home

OneDriveSetup.exe

Windows Live

Microsoft Corporation

This is the uninstaller utility registered in the Windows Control Panel for the program Microsoft OneDrive by Microsoft Corporation. This is installed with Microsoft OneDrive. The file has been seen being downloaded from go.microsoft.com and multiple other hosts.
Publisher:
Microsoft Corporation  (signed and verified)

Product:
Windows Live

Description:
Microsoft OneDrive Setup

Version:
17.3.5907.0716

MD5:
a2346d388aa310c21ffb7f92fdf9ff8d

SHA-1:
9d587b6d4eb090ceabf0e3fdd0484d2abda03f34

SHA-256:
db427dfd5f965a5915088c630ef9bf507e709b4ae2601cd2ed5c223f846c7d6c

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
1/13/2025 3:56:06 PM UTC  (today)

File size:
7.5 MB (7,812,296 bytes)

Product version:
17.3.5907.0716

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
OneDriveSetup.exe

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\wctf460.tmp

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
6/4/2015 7:42:45 PM

Valid to:
9/4/2016 7:42:45 PM

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
330000010A2C79AED7797BA6AC00010000010A

File PE Metadata
Compilation timestamp:
7/16/2015 9:26:03 AM

OS version:
6.2

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.10

CTPH (ssdeep):
196608:/mV25FwaBvMqf1n+NTCZfPPJSLQl7E02y4WkUIAX:aQwuv11n+ZCZnPJ2QlIZypH

Entry address:
0x3C887

Entry point:
E8, C4, 37, 00, 00, E9, 75, FE, FF, FF, CC, CC, CC, CC, CC, E9, B4, 1C, 00, 00, CC, CC, CC, CC, CC, 55, 8B, EC, 83, EC, 10, EB, 0D, FF, 75, 08, E8, 10, 40, 00, 00, 59, 85, C0, 74, 11, FF, 75, 08, E8, 6C, 3F, 00, 00, 59, 85, C0, 74, E6, 8B, E5, 5D, C3, 6A, 01, 8D, 45, FC, C7, 45, FC, 68, 15, 40, 00, 50, 8D, 4D, F0, E8, 80, 25, 00, 00, 68, C4, 29, 4B, 00, 8D, 45, F0, C7, 45, F0, 60, 15, 40, 00, 50, E8, 6D, 06, 00, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 57, 56, 8B, 74, 24, 10, 8B...
 
[+]

Code size:
754.5 KB (772,608 bytes)

Program Uninstaller
Program name:
Microsoft OneDrive

Display publisher:
Microsoft Corporation

Display version:
17.3.5907.0716

Uninstall string:
C:\users\{user}\appdata\local\microsoft\onedrive\17.3.5907.0716\onedrivesetup.exe \uninstall


The file OneDriveSetup.exe has been discovered within the following program.

Microsoft OneDrive  by Microsoft Corporation
OneDrive is a file hosting service that allows users to upload and sync files to a cloud storage and then access them from a Web browser or their local device.
onedrive.live.com/about/en-us
6% remove it
 
Powered by Should I Remove It?

The file OneDriveSetup.exe has been seen being distributed by the following 26 URLs.

http://go.microsoft.com/.../?LinkID=248256&clcid=0x859

http://ultradownloads.com.br/.../2,1174116.html

http://download7.fileeagle.com/files/2015/.../OneDriveSetup.exe

http://go.microsoft.com/.../?LinkID=248256&clcid=0x140a

http://95.141.193.17/noload2/files/.../rsload.net.OneDriveSetup.exe

http://go.microsoft.com/.../?LinkID=248256&clcid=0x401

http://go.microsoft.com/.../?LinkID=248256&clcid=0x40d

http://go.microsoft.com/.../?LinkID=392253&clcid=0x2c0a

https://onedrive.live.com/download.aspx?cid=D24EBB1BF49B552E&resid=D24EBB1BF49B552E!1678&canary=mHXTROUT0AVlyY8gJilXRulJUZqzzDnwze9lxP1GPgg=1

http://go.microsoft.com/.../?LinkID=248256&clcid=0x42a

http://go.microsoft.com/.../?LinkID=248256&clcid=0x411

http://go.microsoft.com/.../?LinkID=248256&clcid=0x41e

http://g.live.com/.../skydrivesetup

http://go.microsoft.com/.../?LinkID=248256&clcid=0x406

http://go.microsoft.com/.../?LinkID=248256&clcid=0x416

http://go.microsoft.com/.../?LinkID=248256&clcid=0x340a

https://oneclient.sfx.ms/Win/Prod/.../OneDriveSetup.exe

http://go.microsoft.com/.../?LinkID=248256&clcid=0x412

http://go.microsoft.com/fwlink/.../?LinkId=248256&clcid=0x40e

http://go.microsoft.com/.../?LinkID=248256&clcid=0xc0a

http://go.microsoft.com/.../?LinkID=248256&clcid=0x80a

http://go.microsoft.com/fwlink/.../?LinkId=248256&clcid=0x405

https://oneclient.sfx.ms/Win/Direct/.../OneDriveSetup.exe

http://go.microsoft.com/.../?LinkID=248256&clcid=0x404

https://g.msn.com/.../skydrivesetup

http://go.microsoft.com/fwlink/.../?LinkId=248256

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.