home

OneDriveSetup.exe

Windows Live

Microsoft Corporation

This is a self-extracting archive and installer. This is the uninstaller utility registered in the Windows Control Panel for the program Microsoft OneDrive by Microsoft Corporation. This is installed with Microsoft OneDrive. The file has been seen being downloaded from oneclient.sfx.ms.
Publisher:
Microsoft Corporation  (signed and verified)

Product:
Windows Live

Description:
Microsoft OneDrive Setup

Version:
17.3.5849.0427

MD5:
2c82f8728cebaf45f8d31983a43b2b32

SHA-1:
a99f51a8ad89479459bb790bc117c687799c28c7

SHA-256:
9ebc17ae5c067bbd64d562ed62090999e9fd7f94b6f938a0119ae2ba5e5ad1e5

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
1/13/2025 3:46:32 PM UTC  (today)

File size:
7.3 MB (7,668,424 bytes)

Product version:
17.3.5849.0427

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
OneDriveSetup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\microsoft\onedrive\17.3.5849.0427\onedrivesetup.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
4/22/2014 1:39:00 PM

Valid to:
7/22/2015 1:39:00 PM

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
33000000CA6CD5321235C4E1550001000000CA

File PE Metadata
Compilation timestamp:
4/27/2015 3:29:38 AM

OS version:
6.2

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
196608:JT3N3hmOwSwiBws6VtQkzssSXi+bx0RRxnVsSXH/I1xne4J:H3dwSwns3kzjSXiuods5o4J

Entry address:
0x227A0

Entry point:
E8, 58, 38, 00, 00, E9, 81, FE, FF, FF, CC, CC, CC, CC, CC, E9, F6, 3C, 00, 00, CC, CC, CC, CC, CC, FF, 35, 10, 75, 4B, 00, FF, 15, F4, D2, 4B, 00, 85, C0, 74, 02, FF, D0, 6A, 19, E8, B9, 2F, 00, 00, 6A, 01, 6A, 00, E8, 0C, 3D, 00, 00, 83, C4, 0C, E9, 28, 3D, 00, 00, CC, CC, CC, CC, CC, 55, 8B, EC, 83, EC, 10, EB, 0D, FF, 75, 08, E8, E0, 3F, 00, 00, 59, 85, C0, 74, 0F, FF, 75, 08, E8, 3C, 3F, 00, 00, 59, 85, C0, 74, E6, C9, C3, 6A, 01, 8D, 45, FC, 50, 8D, 4D, F0, C7, 45, FC, 50, 14, 40, 00, E8, AA, 25, 00...
 
[+]

Entropy:
7.8656  (probably packed)

Code size:
704.5 KB (721,408 bytes)

Program Uninstaller
Program name:
Microsoft OneDrive

Display publisher:
Microsoft Corporation

Display version:
17.3.5849.0427

Uninstall string:
C:\users\{user}\appdata\local\microsoft\onedrive\17.3.5849.0427\onedrivesetup.exe \uninstall


The file OneDriveSetup.exe has been discovered within the following program.

Microsoft OneDrive  by Microsoft Corporation
OneDrive is a file hosting service that allows users to upload and sync files to a cloud storage and then access them from a Web browser or their local device.
onedrive.live.com/about/en-us
6% remove it
 
Powered by Should I Remove It?

The file OneDriveSetup.exe has been seen being distributed by the following URL.

https://oneclient.sfx.ms/Win/Prod/.../OneDriveSetup.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.