home

OneDriveSetup.exe

Windows Live

Microsoft Corporation

This is the uninstaller utility registered in the Windows Control Panel for the program Microsoft OneDrive by Microsoft Corporation. This is installed with Microsoft OneDrive. The file has been seen being downloaded from go.microsoft.com and multiple other hosts.
Publisher:
Microsoft Corporation  (signed and verified)

Product:
Windows Live

Description:
Microsoft OneDrive Setup

Version:
17.3.1229.0918

MD5:
072376c5bb7c4a636721d4482fd5d2ed

SHA-1:
bc5b3e42fc711bd2d7c531e8d2a68bd97c54e11d

SHA-256:
4a07b27cf5ea5d4a25bd46882a78656c66e93913ea741b3b8750e25d696da48c

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
11/4/2024 5:07:00 PM UTC  (today)

File size:
6.8 MB (7,137,440 bytes)

Product version:
17.3.1229.0918

Copyright:
© Microsoft Corporation. All rights reserved.

Original file name:
OneDriveSetup.exe

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\wct3321.tmp

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
4/22/2014 8:39:00 PM

Valid to:
7/22/2015 8:39:00 PM

Subject:
CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
33000000CA6CD5321235C4E1550001000000CA

File PE Metadata
Compilation timestamp:
9/19/2014 8:17:54 AM

OS version:
6.2

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
98304:1Hho/kL3wUMGKCvxesRAkgw08gXXaTIDDd8Ix1/PqWJo+Z7729Xb+KOWj:H8krwUwCvx1eSkXCIePWJZKXb5H

Entry address:
0x1D56E

Entry point:
E8, 24, 34, 00, 00, E9, 81, FE, FF, FF, CC, CC, CC, CC, CC, FF, 35, 50, 7B, 49, 00, FF, 15, 38, 13, 40, 00, 85, C0, 74, 02, FF, D0, 6A, 19, E8, 8F, 2B, 00, 00, 6A, 01, 6A, 00, E8, 98, 38, 00, 00, 83, C4, 0C, E9, B4, 38, 00, 00, CC, CC, CC, CC, CC, 55, 8B, EC, 83, EC, 10, EB, 0D, FF, 75, 08, E8, 66, 3B, 00, 00, 59, 85, C0, 74, 0F, FF, 75, 08, E8, C2, 3A, 00, 00, 59, 85, C0, 74, E6, C9, C3, 6A, 01, 8D, 45, FC, 50, 8D, 4D, F0, C7, 45, FC, CC, 1B, 40, 00, E8, 96, 21, 00, 00, 68, 74, 9A, 48, 00, 8D, 45, F0, 50...
 
[+]

Code size:
581.5 KB (595,456 bytes)

Program Uninstaller
Program name:
Microsoft OneDrive

Display publisher:
Microsoft Corporation

Display version:
17.3.1229.0918

Uninstall string:
C:\users\{user}\appdata\local\microsoft\skydrive\17.3.1229.0918\onedrivesetup.exe \uninstall


The file OneDriveSetup.exe has been discovered within the following program.

Microsoft OneDrive  by Microsoft Corporation
OneDrive is a file hosting service that allows users to upload and sync files to a cloud storage and then access them from a Web browser or their local device.
onedrive.live.com/about/en-us
6% remove it
 
Powered by Should I Remove It?

The file OneDriveSetup.exe has been seen being distributed by the following 50 URLs.

http://go.microsoft.com/.../?LinkID=248256&clcid=0x424

http://go.microsoft.com/.../?LinkID=248256&clcid=0x141a

http://go.microsoft.com/.../?LinkID=248256&clcid=0x807

http://go.microsoft.com/.../?LinkID=248256&clcid=0xc04

http://go.microsoft.com/.../?LinkID=248256&clcid=0x40d

http://go.microsoft.com/.../?LinkID=392253&clcid=0x416

http://filehippo.com/download/file/.../

http://go.microsoft.com/.../?LinkID=248256&clcid=0xe40c

http://go.microsoft.com/.../?LinkID=248256&clcid=0x140a

http://go.microsoft.com/.../?LinkID=248256&clcid=0x3809

http://go.microsoft.com/.../?LinkID=248256&clcid=0x340a

https://oneclient.sfx.ms/Win/Prod/.../OneDriveSetup.exe

http://go.microsoft.com/.../?LinkID=248256&clcid=0x41f

http://indir.gezginler.net/i/17604/.../

http://go.microsoft.com/.../?LinkID=248256&clcid=0x401

http://go.microsoft.com/.../?LinkID=248256&clcid=0x405

http://go.microsoft.com/.../?LinkID=248256&clcid=0x7c46

http://go.microsoft.com/.../?LinkID=248256&clcid=0x41b

http://go.microsoft.com/.../?LinkID=248256&clcid=0x410

http://go.microsoft.com/.../?LinkID=392253

http://go.microsoft.com/.../?LinkID=248256&clcid=0x418

http://go.microsoft.com/.../?LinkID=248256&clcid=0x40e

https://g.live.com/.../skydrivesetup

https://go.microsoft.com/fwlink/.../?LinkId=248256

http://go.microsoft.com/.../?LinkID=248256&clcid=0x404

http://go.microsoft.com/.../?LinkID=248256&clcid=0x4809

http://go.microsoft.com/.../?LinkID=248256&clcid=0x1c09

http://go.microsoft.com/.../?LinkID=248256&clcid=0x4009

http://go.microsoft.com/.../?LinkID=248256&clcid=0x4409

http://fs31.filehippo.com/5266/.../OneDriveSetup.exe

Latest 30 of 63 download URLs

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.