc76abd

              SHA512

              1423a2534ae71174f34ee527fe3a0db38480a869cac50b08b60a2140b5587b3944967a95016f0b00e3ca9ced1f1452c613bb76c34d7ebd386290667084bce77d

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-200.png
              Filesize

              6KB

              MD5

              13e6baac125114e87f50c21017b9e010

              SHA1

              561c84f767537d71c901a23a061213cf03b27a58

              SHA256

              3384357b6110f418b175e2f0910cffe588c847c8e55f2fe3572d82999a62c18e

              SHA512

              673c3bec7c2cd99c07ebfca0f4ab14cd6341086c8702fe9e8b5028aed0174398d7c8a94583da40c32cd0934d784062ad6db71f49391f64122459f8bb00222e08

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-400.png
              Filesize

              15KB

              MD5

              e593676ee86a6183082112df974a4706

              SHA1

              c4e91440312dea1f89777c2856cb11e45d95fe55

              SHA256

              deb0ec0ee8f1c4f7ea4de2c28ff85087ee5ff8c7e3036c3b0a66d84bae32b6bb

              SHA512

              11d7ed45f461f44fa566449bb50bcfce35f73fc775744c2d45ea80aeb364fe40a68a731a2152f10edc059dea16b8bab9c9a47da0c9ffe3d954f57da0ff714681

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png
              Filesize

              783B

              MD5

              f4e9f958ed6436aef6d16ee6868fa657

              SHA1

              b14bc7aaca388f29570825010ebc17ca577b292f

              SHA256

              292cac291af7b45f12404f968759afc7145b2189e778b14d681449132b14f06b

              SHA512

              cd5d78317e82127e9a62366fd33d5420a6f25d0a6e55552335e64dc39932238abd707fe75d4f62472bc28a388d32b70ff08b6aa366c092a7ace3367896a2bd98

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png
              Filesize

              1018B

              MD5

              2c7a9e323a69409f4b13b1c3244074c4

              SHA1

              3c77c1b013691fa3bdff5677c3a31b355d3e2205

              SHA256

              8efeacefb92d64dfb1c4df2568165df6436777f176accfd24f4f7970605d16c2

              SHA512

              087c12e225c1d791d7ad0bf7d3544b4bed8c4fb0daaa02aee0e379badae8954fe6120d61fdf1a11007cbcdb238b5a02c54f429b6cc692a145aa8fbd220c0cb2d

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png
              Filesize

              1KB

              MD5

              552b0304f2e25a1283709ad56c4b1a85

              SHA1

              92a9d0d795852ec45beae1d08f8327d02de8994e

              SHA256

              262b9a30bb8db4fc59b5bc348aa3813c75e113066a087135d0946ad916f72535

              SHA512

              9559895b66ef533486f43274f7346ad3059c15f735c9ce5351adf1403c95c2b787372153d4827b03b6eb530f75efcf9ae89db1e9c69189e86d6383138ab9c839

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png
              Filesize

              1KB

              MD5

              22e17842b11cd1cb17b24aa743a74e67

              SHA1

              f230cb9e5a6cb027e6561fabf11a909aa3ba0207

              SHA256

              9833b80def72b73fca150af17d4b98c8cd484401f0e2d44320ecd75b5bb57c42

              SHA512

              8332fc72cd411f9d9fd65950d58bf6440563dc4bd5ce3622775306575802e20c967f0ee6bab2092769a11e2a4ea228dab91a02534beeb8afde8239dd2b90f23a

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png
              Filesize

              3KB

              MD5

              3c29933ab3beda6803c4b704fba48c53

              SHA1

              056fe7770a2ba171a54bd60b3c29c4fbb6d42f0c

              SHA256

              3a7ef7c0bda402fdaff19a479d6c18577c436a5f4e188da4c058a42ef09a7633

              SHA512

              09408a000a6fa8046649c61ccef36afa1046869506f019f739f67f5c1c05d2e313b95a60bd43d9be882688df1610ad7979dd9d1f16a2170959b526ebd89b8ef7

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-100.png
              Filesize

              1KB

              MD5

              1f156044d43913efd88cad6aa6474d73

              SHA1

              1f6bd3e15a4bdb052746cf9840bdc13e7e8eda26

              SHA256

              4e11167708801727891e8dd9257152b7391fc483d46688d61f44b96360f76816

              SHA512

              df791d7c1e7a580e589613b5a56ba529005162d3564fffd4c8514e6afaa5eccea9cea9e1ac43bd9d74ee3971b2e94d985b103176db592e3c775d5feec7aac6d1

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-125.png
              Filesize

              2KB

              MD5

              09f3f8485e79f57f0a34abd5a67898ca

              SHA1

              e68ae5685d5442c1b7acc567dc0b1939cad5f41a

              SHA256

              69e432d1eec44bed4aad35f72a912e1f0036a4b501a50aec401c9fa260a523e3

              SHA512

              0eafeaf735cedc322719049db6325ccbf5e92de229cace927b78a08317e842261b7adbda03ec192f71ee36e35eb9bf9624589de01beaec2c5597a605fc224130

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-150.png
              Filesize

              3KB

              MD5

              ed306d8b1c42995188866a80d6b761de

              SHA1

              eadc119bec9fad65019909e8229584cd6b7e0a2b

              SHA256

              7e3f35d5eb05435be8d104a2eacf5bace8301853104a4ea4768601c607ddf301

              SHA512

              972a42f7677d57fcb8c8cb0720b21a6ffe9303ea58dde276cfe2f26ee68fe4cc8ae6d29f3a21a400253de7c0a212edf29981e9e2bca49750b79dd439461c8335

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-200.png
              Filesize

              4KB

              MD5

              d9d00ecb4bb933cdbb0cd1b5d511dcf5

              SHA1

              4e41b1eda56c4ebe5534eb49e826289ebff99dd9

              SHA256

              85823f7a5a4ebf8274f790a88b981e92ede57bde0ba804f00b03416ee4feda89

              SHA512

              8b53dec59bba8b4033e5c6b2ff77f9ba6b929c412000184928978f13b475cd691a854fee7d55026e48eab8ac84cf34fc7cb38e3766bbf743cf07c4d59afb98f4

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-400.png
              Filesize

              11KB

              MD5

              096d0e769212718b8de5237b3427aacc

              SHA1

              4b912a0f2192f44824057832d9bb08c1a2c76e72

              SHA256

              9a0b901e97abe02036c782eb6a2471e18160b89fd5141a5a9909f0baab67b1ef

              SHA512

              99eb3d67e1a05ffa440e70b7e053b7d32e84326671b0b9d2fcfcea2633b8566155477b2a226521bf860b471c5926f8e1f8e3a52676cacb41b40e2b97cb3c1173

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDrive.VisualElementsManifest.xml
              Filesize

              344B

              MD5

              5ae2d05d894d1a55d9a1e4f593c68969

              SHA1

              a983584f58d68552e639601538af960a34fa1da7

              SHA256

              d21077ad0c29a4c939b8c25f1186e2b542d054bb787b1d3210e9cab48ec3080c

              SHA512

              152949f5b661980f33608a0804dd8c43d70e056ae0336e409006e764664496fef6e60daa09fecb8d74523d3e7928c0dbd5d8272d8be1cf276852d88370954adc

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDrive.exe
              Filesize

              2.3MB

              MD5

              c2938eb5ff932c2540a1514cc82c197c

              SHA1

              2d7da1c3bfa4755ba0efec5317260d239cbb51c3

              SHA256

              5d8273bf98397e4c5053f8f154e5f838c7e8a798b125fcad33cab16e2515b665

              SHA512

              5deb54462615e39cf7871418871856094031a383e9ad82d5a5993f1e67b7ade7c2217055b657c0d127189792c3bcf6c1fcfbd3c5606f6134adfafcccfa176441

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDriveStandaloneUpdater.exe
              Filesize

              2.9MB

              MD5

              9cdabfbf75fd35e615c9f85fedafce8a

              SHA1

              57b7fc9bf59cf09a9c19ad0ce0a159746554d682

              SHA256

              969fbb03015dd9f33baf45f2750e36b77003a7e18c3954fab890cddc94046673

              SHA512

              348923f497e615a5cd0ed428eb1e30a792dea310585645b721235d48f3f890398ad51d8955c1e483df0a712ba2c0a18ad99b977be64f5ee6768f955b12a4a236

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Resources.pri
              Filesize

              4KB

              MD5

              7473be9c7899f2a2da99d09c596b2d6d

              SHA1

              0f76063651fe45bbc0b5c0532ad87d7dc7dc53ac

              SHA256

              e1252527bc066da6838344d49660e4c6ff2d1ddfda036c5ec19b07fdfb90c8c3

              SHA512

              a4a5c97856e314eedbad38411f250d139a668c2256d917788697c8a009d5408d559772e0836713853704e6a3755601ae7ee433e07a34bd0e7f130a3e28729c45

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png
              Filesize

              1KB

              MD5

              72747c27b2f2a08700ece584c576af89

              SHA1

              5301ca4813cd5ff2f8457635bc3c8944c1fb9f33

              SHA256

              6f028542f6faeaaf1f564eab2605bedb20a2ee72cdd9930bde1a3539344d721b

              SHA512

              3e7f84d3483a25a52a036bf7fd87aac74ac5af327bb8e4695e39dada60c4d6607d1c04e7769a808be260db2af6e91b789008d276ccc6b7e13c80eb97e2818aba

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
              Filesize

              40.2MB

              MD5

              fb4aa59c92c9b3263eb07e07b91568b5

              SHA1

              6071a3e3c4338b90d892a8416b6a92fbfe25bb67

              SHA256

              e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9

              SHA512

              60aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini
              Filesize

              38B

              MD5

              cc04d6015cd4395c9b980b280254156e

              SHA1

              87b176f1330dc08d4ffabe3f7e77da4121c8e749

              SHA256

              884d272d16605590e511ae50c88842a8ce203a864f56061a3c554f8f8265866e

              SHA512

              d3cb7853b69649c673814d5738247b5fbaaae5bb7b84e4c7b3ff5c4f1b1a85fc7261a35f0282d79076a9c862e5e1021d31a318d8b2e5a74b80500cb222642940

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini
              Filesize

              108B

              MD5

              2558953aef58e5367221450273028920

              SHA1

              c903ef1ad05a97cc01e6088b504c65572b2b4c6b

              SHA256

              ba5c66a6b47946a9b4ee31253aa67c4d5fefaeb06a17e167404b6323cee6ecc7

              SHA512

              589af53bb98640afb14c566fd54df53447875985329daf017e5dfb333686afc1aae9421451f10c5329131746a9f61a5bde74c0b7166797a2f4b411651db1763d

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.json
              Filesize

              63KB

              MD5

              e516a60bc980095e8d156b1a99ab5eee

              SHA1

              238e243ffc12d4e012fd020c9822703109b987f6

              SHA256

              543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7

              SHA512

              9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.ini
              Filesize

              77B

              MD5

              972cc34bc5a63cab045135237834007a

              SHA1

              bd2db3d105d2da08ff2f30c335efb48853290d5a

              SHA256

              fc03c1ea864fb97d1f331718fc9e3f1d62ab234261739d0e894c963f94c81480

              SHA512

              49e4d616405167915af29696207b748d6849f8aaae10c1b4249f5b73fabc064bd45e479b6cedbf8c3b39705f07d0d5b41dd19d10da3937b00017f51ab13389a4

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\update100[1].xml
              Filesize

              726B

              MD5

              53244e542ddf6d280a2b03e28f0646b7

              SHA1

              d9925f810a95880c92974549deead18d56f19c37

              SHA256

              36a6bd38a8a6f5a75b73caffae5ae66dfabcaefd83da65b493fa881ea8a64e7d

              SHA512

              4aa71d92ea2c46df86565d97aac75395371d3e17877ab252a297b84dca2ab251d50aaffc62eab9961f0df48de6f12be04a1f4a2cbde75b9ae7bcce6eb5450c62

              Download Submit
            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\6H8F8GAS\login.live[1].xml
              Filesize

              13B

              MD5

              c1ddea3ef6bbef3e7060a1a9ad89e4c5

              SHA1

              35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

              SHA256

              b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

              SHA512

              6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\tmp722D.tmp
              Filesize

              35.9MB

              MD5

              5b16ef80abd2b4ace517c4e98f4ff551

              SHA1

              438806a0256e075239aa8bbec9ba3d3fb634af55

              SHA256

              bbc70091b3834af5413b9658b07269badd4cae8d96724bf1f7919f6aab595009

              SHA512

              69a22b063ab92ca7e941b826400c62be41ae0317143387c8aa8c727b5c9ee3528ddd4014de22a2a2e2cbae801cb041fe477d68d2684353cdf6c83d7ee97c43d4

              Download Submit
            • C:\Users\Admin\Desktop\DenyBlock.vbs
              Filesize

              1KB

              MD5

              45c4cc84643d2187b897af10ef28c00d

              SHA1

              0ce82132d7311a18f1473c32164258757125aa52

              SHA256

              b1c8beebe331d458d9c2e57d2f198c0943398abe5fa18f264ef80a4861557c57

              SHA512

              f5551f72134262851aac9eebb0340b2200c6eef7db05538c67051a79c8814f79092ff809292215e6d86f0b09a273a35f76150155181e216f55a98579de815f04

              Download Submit
            • memory/1928-55172-0x000001F12D940000-0x000001F12D950000-memory.dmp
              Filesize

              64KB

              Download
            • memory/1928-55156-0x000001F12D840000-0x000001F12D850000-memory.dmp
              Filesize

              64KB

              Download
            • memory/1928-55188-0x000001F135C60000-0x000001F135C61000-memory.dmp
              Filesize

              4KB

              Download
            • memory/1928-55190-0x000001F135C90000-0x000001F135C91000-memory.dmp
              Filesize

              4KB

              Download
            • memory/1928-55192-0x000001F135DA0000-0x000001F135DA1000-memory.dmp
              Filesize

              4KB

              Download
            • memory/1928-55191-0x000001F135C90000-0x000001F135C91000-memory.dmp
              Filesize

              4KB

              Download
            • memory/2780-55604-0x000001A746520000-0x000001A746620000-memory.dmp
              Filesize

              1024KB

              Download
            • memory/2780-55514-0x000001A720730000-0x000001A720750000-memory.dmp
              Filesize

              128KB

              Download
            • memory/2780-55487-0x000001A734CA0000-0x000001A734CC0000-memory.dmp
              Filesize

              128KB

              Download
            • memory/2780-55591-0x000001A746200000-0x000001A746300000-memory.dmp
              Filesize

              1024KB

              Download
            • memory/2780-55354-0x000001A720420000-0x000001A720440000-memory.dmp
              Filesize

              128KB

              Download
            • memory/2780-56037-0x000001A7470E0000-0x000001A7471E0000-memory.dmp
              Filesize

              1024KB

              Download
            • memory/2780-56049-0x000001A734200000-0x000001A734300000-memory.dmp
              Filesize

              1024KB

              Download
            • memory/2780-56123-0x000001A747450000-0x000001A747470000-memory.dmp
              Filesize

              128KB

              Download
            • memory/2780-56475-0x000001A753380000-0x000001A7533A0000-memory.dmp
              Filesize

              128KB

              Download
            • memory/2780-57331-0x000001A7536A0000-0x000001A7536C0000-memory.dmp
              Filesize

              128KB

              Download
            • memory/2780-57293-0x000001A747CF0000-0x000001A747DF0000-memory.dmp
              Filesize

              1024KB

              Download
            • memory/2780-57455-0x000001A7535A0000-0x000001A7535C0000-memory.dmp
              Filesize

              128KB

              Download