140ba899c8c72178ddc63492dee95e247fe5ed502baec2cae8e546f9ddd36e88

Analysis

user interaction
yes
max time kernel
100s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
privacy-script2.bat
Size 6.2MB
Sample260703-prwbeahs91
SHA256 140ba899c8c72178ddc63492dee95e247fe5ed502baec2cae8e546f9ddd36e88
MD5 ab01ea4441e098876dc8ff0003e13b05
SHA1 a67d5ee26e0e0df6b2a2156220c1e7d4d81e1bc7
SHA512 d0ab808878bed3b66e28498b9a7b0d2a2c5b6e0b17e1baffd27a5ed9c5ea92d7ac652472992fe5d85b9005b1bedbe0136a94c0435e078ef818d61d26e5473a52
SSDEEP 24576:YMnt+hzy26kaaXyqmyGVQqYPlEWm3fvllB+Izthm3maAX/GkB03XhszfjkJwnnHx:f
TLSH
T1C556947AEF940A264CC3DBAE8E5188D5EE4B005C823678C0F54EC58D6BC71DD92BCAD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution exploit persistence ransomware

Malware Config

Signatures

Drops file in Drivers directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
2320	net.exe
1244	net1.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
4148	takeown.exe
4144	icacls.exe

Deletes itself 1 IoCs

pid	Process
4980	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
4908	dismhost.exe
3772	dismhost.exe
3812	dismhost.exe
4196	dismhost.exe
928	dismhost.exe

Loads dropped DLL 39 IoCs

pid	Process
4908	dismhost.exe
4908	dismhost.exe
4908	dismhost.exe
4908	dismhost.exe
4908	dismhost.exe
4908	dismhost.exe
4908	dismhost.exe
4908	dismhost.exe
4908	dismhost.exe
4908	dismhost.exe
4908	dismhost.exe
4908	dismhost.exe
4908	dismhost.exe
4908	dismhost.exe
4908	dismhost.exe
4908	dismhost.exe
4908	dismhost.exe
4908	dismhost.exe
4908	dismhost.exe
3772	dismhost.exe
3772	dismhost.exe
3772	dismhost.exe
3772	dismhost.exe
3772	dismhost.exe
3812	dismhost.exe
3812	dismhost.exe
3812	dismhost.exe
3812	dismhost.exe
3812	dismhost.exe
4196	dismhost.exe
4196	dismhost.exe
4196	dismhost.exe
4196	dismhost.exe
4196	dismhost.exe
928	dismhost.exe
928	dismhost.exe
928	dismhost.exe
928	dismhost.exe
928	dismhost.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4148	takeown.exe
4144	icacls.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
964	powershell.exe
4972	powershell.exe
3220	powershell.exe
1476	powershell.exe
3076	powershell.exe
2060	powershell.exe
5056	powershell.exe
4572	powershell.exe
4156	powershell.exe
636	powershell.exe
1432	powershell.exe
1928	powershell.exe
4352	powershell.exe
4196	powershell.exe
4464	powershell.exe
2140	powershell.exe
1432	powershell.exe
2332	powershell.exe
4136	powershell.exe
3304	powershell.exe
4936	powershell.exe
920	powershell.exe
1064	powershell.exe
4552	powershell.exe
3256	powershell.exe
4384	powershell.exe
1004	powershell.exe
1448	powershell.exe
2512	powershell.exe
804	powershell.exe
1856	powershell.exe
5004	powershell.exe
3456	powershell.exe
3736	powershell.exe
2268	powershell.exe
4464	powershell.exe
2596	powershell.exe
4328	powershell.exe
4728	powershell.exe
4068	powershell.exe
3440	powershell.exe
4736	powershell.exe
2220	powershell.exe
2824	powershell.exe
4808	powershell.exe
4300	powershell.exe
4196	powershell.exe
4196	powershell.exe
4868	powershell.exe
4680	powershell.exe
1240	powershell.exe
4188	powershell.exe
1684	powershell.exe
4308	powershell.exe
2844	powershell.exe
2724	powershell.exe
3232	powershell.exe
1956	powershell.exe
4860	powershell.exe
1656	powershell.exe
2620	powershell.exe
4728	powershell.exe
2952	powershell.exe
3404	powershell.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\sru\SRUDB.dat	powershell.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	Ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	Ngen.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	powershell.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	Ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	Ngen.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	powershell.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	Ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	Ngen.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 6 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3404	powershell.exe
1244	powershell.exe
4560	powershell.exe
4176	powershell.exe
3036	powershell.exe
2264	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngen.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 30 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1432	powershell.exe
2332	powershell.exe
2268	powershell.exe
4196	powershell.exe
1928	powershell.exe
4680	powershell.exe
4464	powershell.exe
3440	powershell.exe
1064	powershell.exe
4300	powershell.exe
1476	powershell.exe
1856	powershell.exe
3304	powershell.exe
2140	powershell.exe
1240	powershell.exe
5004	powershell.exe
3456	powershell.exe
3256	powershell.exe
5056	powershell.exe
2824	powershell.exe
4552	powershell.exe
4464	powershell.exe
4868	powershell.exe
804	powershell.exe
1432	powershell.exe
4196	powershell.exe
4936	powershell.exe
4808	powershell.exe
920	powershell.exe
4196	powershell.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e0d688459d835b340000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e0d688450000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e0d68845000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae0d68845000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de0d68845000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies registry key 1 TTPs 39 IoCs

Modify Registry

T1112

pid	Process
3456	reg.exe
5028	reg.exe
3740	reg.exe
2384	reg.exe
2516	reg.exe
4348	reg.exe
4964	reg.exe
3264	reg.exe
2516	reg.exe
2484	reg.exe
3256	reg.exe
1656	reg.exe
228	reg.exe
1192	reg.exe
2540	reg.exe
3212	reg.exe
4552	reg.exe
2484	reg.exe
4864	reg.exe
3844	reg.exe
3776	reg.exe
3740	reg.exe
3800	reg.exe
3308	reg.exe
1264	reg.exe
1156	reg.exe
868	reg.exe
972	reg.exe
2128	reg.exe
3880	reg.exe
4476	reg.exe
4880	reg.exe
3844	reg.exe
4192	reg.exe
2364	reg.exe
2904	reg.exe
1840	reg.exe
3016	reg.exe
2064	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4952	powershell.exe
4952	powershell.exe
4176	powershell.exe
4176	powershell.exe
3232	powershell.exe
3232	powershell.exe
3036	powershell.exe
3036	powershell.exe
2696	powershell.exe
2696	powershell.exe
1956	powershell.exe
1956	powershell.exe
1900	powershell.exe
1900	powershell.exe
4728	powershell.exe
4728	powershell.exe
4736	powershell.exe
4736	powershell.exe
4572	powershell.exe
4572	powershell.exe
2220	powershell.exe
2220	powershell.exe
2844	powershell.exe
2844	powershell.exe
4384	powershell.exe
4384	powershell.exe
2724	powershell.exe
2724	powershell.exe
1004	powershell.exe
1004	powershell.exe
2608	powershell.exe
2608	powershell.exe
1448	powershell.exe
1448	powershell.exe
2952	powershell.exe
2952	powershell.exe
2816	powershell.exe
2816	powershell.exe
2596	powershell.exe
2596	powershell.exe
4720	powershell.exe
4720	powershell.exe
964	powershell.exe
964	powershell.exe
4972	powershell.exe
4972	powershell.exe
4328	powershell.exe
4328	powershell.exe
4524	powershell.exe
4524	powershell.exe
4156	powershell.exe
4156	powershell.exe
2264	powershell.exe
2264	powershell.exe
3404	powershell.exe
3404	powershell.exe
2512	powershell.exe
2512	powershell.exe
4728	powershell.exe
4728	powershell.exe
636	powershell.exe
636	powershell.exe
3220	powershell.exe
3220	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeBackupPrivilege	2012	Dism.exe
Token: SeRestorePrivilege	2012	Dism.exe
Token: SeDebugPrivilege	4176	powershell.exe
Token: SeDebugPrivilege	3232	powershell.exe
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	2844	powershell.exe
Token: SeDebugPrivilege	4384	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	1004	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	4720	powershell.exe
Token: SeDebugPrivilege	964	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4524	powershell.exe
Token: SeDebugPrivilege	4156	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	3404	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeDebugPrivilege	636	powershell.exe
Token: SeDebugPrivilege	3220	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	4068	powershell.exe
Token: SeDebugPrivilege	4168	powershell.exe
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeBackupPrivilege	1244	powershell.exe
Token: SeRestorePrivilege	1244	powershell.exe
Token: SeBackupPrivilege	628	vssvc.exe
Token: SeRestorePrivilege	628	vssvc.exe
Token: SeAuditPrivilege	628	vssvc.exe
Token: SeBackupPrivilege	4064	srtasks.exe
Token: SeRestorePrivilege	4064	srtasks.exe
Token: SeSecurityPrivilege	4064	srtasks.exe
Token: SeTakeOwnershipPrivilege	4064	srtasks.exe
Token: SeBackupPrivilege	4064	srtasks.exe
Token: SeRestorePrivilege	4064	srtasks.exe
Token: SeSecurityPrivilege	4064	srtasks.exe
Token: SeTakeOwnershipPrivilege	4064	srtasks.exe
Token: SeBackupPrivilege	1244	powershell.exe
Token: SeRestorePrivilege	1244	powershell.exe
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeBackupPrivilege	4560	powershell.exe
Token: SeRestorePrivilege	4560	powershell.exe
Token: SeBackupPrivilege	4560	powershell.exe
Token: SeRestorePrivilege	4560	powershell.exe
Token: SeDebugPrivilege	3076	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	3736	powershell.exe
Token: SeDebugPrivilege	4308	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 4896	1380	cmd.exe	85
PID 1380 wrote to memory of 4220	1380	cmd.exe	86
PID 1380 wrote to memory of 2320	1380	cmd.exe	87
PID 2320 wrote to memory of 1244	2320	net.exe	88
PID 1380 wrote to memory of 4952	1380	cmd.exe	89
PID 4952 wrote to memory of 4348	4952	powershell.exe	90
PID 1380 wrote to memory of 2012	1380	cmd.exe	91
PID 2012 wrote to memory of 4908	2012	Dism.exe	92
PID 1380 wrote to memory of 4176	1380	cmd.exe	99
PID 1380 wrote to memory of 3232	1380	cmd.exe	101
PID 3232 wrote to memory of 3604	3232	powershell.exe	102
PID 3604 wrote to memory of 4148	3604	cmd.exe	103
PID 3232 wrote to memory of 560	3232	powershell.exe	104
PID 560 wrote to memory of 4144	560	cmd.exe	105
PID 1380 wrote to memory of 3036	1380	cmd.exe	106
PID 1380 wrote to memory of 2696	1380	cmd.exe	108
PID 2696 wrote to memory of 3212	2696	powershell.exe	109
PID 1380 wrote to memory of 1956	1380	cmd.exe	110
PID 1956 wrote to memory of 3016	1956	powershell.exe	111
PID 1380 wrote to memory of 1900	1380	cmd.exe	112
PID 1900 wrote to memory of 4552	1900	powershell.exe	113
PID 1380 wrote to memory of 4728	1380	cmd.exe	114
PID 1380 wrote to memory of 4736	1380	cmd.exe	118
PID 4736 wrote to memory of 972	4736	powershell.exe	119
PID 1380 wrote to memory of 4572	1380	cmd.exe	120
PID 4572 wrote to memory of 2128	4572	powershell.exe	121
PID 1380 wrote to memory of 2220	1380	cmd.exe	122
PID 2220 wrote to memory of 3880	2220	powershell.exe	123
PID 1380 wrote to memory of 2844	1380	cmd.exe	124
PID 2844 wrote to memory of 4476	2844	powershell.exe	125
PID 1380 wrote to memory of 4384	1380	cmd.exe	126
PID 4384 wrote to memory of 3776	4384	powershell.exe	127
PID 1380 wrote to memory of 2724	1380	cmd.exe	128
PID 2724 wrote to memory of 3456	2724	powershell.exe	129
PID 1380 wrote to memory of 1004	1380	cmd.exe	130
PID 1004 wrote to memory of 5028	1004	powershell.exe	131
PID 1380 wrote to memory of 2608	1380	cmd.exe	132
PID 2608 wrote to memory of 4964	2608	powershell.exe	154
PID 1380 wrote to memory of 1448	1380	cmd.exe	134
PID 1448 wrote to memory of 2484	1448	powershell.exe	135
PID 1380 wrote to memory of 2952	1380	cmd.exe	136
PID 2952 wrote to memory of 1224	2952	powershell.exe	137
PID 1380 wrote to memory of 2816	1380	cmd.exe	138
PID 2816 wrote to memory of 3740	2816	powershell.exe	139
PID 1380 wrote to memory of 2596	1380	cmd.exe	140
PID 2596 wrote to memory of 3844	2596	powershell.exe	162
PID 1380 wrote to memory of 4720	1380	cmd.exe	142
PID 4720 wrote to memory of 1264	4720	powershell.exe	143
PID 1380 wrote to memory of 964	1380	cmd.exe	144
PID 964 wrote to memory of 3264	964	powershell.exe	177
PID 1380 wrote to memory of 4972	1380	cmd.exe	146
PID 4972 wrote to memory of 4880	4972	powershell.exe	147
PID 1380 wrote to memory of 4328	1380	cmd.exe	148
PID 4328 wrote to memory of 2516	4328	powershell.exe	149
PID 1380 wrote to memory of 4524	1380	cmd.exe	150
PID 4524 wrote to memory of 4192	4524	powershell.exe	151
PID 1380 wrote to memory of 4156	1380	cmd.exe	152
PID 4156 wrote to memory of 4864	4156	powershell.exe	153
PID 1380 wrote to memory of 4964	1380	cmd.exe	154
PID 1380 wrote to memory of 1876	1380	cmd.exe	156
PID 1380 wrote to memory of 2264	1380	cmd.exe	157
PID 1380 wrote to memory of 3404	1380	cmd.exe	159
PID 1380 wrote to memory of 2512	1380	cmd.exe	161
PID 2512 wrote to memory of 3844	2512	powershell.exe	162

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\privacy-script2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\system32\where.exe
  where PowerShell
  2⤵
  PID:4896
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:4220
- C:\Windows\system32\net.exe
  net user defaultuser0 /delete
  2⤵
  - Indicator Removal: Network Share Connection Removal
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user defaultuser0 /delete
    3⤵
    - Indicator Removal: Network Share Connection Removal
    PID:1244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\Configuration'; $data = '0'; reg add 'HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\Configuration' /v 'DisableResetbase' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\Configuration /v DisableResetbase /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:4348
- C:\Windows\system32\Dism.exe
  dism /online /Remove-DefaultAppAssociations
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\dismhost.exe
    C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\dismhost.exe {BBE5D29F-B81D-4AB6-A14B-0755FF47AF11}
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:4908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$serviceName = 'DPS'; Write-Host """Stopping service: `"""$serviceName`"""."""; $service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue; if (!$service) { Write-Host """Skipping, service `"""$serviceName`""" could not be not found, no need to stop it."""; exit 0; }; if ($service.Status -ne [System.ServiceProcess.ServiceControllerStatus]::Running) { Write-Host """Skipping, `"""$serviceName`""" is not running, no need to stop."""; exit 0; }; Write-Host """`"""$serviceName`""" is running, stopping it."""; try { $service | Stop-Service -Force -ErrorAction Stop; $service.WaitForStatus([System.ServiceProcess.ServiceControllerStatus]::Stopped); } catch { throw """Failed to stop the service `"""$serviceName`""": $_"""; }; Write-Host """Successfully stopped the service: `"""$serviceName`"""."""; function Get-StateFilePath($BaseName, $Suffix) { $escapedBaseName = $BaseName.Split([IO.Path]::GetInvalidFileNameChars()) -Join '_'; $uniqueFilename = $escapedBaseName, $Suffix -Join '-'; $path = [IO.Path]::Combine( $env:APPDATA, 'privacy.sexy', 'state', $uniqueFilename ); return $path; }; function Get-UniqueStateFilePath($BaseName) { $suffix = New-Guid; $path = Get-StateFilePath -BaseName $BaseName -Suffix $suffix; if (Test-Path -Path $path) { Write-Verbose """Path collision detected at: '$path'. Generating new path..."""; return Get-UniqueStateFilePath $serviceName; }; return $path; }; function New-EmptyFile($Path) { $parentDirectory = [System.IO.Path]::GetDirectoryName($Path); if (-not (Test-Path $parentDirectory -PathType Container)) { try { New-Item -ItemType Directory -Path $parentDirectory -Force -ErrorAction Stop | Out-Null; } catch { Write-Warning """Failed to create parent directory of file `"""$parentDirectory`""": $_"""; }; }; try { New-Item -ItemType File -Path $Path -Force -ErrorAction Stop | Out-Null; return $true; } catch { Write-Warning """Failed to create file `"""$Path`""": $_"""; return $false; }; }; $path = Get-UniqueStateFilePath $serviceName; if (New-EmptyFile $path) { Write-Host 'Service will restart automatically.'; } else { Write-Warning 'Manual restart required - please restart your computer.'; }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$pathGlobPattern = """C:\Windows\System32\sru\SRUDB.dat"""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host """Searching for items matching pattern: `"""$($expandedPath)`"""."""; <# Not using `Get-Acl`/`Set-Acl` to avoid adjusting token privileges #>; $parentDirectory = [System.IO.Path]::GetDirectoryName($expandedPath); $fileName = [System.IO.Path]::GetFileName($expandedPath); if ($parentDirectory -like '*[*?]*') { throw """Unable to grant permissions to glob path parent directory: `"""$parentDirectory`""", wildcards in parent directory are not supported by ``takeown`` and ``icacls``."""; }; if (($fileName -ne '*') -and ($fileName -like '*[*?]*')) { throw """Unable to grant permissions to glob path file name: `"""$fileName`""", wildcards in file name is not supported by ``takeown`` and ``icacls``."""; }; Write-Host """Taking ownership of `"""$expandedPath`"""."""; $cmdPath = $expandedPath; if ($cmdPath.EndsWith('\')) { $cmdPath += '\' <# Escape trailing backslash for correct handling in batch commands #>; }; $takeOwnershipCommand = """takeown /f `"""$cmdPath`""" /a""" <# `icacls /setowner` does not succeed, so use `takeown` instead. #>; if (-not (Test-Path -Path """$expandedPath""" -PathType Leaf)) { $localizedYes = 'Y' <# Default 'Yes' flag (fallback) #>; try { $choiceOutput = cmd /c """choice <nul 2>nul"""; if ($choiceOutput -and $choiceOutput.Length -ge 2) { $localizedYes = $choiceOutput[1]; } else { Write-Warning """Failed to determine localized 'Yes' character. Output: `"""$choiceOutput`""""""; }; } catch { Write-Warning """Failed to determine localized 'Yes' character. Error: $_"""; }; $takeOwnershipCommand += """ /r /d $localizedYes"""; }; $takeOwnershipOutput = cmd /c """$takeOwnershipCommand 2>&1""" <# `stderr` message is misleading, e.g. """ERROR: The system cannot find the file specified.""" is not an error. #>; if ($LASTEXITCODE -eq 0) { Write-Host """Successfully took ownership of `"""$expandedPath`""" (using ``$takeOwnershipCommand``)."""; } else { Write-Host """Did not take ownership of `"""$expandedPath`""" using ``$takeOwnershipCommand``, status code: $LASTEXITCODE, message: $takeOwnershipOutput."""; <# Do not write as error or warning, because this can be due to missing path, it's handled in next command. #>; <# `takeown` exits with status code `1`, making it hard to handle missing path here. #>; }; Write-Host """Granting permissions for `"""$expandedPath`"""."""; $adminSid = New-Object System.Security.Principal.SecurityIdentifier 'S-1-5-32-544'; $adminAccount = $adminSid.Translate([System.Security.Principal.NTAccount]); $adminAccountName = $adminAccount.Value; $grantPermissionsCommand = """icacls `"""$cmdPath`""" /grant `"""$($adminAccountName):F`""" /t"""; $icaclsOutput = cmd /c """$grantPermissionsCommand"""; if ($LASTEXITCODE -eq 3) { Write-Host """Skipping, no items available for deletion according to: ``$grantPermissionsCommand``."""; exit 0; } elseif ($LASTEXITCODE -ne 0) { Write-Host """Take ownership message:`n$takeOwnershipOutput"""; Write-Host """Grant permissions:`n$icaclsOutput"""; Write-Warning """Failed to assign permissions for `"""$expandedPath`""" using ``$grantPermissionsCommand``, status code: $LASTEXITCODE."""; } else { $fileStats = $icaclsOutput | ForEach-Object { $_ -match '\d+' | Out-Null; $matches[0] } | Where-Object { $_ -ne $null } | ForEach-Object { [int]$_ }; if ($fileStats.Count -gt 0 -and ($fileStats | ForEach-Object { $_ -eq 0 } | Where-Object { $_ -eq $false }).Count -eq 0) { Write-Host """Skipping, no items available for deletion according to: ``$grantPermissionsCommand``."""; exit 0; } else { Write-Host """Successfully granted permissions for `"""$expandedPath`""" (using ``$grantPermissionsCommand``)."""; }; }; $deletedCount = 0; $failedCount = 0; $skippedCount = 0; $foundAbsolutePaths = @(); try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host """Initiating processing of $($foundAbsolutePaths.Count) items from `"""$expandedPath`"""."""; foreach ($path in $foundAbsolutePaths) { if (Test-Path -Path $path -PathType Container) { Write-Host """Skipping, the path is not a file but a folder: $($path)."""; $skippedCount++; continue; }; if (-not (Test-Path $path)) { <# Re-check existence as prior deletions might remove subsequent items (e.g., subdirectories). #>; Write-Host """Successfully deleted: $($path) (already deleted)."""; $deletedCount++; continue; }; try { Remove-Item -Path $path -Force -Recurse -ErrorAction Stop; $deletedCount++; Write-Host """Successfully deleted: $($path)"""; } catch { $failedCount++; Write-Warning """Unable to delete $($path): $_"""; }; }; if ($skippedCount -gt 0) { Write-Host """Skipped $($skippedCount) items."""; }; Write-Host """Successfully deleted $($deletedCount) items."""; if ($failedCount -gt 0) { Write-Warning """Failed to delete $($failedCount) items."""; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "takeown /f "C:\Windows\System32\sru\SRUDB.dat" /a 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\sru\SRUDB.dat" /a
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4148
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "icacls "C:\Windows\System32\sru\SRUDB.dat" /grant "BUILTIN\Administrators:F" /t"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:560
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\sru\SRUDB.dat" /grant "BUILTIN\Administrators:F" /t
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$serviceName = 'DPS'; function Get-StateFilePath($BaseName, $Suffix) { $escapedBaseName = $BaseName.Split([IO.Path]::GetInvalidFileNameChars()) -Join '_'; $uniqueFilename = $escapedBaseName, $Suffix -Join '-'; $path = [IO.Path]::Combine( $env:APPDATA, 'privacy.sexy', 'state', $uniqueFilename ); return $path; }; $fileGlob = Get-StateFilePath -BaseName $serviceName -Suffix '*'; $files = Get-ChildItem -Path """$fileGlob"""; if ($files.Count -gt 0) { $firstFilePath = $files[0].FullName; try { Remove-Item -Path $firstFilePath -Force -ErrorAction Stop; Write-Host 'The service is expected to be started.'; } catch { Write-Warning """Failed to delete the service state file `"""$firstFilePath`""": $_"""; }; }; if ($files.Count -ne 1) { <# Not the last file requiring restart #>; Write-Host 'Skipping starting the service: It was not running before.'; exit 0; }; $service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue; if (!$service) { throw """Failed to start service `"""$serviceName`""": Service not found."""; }; if ($service.Status -eq [System.ServiceProcess.ServiceControllerStatus]::Running) { Write-Host """Skipping, `"""$serviceName`""" is already running, no need to start."""; exit 0; }; Write-Host """`"""$serviceName`""" is not running, starting it."""; try { $service | Start-Service -ErrorAction Stop; Write-Host """Successfully started the service: `"""$serviceName`"""."""; } catch { Write-Warning """Failed to start the service: `"""$serviceName`"""."""; exit 1; }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\Software\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy'; $data = '0'; reg add 'HKCU\Software\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy' /v 'HasAccepted' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy /v HasAccepted /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:3212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\SOFTWARE\Microsoft\Personalization\Settings'; $data = '0'; reg add 'HKCU\SOFTWARE\Microsoft\Personalization\Settings' /v 'AcceptedPrivacyPolicy' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Personalization\Settings /v AcceptedPrivacyPolicy /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:3016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\SOFTWARE\Microsoft\Siuf\Rules'; $data = '0'; reg add 'HKCU\SOFTWARE\Microsoft\Siuf\Rules' /v 'NumberOfSIUFInPeriod' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Siuf\Rules /v NumberOfSIUFInPeriod /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:4552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$keyName = 'HKCU\SOFTWARE\Microsoft\Siuf\Rules'; $valueName = 'PeriodInNanoSeconds'; $hive = $keyName.Split('\')[0]; $path = """$($hive):$($keyName.Substring($hive.Length))"""; Write-Host """Removing the registry value '$valueName' from '$path'."""; if (-Not (Test-Path -LiteralPath $path)) { Write-Host 'Skipping, no action needed, registry key does not exist.'; Exit 0; }; $existingValueNames = (Get-ItemProperty -LiteralPath $path).PSObject.Properties.Name; if (-Not ($existingValueNames -Contains $valueName)) { Write-Host 'Skipping, no action needed, registry value does not exist.'; Exit 0; }; try { if ($valueName -ieq '(default)') { Write-Host 'Removing the default value.'; $(Get-Item -LiteralPath $path).OpenSubKey('', $true).DeleteValue(''); } else { Remove-ItemProperty -LiteralPath $path -Name $valueName -Force -ErrorAction Stop; }; Write-Host 'Successfully removed the registry value.'; } catch { Write-Error """Failed to remove the registry value: $($_.Exception.Message)"""; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection'; $data = '1'; reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection' /v 'DoNotShowFeedbackNotifications' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v DoNotShowFeedbackNotifications /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection' /v 'DoNotShowFeedbackNotifications' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection /v DoNotShowFeedbackNotifications /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization' /v 'RestrictImplicitInkCollection' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization /v RestrictImplicitInkCollection /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:3880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization' /v 'RestrictImplicitTextCollection' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization /v RestrictImplicitTextCollection /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports' /v 'PreventHandwritingErrorReports' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports /v PreventHandwritingErrorReports /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:3776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\TabletPC'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\TabletPC' /v 'PreventHandwritingDataSharing' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\TabletPC /v PreventHandwritingDataSharing /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:3456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization' /v 'AllowInputPersonalization' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\InputPersonalization /v AllowInputPersonalization /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:5028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\SOFTWARE\Microsoft\InputPersonalization\TrainedDataStore'; $data = '0'; reg add 'HKCU\SOFTWARE\Microsoft\InputPersonalization\TrainedDataStore' /v 'HarvestContacts' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\InputPersonalization\TrainedDataStore /v HarvestContacts /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:4964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors' /v 'DisableSensors' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors /v DisableSensors /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\Control Panel\International\User Profile'; $data = '1'; reg add 'HKCU\Control Panel\International\User Profile' /v 'HttpAcceptLanguageOptOut' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKCU\Control Panel\International\User Profile" /v HttpAcceptLanguageOptOut /t REG_DWORD /d 1 /f
    3⤵
    PID:1224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Maps'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Maps' /v 'AllowUntriggeredNetworkTrafficOnSettingsPage' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\Maps /v AllowUntriggeredNetworkTrafficOnSettingsPage /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:3740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Maps'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Maps' /v 'AutoDownloadAndUpdateMapData' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\Maps /v AutoDownloadAndUpdateMapData /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:3844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\System\GameConfigStore'; $data = '0'; reg add 'HKCU\System\GameConfigStore' /v 'GameDVR_Enabled' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKCU\System\GameConfigStore /v GameDVR_Enabled /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:1264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR' /v 'AllowGameDVR' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR /v AllowGameDVR /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:3264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\WMDRM'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\WMDRM' /v 'DisableOnline' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\WMDRM /v DisableOnline /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Microsoft\Input\TIPC'; $data = '0'; reg add 'HKLM\SOFTWARE\Microsoft\Input\TIPC' /v 'Enabled' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\Input\TIPC /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:2516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\SOFTWARE\Microsoft\Input\TIPC'; $data = '0'; reg add 'HKCU\SOFTWARE\Microsoft\Input\TIPC' /v 'Enabled' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Microsoft\Input\TIPC /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:4192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\System'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\System' /v 'EnableActivityFeed' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v EnableActivityFeed /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:4864
- C:\Windows\system32\setx.exe
  setx DOTNET_CLI_TELEMETRY_OPTOUT 1
  2⤵
  PID:4964
- C:\Windows\system32\setx.exe
  setx POWERSHELL_TELEMETRY_OPTOUT 1
  2⤵
  PID:1876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$serviceName = 'Razer Game Scanner Service'; Write-Host """Disabling service: `"""$serviceName`"""."""; <# -- 1. Skip if service does not exist #>; $service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue; if(!$service) { Write-Host """Service `"""$serviceName`""" could not be not found, no need to disable it."""; Exit 0; }; <# -- 2. Stop if running #>; if ($service.Status -eq [System.ServiceProcess.ServiceControllerStatus]::Running) { Write-Host """`"""$serviceName`""" is running, stopping it."""; try { Stop-Service -Name """$serviceName""" -Force -ErrorAction Stop; Write-Host """Stopped `"""$serviceName`""" successfully."""; } catch { Write-Warning """Could not stop `"""$serviceName`""", it will be stopped after reboot: $_"""; }; } else { Write-Host """`"""$serviceName`""" is not running, no need to stop."""; }; <# -- 3. Skip if already disabled #>; $startupType = $service.StartType <# Does not work before .NET 4.6.1 #>; if (!$startupType) { $startupType = (Get-WmiObject -Query """Select StartMode From Win32_Service Where Name='$serviceName'""" -ErrorAction Ignore).StartMode; if(!$startupType) { $startupType = (Get-WmiObject -Class Win32_Service -Property StartMode -Filter """Name='$serviceName'""" -ErrorAction Ignore).StartMode; }; }; if ($startupType -eq 'Disabled') { Write-Host """$serviceName is already disabled, no further action is needed"""; Exit 0; }; <# -- 4. Disable service #>; try { Set-Service -Name """$serviceName""" -StartupType Disabled -Confirm:$false -ErrorAction Stop; Write-Host """Disabled `"""$serviceName`""" successfully."""; } catch { Write-Error """Could not disable `"""$serviceName`""": $_"""; }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$serviceName = 'LogiRegistryService'; Write-Host """Disabling service: `"""$serviceName`"""."""; <# -- 1. Skip if service does not exist #>; $service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue; if(!$service) { Write-Host """Service `"""$serviceName`""" could not be not found, no need to disable it."""; Exit 0; }; <# -- 2. Stop if running #>; if ($service.Status -eq [System.ServiceProcess.ServiceControllerStatus]::Running) { Write-Host """`"""$serviceName`""" is running, stopping it."""; try { Stop-Service -Name """$serviceName""" -Force -ErrorAction Stop; Write-Host """Stopped `"""$serviceName`""" successfully."""; } catch { Write-Warning """Could not stop `"""$serviceName`""", it will be stopped after reboot: $_"""; }; } else { Write-Host """`"""$serviceName`""" is not running, no need to stop."""; }; <# -- 3. Skip if already disabled #>; $startupType = $service.StartType <# Does not work before .NET 4.6.1 #>; if (!$startupType) { $startupType = (Get-WmiObject -Query """Select StartMode From Win32_Service Where Name='$serviceName'""" -ErrorAction Ignore).StartMode; if(!$startupType) { $startupType = (Get-WmiObject -Class Win32_Service -Property StartMode -Filter """Name='$serviceName'""" -ErrorAction Ignore).StartMode; }; }; if ($startupType -eq 'Disabled') { Write-Host """$serviceName is already disabled, no further action is needed"""; Exit 0; }; <# -- 4. Disable service #>; try { Set-Service -Name """$serviceName""" -StartupType Disabled -Confirm:$false -ErrorAction Stop; Write-Host """Disabled `"""$serviceName`""" successfully."""; } catch { Write-Error """Could not disable `"""$serviceName`""": $_"""; }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer'; $data = '255'; reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' /v 'NoDriveTypeAutoRun' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
    3⤵
    - Modifies registry key
    PID:3844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer'; $data = '1'; reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer' /v 'NoAutorun' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4728
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoAutorun /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:1192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer' /v 'NoAutoplayfornonVolume' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:636
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer /v NoAutoplayfornonVolume /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization' /v 'NoLockScreenCamera' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3220
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization /v NoLockScreenCamera /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:1156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SYSTEM\CurrentControlSet\Control\Lsa'; $data = '1'; reg add 'HKLM\SYSTEM\CurrentControlSet\Control\Lsa' /v 'NoLMHash' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v NoLMHash /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer' /v 'AlwaysInstallElevated' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4068
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:3800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel'; $data = '0'; reg add 'HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel' /v 'DisableExceptionChainValidation' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4168
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v DisableExceptionChainValidation /t REG_DWORD /d 0 /f
    3⤵
    PID:3456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$featureName = 'MicrosoftWindowsPowerShellV2'; $feature = Get-WindowsOptionalFeature -FeatureName """$featureName""" -Online -ErrorAction Stop; if (-Not $feature) { Write-Output """Skipping: The feature `"""$featureName`""" is not found. No action required."""; Exit 0; }; if ($feature.State -eq [Microsoft.Dism.Commands.FeatureState]::Disabled) { Write-Output """Skipping: The feature `"""$featureName`""" is already disabled. No action required."""; Exit 0; }; try { Write-Host """Disabling feature: `"""$featureName`"""."""; Disable-WindowsOptionalFeature -FeatureName """$featureName""" -Online -NoRestart -LogLevel ([Microsoft.Dism.Commands.LogLevel]::Errors) -WarningAction SilentlyContinue -ErrorAction Stop | Out-Null; } catch { Write-Error """Failed to disable the feature `"""$featureName`""": $($_.Exception.Message)"""; Exit 1; }; Write-Output """Successfully disabled the feature `"""$featureName`"""."""; Exit 0"
  2⤵
  - Drops file in Windows directory
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- - C:\Users\Admin\AppData\Local\Temp\6E7978E7-0CB7-4D0F-8085-7100B1A4286C\dismhost.exe
    C:\Users\Admin\AppData\Local\Temp\6E7978E7-0CB7-4D0F-8085-7100B1A4286C\dismhost.exe {1AC695EB-A380-40B6-8A38-C73F6063DCAE}
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:3772
- - C:\Users\Admin\AppData\Local\Temp\7C2BF693-7F23-469A-A10F-B3DAABABD3D7\dismhost.exe
    C:\Users\Admin\AppData\Local\Temp\7C2BF693-7F23-469A-A10F-B3DAABABD3D7\dismhost.exe {D42D3CCB-420D-4A79-8170-DA7AB9D49D41}
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:3812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$featureName = 'MicrosoftWindowsPowerShellV2Root'; $feature = Get-WindowsOptionalFeature -FeatureName """$featureName""" -Online -ErrorAction Stop; if (-Not $feature) { Write-Output """Skipping: The feature `"""$featureName`""" is not found. No action required."""; Exit 0; }; if ($feature.State -eq [Microsoft.Dism.Commands.FeatureState]::Disabled) { Write-Output """Skipping: The feature `"""$featureName`""" is already disabled. No action required."""; Exit 0; }; try { Write-Host """Disabling feature: `"""$featureName`"""."""; Disable-WindowsOptionalFeature -FeatureName """$featureName""" -Online -NoRestart -LogLevel ([Microsoft.Dism.Commands.LogLevel]::Errors) -WarningAction SilentlyContinue -ErrorAction Stop | Out-Null; } catch { Write-Error """Failed to disable the feature `"""$featureName`""": $($_.Exception.Message)"""; Exit 1; }; Write-Output """Successfully disabled the feature `"""$featureName`"""."""; Exit 0"
  2⤵
  - Drops file in Windows directory
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- - C:\Users\Admin\AppData\Local\Temp\BF875AEE-D955-46D6-BA36-F628DD555776\dismhost.exe
    C:\Users\Admin\AppData\Local\Temp\BF875AEE-D955-46D6-BA36-F628DD555776\dismhost.exe {DE48DE70-0D1C-4DF9-A1AD-FFEBC1D668CB}
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:4196
- - C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\dismhost.exe
    C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\dismhost.exe {EC6901E5-3413-4E5F-AA0A-1AD17C38A928}
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\Software\Policies\Microsoft\Windows\WCN\UI'; $data = '1'; reg add 'HKLM\Software\Policies\Microsoft\Windows\WCN\UI' /v 'DisableWcnUi' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3076
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\Software\Policies\Microsoft\Windows\WCN\UI /v DisableWcnUi /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:3308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars' /v 'DisableFlashConfigRegistrar' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2060
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars /v DisableFlashConfigRegistrar /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:2484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars' /v 'DisableInBand802DOT11Registrar' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1684
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars /v DisableInBand802DOT11Registrar /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars' /v 'DisableUPnPRegistrar' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4352
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars /v DisableUPnPRegistrar /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:3256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars' /v 'DisableWPDRegistrar' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3736
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars /v DisableWPDRegistrar /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:2364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars' /v 'EnableRegistrars' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4308
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\WCN\Registrars /v EnableRegistrars /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:2904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='oca.telemetry.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='oca.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='kmwatsonc.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='watson.telemetry.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='umwatsonc.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='ceuswatcab01.blob.core.windows.net'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='ceuswatcab02.blob.core.windows.net'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='eaus2watcab01.blob.core.windows.net'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='eaus2watcab02.blob.core.windows.net'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='weus2watcab01.blob.core.windows.net'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='weus2watcab02.blob.core.windows.net'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='co4.telecommand.telemetry.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='cs11.wpc.v0cdn.net'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='cs1137.wpc.gammacdn.net'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='modern.watson.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='functional.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='browser.events.data.msn.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='self.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='v10.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='v10c.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='us-v10c.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='eu-v10c.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='v10.vortex-win.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='vortex-win.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='telecommand.telemetry.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='www.telecommandsvc.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='umwatson.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='watsonc.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='eu-watsonc.events.data.microsoft.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$domain ='config.edge.skype.com'; $hostsFilePath = """$env:SYSTEMROOT\System32\drivers\etc\hosts"""; $comment = """managed by privacy.sexy"""; $hostsFileEncoding = [Microsoft.PowerShell.Commands.FileSystemCmdletProviderEncoding]::Utf8; $blockingHostsEntries = @(; @{ AddressType = """IPv4"""; IPAddress = '0.0.0.0'; }; @{ AddressType = """IPv6"""; IPAddress = '::1'; }; ); try { $isHostsFilePresent = Test-Path -Path $hostsFilePath -PathType Leaf -ErrorAction Stop; } catch { Write-Error """Failed to check hosts file existence. Error: $_"""; exit 1; }; if (-Not $isHostsFilePresent) { Write-Output """Creating a new hosts file at $hostsFilePath."""; try { New-Item -Path $hostsFilePath -ItemType File -Force -ErrorAction Stop | Out-Null; Write-Output """Successfully created the hosts file."""; } catch { Write-Error """Failed to create the hosts file. Error: $_"""; exit 1; }; }; foreach ($blockingEntry in $blockingHostsEntries) { Write-Output """Processing addition for $($blockingEntry.AddressType) entry."""; try { $hostsFileContents = Get-Content -Path """$hostsFilePath""" -Raw -Encoding $hostsFileEncoding -ErrorAction Stop; } catch { Write-Error """Failed to read the hosts file. Error: $_"""; continue; }; $hostsEntryLine = """$($blockingEntry.IPAddress)`t$domain $([char]35) $comment"""; if ((-Not [String]::IsNullOrWhiteSpace($hostsFileContents)) -And ($hostsFileContents.Contains($hostsEntryLine))) { Write-Output 'Skipping, entry already exists.'; continue; }; try { Add-Content -Path $hostsFilePath -Value $hostsEntryLine -Encoding $hostsFileEncoding -ErrorAction Stop; Write-Output 'Successfully added the entry.'; } catch { Write-Error """Failed to add the entry. Error: $_"""; continue; }; }"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\System'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\System' /v 'DisableLockScreenAppNotifications' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4188
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v DisableLockScreenAppNotifications /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:3740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications'; $data = '1'; reg add 'HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications' /v 'NoTileApplicationNotification' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  PID:2756
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications /v NoTileApplicationNotification /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer'; $data = '1'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer' /v 'NoUseStoreOpenWith' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4136
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer /v NoUseStoreOpenWith /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\Software\Policies\Microsoft\Windows\EdgeUI'; $data = '1'; reg add 'HKCU\Software\Policies\Microsoft\Windows\EdgeUI' /v 'DisableMFUTracking' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  PID:4276
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKCU\Software\Policies\Microsoft\Windows\EdgeUI /v DisableMFUTracking /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:1840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\Software\Policies\Microsoft\Windows\EdgeUI'; $data = '1'; reg add 'HKCU\Software\Policies\Microsoft\Windows\EdgeUI' /v 'DisableRecentApps' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  PID:692
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKCU\Software\Policies\Microsoft\Windows\EdgeUI /v DisableRecentApps /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:1656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKCU\Software\Policies\Microsoft\Windows\EdgeUI'; $data = '1'; reg add 'HKCU\Software\Policies\Microsoft\Windows\EdgeUI' /v 'TurnOffBackstack' /t 'REG_DWORD' /d """$data""" /f"
  2⤵
  PID:3556
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKCU\Software\Policies\Microsoft\Windows\EdgeUI /v TurnOffBackstack /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
  2⤵
  PID:4208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
  2⤵
  PID:4968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRULegacy'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
  2⤵
  PID:5060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$keyPath='HKCU\Software\Adobe\MediaBrowser\MRU'; $registryHive = $keyPath.Split('\')[0]; $registryPath = """$($registryHive):$($keyPath.Substring($registryHive.Length))"""; Write-Host """Removing registry key at `"""$registryPath`"""."""; if (-not (Test-Path -LiteralPath $registryPath)) { Write-Host """Skipping, no action needed, registry key `"""$registryPath`""" does not exist."""; exit 0; }; try { Remove-Item -LiteralPath $registryPath -Force -ErrorAction Stop | Out-Null; Write-Host """Successfully removed the registry key at path `"""$registryPath`"""."""; } catch { Write-Error """Failed to remove the registry key at path `"""$registryPath`""": $($_.Exception.Message)"""; }"
  2⤵
  PID:3144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
  2⤵
  PID:4680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
  2⤵
  PID:2516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Search Assistant\ACMru'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Iterating subkeys recursively: `"""$formattedRegistryKeyPath`"""."""; $subKeys = Get-ChildItem -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop; if (!$subKeys) { Write-Output 'Skipping: no subkeys available.'; return; }; foreach ($subKey in $subKeys) { $subkeyName = $($subKey.PSChildName); Write-Output """Processing subkey: `"""$subkeyName`""""""; $subkeyPath = Join-Path -Path $currentRegistryKeyPath -ChildPath $subkeyName; Clear-RegistryKeyValues $subkeyPath; }; Write-Output """Successfully cleared all subkeys in `"""$formattedRegistryKeyPath`"""."""; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
  2⤵
  PID:1840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SearchHistory'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Iterating subkeys recursively: `"""$formattedRegistryKeyPath`"""."""; $subKeys = Get-ChildItem -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop; if (!$subKeys) { Write-Output 'Skipping: no subkeys available.'; return; }; foreach ($subKey in $subKeys) { $subkeyName = $($subKey.PSChildName); Write-Output """Processing subkey: `"""$subkeyName`""""""; $subkeyPath = Join-Path -Path $currentRegistryKeyPath -ChildPath $subkeyName; Clear-RegistryKeyValues $subkeyPath; }; Write-Output """Successfully cleared all subkeys in `"""$formattedRegistryKeyPath`"""."""; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
  2⤵
  PID:4248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$pathGlobPattern = """$($directoryGlob = 'C:\Users\Admin\AppData\Local\Microsoft\Windows\ConnectedSearch\History'; if ($directoryGlob.EndsWith('\*')) { $directoryGlob } elseif ($directoryGlob.EndsWith('\')) { """$($directoryGlob)*""" } else { """$($directoryGlob)\*""" } )"""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host """Searching for items matching pattern: `"""$($expandedPath)`"""."""; $deletedCount = 0; $failedCount = 0; $foundAbsolutePaths = @(); Write-Host 'Iterating files and directories recursively.'; try { $foundAbsolutePaths += @(; Get-ChildItem -Path $expandedPath -Force -Recurse -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host """Initiating processing of $($foundAbsolutePaths.Count) items from `"""$expandedPath`"""."""; foreach ($path in $foundAbsolutePaths) { if (-not (Test-Path $path)) { <# Re-check existence as prior deletions might remove subsequent items (e.g., subdirectories). #>; Write-Host """Successfully deleted: $($path) (already deleted)."""; $deletedCount++; continue; }; try { Remove-Item -Path $path -Force -Recurse -ErrorAction Stop; $deletedCount++; Write-Host """Successfully deleted: $($path)"""; } catch { $failedCount++; Write-Warning """Unable to delete $($path): $_"""; }; }; Write-Host """Successfully deleted $($deletedCount) items."""; if ($failedCount -gt 0) { Write-Warning """Failed to delete $($failedCount) items."""; }"
  2⤵
  PID:2976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Iterating subkeys recursively: `"""$formattedRegistryKeyPath`"""."""; $subKeys = Get-ChildItem -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop; if (!$subKeys) { Write-Output 'Skipping: no subkeys available.'; return; }; foreach ($subKey in $subKeys) { $subkeyName = $($subKey.PSChildName); Write-Output """Processing subkey: `"""$subkeyName`""""""; $subkeyPath = Join-Path -Path $currentRegistryKeyPath -ChildPath $subkeyName; Clear-RegistryKeyValues $subkeyPath; }; Write-Output """Successfully cleared all subkeys in `"""$formattedRegistryKeyPath`"""."""; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Iterating subkeys recursively: `"""$formattedRegistryKeyPath`"""."""; $subKeys = Get-ChildItem -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop; if (!$subKeys) { Write-Output 'Skipping: no subkeys available.'; return; }; foreach ($subKey in $subKeys) { $subkeyName = $($subKey.PSChildName); Write-Output """Processing subkey: `"""$subkeyName`""""""; $subkeyPath = Join-Path -Path $currentRegistryKeyPath -ChildPath $subkeyName; Clear-RegistryKeyValues $subkeyPath; }; Write-Output """Successfully cleared all subkeys in `"""$formattedRegistryKeyPath`"""."""; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
  2⤵
  PID:1140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Iterating subkeys recursively: `"""$formattedRegistryKeyPath`"""."""; $subKeys = Get-ChildItem -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop; if (!$subKeys) { Write-Output 'Skipping: no subkeys available.'; return; }; foreach ($subKey in $subKeys) { $subkeyName = $($subKey.PSChildName); Write-Output """Processing subkey: `"""$subkeyName`""""""; $subkeyPath = Join-Path -Path $currentRegistryKeyPath -ChildPath $subkeyName; Clear-RegistryKeyValues $subkeyPath; }; Write-Output """Successfully cleared all subkeys in `"""$formattedRegistryKeyPath`"""."""; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
  2⤵
  PID:568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$pathGlobPattern = """$($directoryGlob = 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent Items'; if ($directoryGlob.EndsWith('\*')) { $directoryGlob } elseif ($directoryGlob.EndsWith('\')) { """$($directoryGlob)*""" } else { """$($directoryGlob)\*""" } )"""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host """Searching for items matching pattern: `"""$($expandedPath)`"""."""; $deletedCount = 0; $failedCount = 0; $foundAbsolutePaths = @(); Write-Host 'Iterating files and directories recursively.'; try { $foundAbsolutePaths += @(; Get-ChildItem -Path $expandedPath -Force -Recurse -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host """Initiating processing of $($foundAbsolutePaths.Count) items from `"""$expandedPath`"""."""; foreach ($path in $foundAbsolutePaths) { if (-not (Test-Path $path)) { <# Re-check existence as prior deletions might remove subsequent items (e.g., subdirectories). #>; Write-Host """Successfully deleted: $($path) (already deleted)."""; $deletedCount++; continue; }; try { Remove-Item -Path $path -Force -Recurse -ErrorAction Stop; $deletedCount++; Write-Host """Successfully deleted: $($path)"""; } catch { $failedCount++; Write-Warning """Unable to delete $($path): $_"""; }; }; Write-Host """Successfully deleted $($deletedCount) items."""; if ($failedCount -gt 0) { Write-Warning """Failed to delete $($failedCount) items."""; }"
  2⤵
  PID:4976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\MediaPlayer\Player\RecentFileList'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
  2⤵
  PID:412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\MediaPlayer\Player\RecentURLList'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
  2⤵
  PID:3364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Gabest\Media Player Classic\Recent File List'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Direct3D\MostRecentApplication'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
  2⤵
  PID:4208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$rootRegistryKeyPath = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU'; function Clear-RegistryKeyValues { try { $currentRegistryKeyPath = $args[0]; Write-Output """Clearing registry values from `"""$currentRegistryKeyPath`"""."""; $formattedRegistryKeyPath = $currentRegistryKeyPath -replace '^([^\\]+)', '$1:'; if (-Not (Test-Path -LiteralPath $formattedRegistryKeyPath)) { Write-Output """Skipping: Registry key not found: `"""$formattedRegistryKeyPath`"""."""; return; }; $directValueNames=(Get-Item -LiteralPath $formattedRegistryKeyPath -ErrorAction Stop | Select-Object -ExpandProperty Property); if (-Not $directValueNames) { Write-Output 'Skipping: Registry key has no direct values.'; } else { foreach ($valueName in $directValueNames) { Remove-ItemProperty -LiteralPath $formattedRegistryKeyPath -Name $valueName -ErrorAction Stop; Write-Output """Successfully deleted value: `"""$valueName`""" from `"""$formattedRegistryKeyPath`"""."""; }; Write-Output """Successfully cleared all direct values in `"""$formattedRegistryKeyPath`"""."""; }; } catch { Write-Error """Failed to clear registry values in `"""$formattedRegistryKeyPath`""". Error: $_"""; Exit 1; }; }; Clear-RegistryKeyValues $rootRegistryKeyPath"
  2⤵
  PID:1564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$pathGlobPattern = """$($directoryGlob = 'C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player'; if ($directoryGlob.EndsWith('\*')) { $directoryGlob } elseif ($directoryGlob.EndsWith('\')) { """$($directoryGlob)*""" } else { """$($directoryGlob)\*""" } )"""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host """Searching for items matching pattern: `"""$($expandedPath)`"""."""; $deletedCount = 0; $failedCount = 0; $foundAbsolutePaths = @(); Write-Host 'Iterating files and directories recursively.'; try { $foundAbsolutePaths += @(; Get-ChildItem -Path $expandedPath -Force -Recurse -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host """Initiating processing of $($foundAbsolutePaths.Count) items from `"""$expandedPath`"""."""; foreach ($path in $foundAbsolutePaths) { if (-not (Test-Path $path)) { <# Re-check existence as prior deletions might remove subsequent items (e.g., subdirectories). #>; Write-Host """Successfully deleted: $($path) (already deleted)."""; $deletedCount++; continue; }; try { Remove-Item -Path $path -Force -Recurse -ErrorAction Stop; $deletedCount++; Write-Host """Successfully deleted: $($path)"""; } catch { $failedCount++; Write-Warning """Unable to delete $($path): $_"""; }; }; Write-Host """Successfully deleted $($deletedCount) items."""; if ($failedCount -gt 0) { Write-Warning """Failed to delete $($failedCount) items."""; }"
  2⤵
  PID:2772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$pathGlobPattern = """$($directoryGlob = 'C:\Users\Admin\.dotnet\TelemetryStorageService'; if ($directoryGlob.EndsWith('\*')) { $directoryGlob } elseif ($directoryGlob.EndsWith('\')) { """$($directoryGlob)*""" } else { """$($directoryGlob)\*""" } )"""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host """Searching for items matching pattern: `"""$($expandedPath)`"""."""; $deletedCount = 0; $failedCount = 0; $foundAbsolutePaths = @(); Write-Host 'Iterating files and directories recursively.'; try { $foundAbsolutePaths += @(; Get-ChildItem -Path $expandedPath -Force -Recurse -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host """Initiating processing of $($foundAbsolutePaths.Count) items from `"""$expandedPath`"""."""; foreach ($path in $foundAbsolutePaths) { if (-not (Test-Path $path)) { <# Re-check existence as prior deletions might remove subsequent items (e.g., subdirectories). #>; Write-Host """Successfully deleted: $($path) (already deleted)."""; $deletedCount++; continue; }; try { Remove-Item -Path $path -Force -Recurse -ErrorAction Stop; $deletedCount++; Write-Host """Successfully deleted: $($path)"""; } catch { $failedCount++; Write-Warning """Unable to delete $($path): $_"""; }; }; Write-Host """Successfully deleted $($deletedCount) items."""; if ($failedCount -gt 0) { Write-Warning """Failed to delete $($failedCount) items."""; }"
  2⤵
  PID:4220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$pathGlobPattern = """$($directoryGlob = 'C:\Windows\Temp'; if ($directoryGlob.EndsWith('\*')) { $directoryGlob } elseif ($directoryGlob.EndsWith('\')) { """$($directoryGlob)*""" } else { """$($directoryGlob)\*""" } )"""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host """Searching for items matching pattern: `"""$($expandedPath)`"""."""; $deletedCount = 0; $failedCount = 0; $foundAbsolutePaths = @(); Write-Host 'Iterating files and directories recursively.'; try { $foundAbsolutePaths += @(; Get-ChildItem -Path $expandedPath -Force -Recurse -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host """Initiating processing of $($foundAbsolutePaths.Count) items from `"""$expandedPath`"""."""; foreach ($path in $foundAbsolutePaths) { if (-not (Test-Path $path)) { <# Re-check existence as prior deletions might remove subsequent items (e.g., subdirectories). #>; Write-Host """Successfully deleted: $($path) (already deleted)."""; $deletedCount++; continue; }; try { Remove-Item -Path $path -Force -Recurse -ErrorAction Stop; $deletedCount++; Write-Host """Successfully deleted: $($path)"""; } catch { $failedCount++; Write-Warning """Unable to delete $($path): $_"""; }; }; Write-Host """Successfully deleted $($deletedCount) items."""; if ($failedCount -gt 0) { Write-Warning """Failed to delete $($failedCount) items."""; }"
  2⤵
  PID:4680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "$pathGlobPattern = """$($directoryGlob = 'C:\Users\Admin\AppData\Local\Temp'; if ($directoryGlob.EndsWith('\*')) { $directoryGlob } elseif ($directoryGlob.EndsWith('\')) { """$($directoryGlob)*""" } else { """$($directoryGlob)\*""" } )"""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host """Searching for items matching pattern: `"""$($expandedPath)`"""."""; $deletedCount = 0; $failedCount = 0; $foundAbsolutePaths = @(); Write-Host 'Iterating files and directories recursively.'; try { $foundAbsolutePaths += @(; Get-ChildItem -Path $expandedPath -Force -Recurse -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host """Initiating processing of $($foundAbsolutePaths.Count) items from `"""$expandedPath`"""."""; foreach ($path in $foundAbsolutePaths) { if (-not (Test-Path $path)) { <# Re-check existence as prior deletions might remove subsequent items (e.g., subdirectories). #>; Write-Host """Successfully deleted: $($path) (already deleted)."""; $deletedCount++; continue; }; try { Remove-Item -Path $path -Force -Recurse -ErrorAction Stop; $deletedCount++; Write-Host """Successfully deleted: $($path)"""; } catch { $failedCount++; Write-Warning """Unable to delete $($path): $_"""; }; }; Write-Host """Successfully deleted $($deletedCount) items."""; if ($failedCount -gt 0) { Write-Warning """Failed to delete $($failedCount) items."""; }"
  2⤵
  - Deletes itself
  PID:4980

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:3264
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4064
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Ngen.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\Ngen.exe Update /Queue /Delay
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:736
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Ngen.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Ngen.exe Update /Queue /Delay
  2⤵
  - Drops file in Windows directory
  PID:4896

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:628

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

File Deletion

T1070.004

Network Share Connection Removal

T1070.005

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4f02e11630c35793ab192b0c2caf4c0c2c4f8926e52245f667fb4ba8dfdb0384
MD5 571c6a07ffe6fbbb641ac3f182b8eba6
SHA1 63b39c606e1e06593270874a29864acefa52de08
SHA512 861536287f735e61f13ad731cd825ba9268a16d956e8c2adeb16075bfb25f0e296e647eb1220369d4b48ed727413adfeebd27e0219c8c49bf8c16ef7120d0961
TLSH
T1F421A837B3DCC921CC86123A109D9C1072B283C7819ECF9F6FC0D604A07F989CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cd2c977928e78b2d39bba8a726308f17b2946ea3f1a432de209720f691450713
MD5 806286a9ea8981d782ba5872780e6a4c
SHA1 99fe6f0c1098145a7b60fda68af7e10880f145da
SHA512 362df97f9fc9c2f546538814cd0402a364a286326219f03325f8cbd59d33f9d850c26daf42230f0bb4feb7e5134868a51e7a3d2f5bc136fe3de69d5d82c5ae2e
TLSH
T15D21A837B3DC8921CC86163A109D9C1072B283C7819ECF9F6FC0D600A07F989CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

AppxProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\AppxProvider.dll
Size 554KB
SHA256 913f97dd219eeb7d5f7534361037fe1ecc3a637eb48d67b1c8afa8b5f951ba2f
MD5 a7927846f2bd5e6ab6159fbe762990b1
SHA1 8e3b40c0783cc88765bbc02ccc781960e4592f3f
SHA512 1eafece2f6aa881193e6374b81d7a7c8555346756ed53b11ca1678f1f3ffb70ae3dea0a30c5a0aab8be45db9c31d78f30f026bb22a7519a0930483d50507243f
SSDEEP 6144:TiBcTKZ54SpjXqHKVM8GoxYJwUbdjQzFAPdi3tebF5yf+Q6yLn7xTPBc3:uBFXWUcyziktebF5nn
TLSH
T1A5C4C61E67EC0514D0B6E1384AB79144FA7278221B3297CF6181D33D6F7BAE85E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssocProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\AssocProvider.dll
Size 112KB
SHA256 dc6a5930c2b9a11204d2e22a3e8d14c28e5bdac548548e256ba7ffa79bd8c907
MD5 94dc379aa020d365ea5a32c4fab7f6a3
SHA1 7270573fd7df3f3c996a772f85915e5982ad30a1
SHA512 998fd10a1f43024a2398491e3764748c0b990b37d8b3c820d281296f8da8f1a2f97073f4fd83543994a6e326fa7e299cb5f59e609358cd77af996175782eeaca
SSDEEP 1536:yV9TBLzWvVZtglIDIQdgDbEyuh9UHsTj2HUWli7HlzuTPxwQ:yH1uL6IdgDWjUHeEhyuTx
TLSH
T1FEB3C55A37EC9151E1B2A1388962864497B7BC605F3297EF20A0A33E4F73BD44D35B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CbsProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\CbsProvider.dll
Size 875KB
SHA256 4c9a4ab6596626482dd2190034fcb3fafebe88a961423962ad577e873ef5008f
MD5 6ad0376a375e747e66f29fb7877da7d0
SHA1 a0de5966453ff2c899f00f165bbff50214b5ea39
SHA512 8a97b2cc96ec975188e53e428d0fc2c562f4c3493d3c354e316c7f89a0bd25c84246807c9977f0afdda3291b8c23d518a36fd967d8f9d4d2ce7b0af11b96eb18
SSDEEP 12288:kqe4tO+jP4PZxP2gv4MefWfN3bGJ0mqs7xBU99l7gghi000U:ko4+UP3P2pMefWfN3bGJpv7QLl7hi0M
TLSH
T1D515D21D67FC0548E5F7A6B88A724654EAB2B8225B36D6CF0000C23D5E77BE04E75F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismCore.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\DismCore.dll
Size 402KB
SHA256 af7f342adf5b533ea6978b68064f39bfb1e4ad3b572ae1b7f2287f5533334d4e
MD5 b1f793773dc727b4af1648d6d61f5602
SHA1 be7ed4e121c39989f2fb343558171ef8b5f7af68
SHA512 66a92bff5869a56a7931d7ed9881d79c22ba741c55fb42c11364f037e1ec99902db2679b67a7e60cbf760740d5b47dcf1a6dcfae5ad6711a0bd7f086cc054eed
SSDEEP 6144:2pFC8Q92GEAjR53dcPFj2loO4KwbPnRKQo2:2pxQ92QjR5tEKCkK
TLSH
T1E794F81DB7EC4495E4BAA13449638649EAB2B4611F3293CF2390C33E6E33BD46A35F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismCorePS.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\DismCorePS.dll
Size 183KB
SHA256 e3b3a4c9c6403cb8b0aa12d34915b67e4eaa5bb911e102cf77033aa315d66a1e
MD5 a033f16836d6f8acbe3b27b614b51453
SHA1 716297072897aea3ec985640793d2cdcbf996cf9
SHA512 ad5b641d93ad35b3c7a3b56cdf576750d1ad4c63e2a16006739888f0702280cad57dd0a6553ef426111c04ceafd6d1e87f6e7486a171fff77f243311aee83871
SSDEEP 1536:UA5jxij1/4CL6FFJbK1hipbLEXt0GAwlPat:UA5jAj1QCL6FFJ+1hipPEXtpXlY
TLSH
T177042F47B6208423C828A232445B4E5EB7B5DF94D7D6079B2068727ECD7B3C19F396AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismHost.exe

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\DismHost.exe
Size 142KB
SHA256 e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80
MD5 e5d5e9c1f65b8ec7aa5b7f1b1acdd731
SHA1 dbb14dcda6502ab1d23a7c77d405dafbcbeb439e
SHA512 7cf80d4a16c5dbbf61fcb22ebe30cf78ca42a030b7d7b4ad017f28fba2c9b111e8cf5b3064621453a44869bbaed124d6fb1e8d2c8fe8202f1e47579d874fa4bc
SSDEEP 1536:16iNEP0SZpv0aVyo0rbRmiUwhjgPp9X6E79KfmeCUhNs4+Au0ceacoM1f/TnbsnG:1rEME0FgH6ERKf3/lb/Rw2siUuaqR
TLSH
T108E3191E77A92099D166913C8285824AF7B2BC30171257EF16E0E27D5F33AD8BE39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DmiProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\DmiProvider.dll
Size 415KB
SHA256 04f851b9d5e58ed002ad768bdcc475f22905fb1dab8341e9b3128df6eaa25b98
MD5 ea8488990b95ce4ef6b4e210e0d963b2
SHA1 cd8bf723aa9690b8ca9a0215321e8148626a27d1
SHA512 56562131cbe5f0ea5a2508f5bfed88f21413526f1539fe4864ece5b0e03a18513f3db33c07e7abd7b8aaffc34a7587952b96bb9990d9f4efa886f613d95a5b1b
SSDEEP 6144:Hx/vIsFo3S/cEeMykrx++h0kra+gIEmHK:Hx/vrs0FeGxf7ZVK
TLSH
T18C94C41DE7EC4854F4F2A27849728644E6B2BCA49B72D2CF1180D23D0E73BE46D75B4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FfuProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\FfuProvider.dll
Size 619KB
SHA256 56cc8d139be12e969fff3bbf47b1f5c62c3db887e3fb97c79cf7d285076f9271
MD5 df785c5e4aacaee3bd16642d91492815
SHA1 286330d2ab07512e1f636b90613afcd6529ada1e
SHA512 3566de60fe76b63940cff3579da94f404c0bc713f2476ba00b9de12dc47973c7c22d5eed1fd667d20cea29b3c3c4fa648e5f44667e8369c192a4b69046e6f745
SSDEEP 6144:Dl7JmNA6s7wJzYlfa4QsFIKDys3NvGvcIKifgRw/zJkwT/F0MOAYIfsA46ItKata:Dld6A67qjFVKVSw/au2A4DclSZkL
TLSH
T1C2D42A1D72FC0195E1BB96788A634225E6B2B8302B3196CF1160D27D9F27BD09F79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FolderProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\FolderProvider.dll
Size 59KB
SHA256 a235317ab7ed89e6530844a78b933d50f6f48ea5df481de158eb99dd8c4ba461
MD5 4f3250ecb7a170a5eb18295aa768702d
SHA1 70eb14976ddab023f85bc778621ade1d4b5f4d9d
SHA512 e9ce6cced5029d931d82e78e7e609a892bfe239096b55062b78e8ff38cce34ce6dd4e91efb41c4cd6ecf6017d098e4c9b13d6cb4408d761051468ee7f74bc569
SSDEEP 1536:sexLd+GGpAR1uFs4mrYNjTURz6dZiFj1EOt4Pf2:skUG+EIFRb9TURz8iFJEOt4n2
TLSH
T12353295ABBEC9081E0319078C96B8F09F5B6F1201B1257EF11A4C37E2F777C49A35A59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GenericProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\GenericProvider.dll
Size 149KB
SHA256 d39f38402a9309ddd1cba67be470ede348f2bc1bab2f8d565e8f15510761087a
MD5 ef7e2760c0a24453fc78359aea3d7869
SHA1 0ea67f1fd29df2615da43e023e86046e8e46e2e1
SHA512 be785ba6b564cc4e755b4044ae27f916c009b7d942fcd092aed2ae630b1704e8a2f8b4692648eed481a5eb5355fd2e1ef7f94f6fb519b7e1ff6fc3c5f1aaa06f
SSDEEP 3072:WvIVEykJhkBPNN9/Y/6xOi/xHVpbe01cPKZoq:WvsEyChkBPNN9NNDbeacPLq
TLSH
T100E3D61D37EC6165E062623889668648E3B3B8605B2297EF11D0D33E4F73BD86D35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IBSProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\IBSProvider.dll
Size 59KB
SHA256 5425382aaa32ffc133adb6458ff516db0e2ad60fac52dd595d53c370f4ba6fa0
MD5 120f0a2022f423fc9aadb630250f52c4
SHA1 826df2b752c4f1bba60a77e2b2cf908dd01d3cf7
SHA512 23e50735c06cef93d11873fc8e5e29fc63dcf3f01dc56822a17c11ca57bbfb10d46fac6351f84ba30050a16d6bd0744a08a4042a9743a6df87ac8a12e81e2764
SSDEEP 768:hANsBtL+LsOHEeZMG8c4cWamUMvyARy0VnrI3Lebvdqvp7UYr6wD1PQb8/:UmsLsOkeacfmDjZriSTU22P28/
TLSH
T1CD534A69BB9C8081E42151788967CE49E5B6FC605F1207DF22B4F32E1F737C89A35BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImagingProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\ImagingProvider.dll
Size 218KB
SHA256 874137ee906f91285b9a018735683a0dd21bdeaf2e340cbc54296551ccf8be2d
MD5 35e989a1df828378baa340f4e0b2dfcb
SHA1 59ecc73a0b3f55e43dace3b05ff339f24ec2c406
SHA512 c8d69e37c918881786a8fdab2a2c5d1632411b1f75082aeb3eb24a8ba5f93dcb39b3f4000e651f95452263525d98fd1d3cb834de93bed16fa6f92ef271c3a92a
SSDEEP 6144:SR2jvbWvfuzAWkVUtqlk7AlP1GB2wNBG6:SR2ymvkm2wNf
TLSH
T17624D40E26EC4059E5AB667848A24A45A773B8205B3193CF2190C33D5F73BC8FD75FA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntlProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\IntlProvider.dll
Size 296KB
SHA256 1bb39f3389aa4258a923fa265afa2279688e6cdb14ff771f1621a56b03ddcf52
MD5 510e132215cef8d09be40402f355879b
SHA1 cae8659f2d3fd54eb321a8f690267ba93d56c6f1
SHA512 2f7b2ec0e94738838f755759cd35e20ab2138b8eca023ee6ef630ab83a3de1bc0792f12ea0d722abe9a6953626cbddf8ba55ea32fc794d2df677a0625e498ab0
SSDEEP 6144:D20d1ONlCQZ8RWbKJqHVp13hbTPaTUMPo+WKOLv:K0d1O7CQuRhJGjgUYWHLv
TLSH
T13D54D70933E90858FDB7A63C99B7824597B3BC216B31D6CF1190827D4E77BD4A934B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\LogProvider.dll
Size 77KB
SHA256 a9c8787c79a952779eca82e7389cf5bbde7556e4491b8bfcfd6617740ac7d8a2
MD5 815a4e7a7342224a239232f2c788d7c0
SHA1 430b7526d864cfbd727b75738197230d148de21a
SHA512 0c19d1e388ed0855a660135dec7a5e6b72ecbb7eb67ff94000f2399bd07df431be538055a61cfb2937319a0ce060898bb9b6996765117b5acda8fc0bad47a349
SSDEEP 1536:X9mLBNlc4Rd1wbNA7elgn0+r+GEJ8a0qMX0Igx7DAJoNxPyCp:XMLlBRd1kSels+T8a0qMX0Igx7DAJoN7
TLSH
T1A373071A67EC6049F072A13889728B49E6B2F4606B3243EF5194C37E1F37BD49E34B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsiProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\MsiProvider.dll
Size 207KB
SHA256 7ff3939e1ef015da8c9577af4edfdd46f0029a2cfe4e3dac574d3175516e095f
MD5 9a760ddc9fdca758501faf7e6d9ec368
SHA1 5d395ad119ceb41b776690f9085f508eaaddb263
SHA512 59d095246b62a7777e7d2d50c2474f4b633a1ae96056e4a4cb5265ccf7432fed0ea5df9b350f44d70b55a726241da10f228d8b5cbee9b0890c0b9dc9e810b139
SSDEEP 3072:lAHjL5MM39qnOOL1QZaFsrMQ72dmTcWI+fByuc+RAuI/bB0MoutygIQlUoMIVWE:lAHfyMkraaSrGwnjfBIXbdtyyx
TLSH
T15824E51933ED5055E5F661388DA68A84A6B3BC206F3297CF1290933D4E73BC4BD70B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\OSProvider.dll
Size 149KB
SHA256 2165d567aa47264abe2a866bb1bcb01a1455a75a6ea530b1b9a4dda54d08f758
MD5 db4c3a07a1d3a45af53a4cf44ed550ad
SHA1 5dea737faadf0422c94f8f50e9588033d53d13b3
SHA512 5182b80459447f3c1fb63b70ad0370e1da26828a7f73083bec0af875b37888dd12ec5a6d9dc84157fc5b535f473ad7019eb6a53b9a47a2e64e6a8b7fae4cddde
SSDEEP 3072:mT/wD4tK821qqa4SzpVYJyAu27gH3MgDXGy:mTasK6LpVObgH9DX
TLSH
T1CDE3E51977ED1095E1FAA57889B58A49E6B3B4201B3293DF1190C33D5E33BC8AE31F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfflineSetupProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\OfflineSetupProvider.dll
Size 182KB
SHA256 b38d322af8e614cc54299effd2164247c75bd7e68e0eb1a428376fcedaca9a6f
MD5 9cd7292cca75d278387d2bdfb940003c
SHA1 bab579889ed3ac9cb0f124842c3e495cb2ec92ac
SHA512 ebf96839e47bef9e240836b1d02065c703547a2424e05074467fe70f83c1ebf3db6cb71bf0d38848ec25e2e81b4cbb506ced7973b85e2ab2d8e4273de720779d
SSDEEP 3072:bk8F4zlDtDlWY32LCG3F4l96gsFYrykP57S7moSFiO36CzPvOFX:bk8OzljW3CoSl9eOmU7sbE7PA
TLSH
T17104071937EC5055E0B3A2788A664A85E6B3BC205F3292DF1190D33D4E33BD8BD35B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProvProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\ProvProvider.dll
Size 753KB
SHA256 a3e652c0bbe2082f2e0290da73485fb2c6e35c33ac60daa51a65f8c782dbd7a7
MD5 70c34975e700a9d7e120aaecf9d8f14b
SHA1 e24d47f025c0ec0f60ec187bfc664e9347dc2c9c
SHA512 7f6a24345f5724d710e0b6c23b3b251e96d656fac58ea67b2b84d7d9a38d7723eae2c278e6e218e7f69f79d1cce240d91a8b0fd0d99960cacc65d82eb614a260
SSDEEP 12288:X/ck9AStILSQfhJI1UOAibcu978/ftYEGVRU8rbcgWte6QP:PckaLSQpJI1UeUKEKFfetTQP
TLSH
T1D6F42A1E77FC01A9E4BBD1388A624656EAB2B43027319ACF1150C27D5F2BBE05E39F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupPlatformProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\SetupPlatformProvider.dll
Size 159KB
SHA256 367e73f97318b6663018a83a11019147e67b62ab83988730ebbda93984664dd3
MD5 1ae66f4524911b2728201fff6776903c
SHA1 68bea62eb0f616af0729dbcbb80dc27de5816a83
SHA512 7abf07d1338e08dc8b65b4f987eaff96d99aa46c892b5d2d79684ca7cf5f139d2634d9b990e5f6730f7f8a647e4fbb3d5905f9f2a5680250852671599f15ee69
SSDEEP 3072:Z5h05CD/pmthkAKPXzXDhfjCN6XbU7focR/lMmrcAK7kG0:Z5T+4Q+b4t1rb
TLSH
T19CF3D41A37EC5055E1B2A23889668685E773BC205B3297EF1190D33E4E377D8AD35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmiProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\SmiProvider.dll
Size 246KB
SHA256 ac1e7407317859981d253fd9d977e246a4d0da24572c45efe0ade1745376bffb
MD5 ad7bbb62335f6dc36214d8c9fe1aaca0
SHA1 f03cb2db64c361d47a1c21f6d714e090d695b776
SHA512 4ad7132f0ad5a7228ec116c28d23ee9acfdbf4adf535b0b9995f2e7eec8776e652a0a18539c02b6f4b3e0c8fa2f75d5181577dec16993fa55cb971d7e82faac5
SSDEEP 6144:43ur8J+YA8/n0ohAKawrmTt8xANEyQMyQO:eur8Jb5n0DKawqFryv
TLSH
T1A6344B1A73DC0CB5E9BB91388967C606EAB2B8202711D2CF1260923D1F37BD4AE7D755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SysprepProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\SysprepProvider.dll
Size 778KB
SHA256 f9b4d0afe87f434e8319556961b292ddc7d3a8c6fc06b8a08a50b5a96e28a204
MD5 8bd67d87dbdcf881fb9c1f4f6bf83f46
SHA1 10bd2e541b6a125c29f05958f496edf31ff9abb1
SHA512 258a4075a3149669ccd6ff602f71a721b195c9d15dea22d994d4d3e35cdf27beb0b8b8f5da8f52914f769642f89edbb1d9d857087778be713a874571a2ec6f89
SSDEEP 6144:LxNAWynmU7aAbLZPrrAQGGhYMb39YDNWUzWfpI9WSj:LxNAHVRXlrrNGGhYEYDMU06
TLSH
T11905F829BF9C9861D2BA963BC5738941F6B634209BA0A7CB9175023D8F3F7C45A35F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransmogProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\TransmogProvider.dll
Size 1.3MB
SHA256 943ea79ccbbb9790723f411720777af386acc03efab709ac2cbfeb7bd040a3e4
MD5 84ae9659e8d28c2bd19d45dbe32b6736
SHA1 2a47058eafab4135a55575a359fbd22390788e93
SHA512 d108a4a8699cd98576a5de9ce2f925697ece546fb441a76db6a922564ea70c54449cb1e8ac049a203979331c2c0ee7790d090ae5bb72d8d5e02786ef1cca530d
SSDEEP 6144:HToonFk/rImaNz2NrE5M+Lx2xZ5SLi+zJ7ap35sKoex4aHyNu0OONLjJnNckM3BH:HTK/rIm2hsZ5Uy54raqA3BruMVDn
TLSH
T1295500386AF90625F4B39B75D9B76585AD32BC227A008EDF0091421E4D27F929C74F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnattendProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\UnattendProvider.dll
Size 228KB
SHA256 05da5af89fafe492adf5255a7dbf16468be6d130ee8a9d713ab2182c72346db0
MD5 f7bd21c4170b1397eb098fa18ef45d4b
SHA1 05d36abc4853eda468eab68d289337962c76195f
SHA512 8a804bfe27f25b9d7c87cfb6951e1f1254e984ff9eada0b1547c30352397438d2c9e2f1c3b42c2db43f693b08224e0c7b7a17cd0b21ced893e12c330b91355ff
SSDEEP 3072:U5RPXs5dU+8lC5XR1fxASaatsXYtRJJedgkEfxveZLCpbb31nAQ5mM3iLa:U5VXs5dU+H5B1mSP2qR6C5eZ+tdF33
TLSH
T15B344C2A73EC48A1E86391398A53C649F5B3B8201B21D7CB1260937D1F3BBE46E3D755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VhdProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\VhdProvider.dll
Size 560KB
SHA256 4ed23b46188dae12523f96a2755434c0574cd27584f9921133b0b4c1017b8a36
MD5 c6488a9b3569230669c72f3239cbc108
SHA1 87b9b2ab5de52f246c1936480463bd402ad519b9
SHA512 47ae886893032306e9b69b2d1c736ce23061b5be7552d2ed1d680b91e45fe0225b5acb12b83f6d572ef0b270dbaa47af3320516f4bfadb0a2889a9ffed45a66f
SSDEEP 12288:lMGhMClUooBhkCcBrFRvLR5VJV8zZPhj/:lnVl9of0k1hj/
TLSH
T179C44A2DB7FC4398E5B7913449724945EAB2B8202B31AACF1190C27D5F3BBD49E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WimProvider.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\WimProvider.dll
Size 589KB
SHA256 8b7821a1fb9170c6aa1ec25eea378f43661812eba25064bb95999156b472c377
MD5 229df404d67e69e57f9e284a66f2adeb
SHA1 7f4f703dbe8c274f5104d4d104dafcadf0c3857b
SHA512 917912cdfcf1d46f691cadc6e7aaae1a302a66721beec0e9b22e394592b290605caf410221045f2ce89896e5d9602ee4946202f2de9390e92c8aaa5a609b3a54
SSDEEP 12288:5DRxJyz+Fy8XVXNjHSUrSA9Jzs1KOUnZyiZ:5DRxQz+xXBdrr999uvUEiZ
TLSH
T187D4191DABFC0665E5B7A17849728A45EAB2F8241B3196CF1090C23D5F37FE04E36B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dismprov.dll

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\dismprov.dll
Size 255KB
SHA256 ef1e263e1bcc05d9538cb9469dd7dba5093956aa325479c3d2607168cc1c000a
MD5 490be3119ea17fa29329e77b7e416e80
SHA1 c71191c3415c98b7d9c9bbcf1005ce6a813221da
SHA512 6339b030008b7d009d36abf0f9595da9b793264ebdce156d4a330d095a5d7602ba074075ea05fef3dde474fc1d8e778480429de308c121df0bf3075177f26f13
SSDEEP 3072:cKvrcFu+XXythARfaBAUGNDBOZlUsJY/xL6LyzH7vt/MEhpw9nF:kFBXytcaCUGbOZlUsJaxO2z7vtxhK
TLSH
T1D744F81D77ED1C55F8B6A13889628A48E6B3B8204B31D2CF1190D33D9E37BD8AD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppxProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\AppxProvider.dll.mui
Size 22KB
SHA256 8af0073f8a023f55866e48bf3b902dfa7f41c51b0e8b0fe06f8c496d41f9a7b3
MD5 bd0dd9c5a602cb0ad7eabc16b3c1abfc
SHA1 cede6e6a55d972c22da4bc9e0389759690e6b37f
SHA512 86351dc31118fc5a12fad6f549aa60c45ebe92b3ce5b90376e41f60d6d168a8a9f6c35320fc2cdcc750e67a5751651657fe64cf42690943500afd0d1dae2cd0c
SSDEEP 192:WqLBjDHbtptJt5MNxWJtrtutAtKt0tptj/eCk6tf6voFeSMoLH7/x9Wg+WA:WqLJDrLpMyYWbWoFelCH7Z9Wg+WA
TLSH
T1DFA24E4236FA5119F2F77BB86AB716650F7FFD62E934C60C1258511E0FA3A818C64B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssocProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\AssocProvider.dll.mui
Size 8KB
SHA256 b18c6ce1558c9ef6942a3bce246a46557c2a7d12aec6c4a07e4fa84dd5c422f5
MD5 8833761572f0964bdc1bea6e1667f458
SHA1 166260a12c3399a9aa298932862569756b4ecc45
SHA512 2a907354ec9a1920b9d1d2aeb9ff7c7314854b36a27f7d88aca17825e74a87413dbe7d1c3fde6a2410b5934f8c80a76f8bb6b7f12e7cfc643ce6622ca516d9b8
SSDEEP 192:x/Akc8dT8EC1y/vYsCAFdUTFLrNmAYKkA48UGtqWKKWr:TtsRbIWKKWr
TLSH
T133F13A8263FE1659F1F76F796ABB22210EBF7C559C39D61C1688521D1BA3900C8B0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CbsProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\CbsProvider.dll.mui
Size 53KB
SHA256 d7a0253d6586e7bbfb0acb6facd9a326b32ba1642b458f5b5ed27feccb4fc199
MD5 6c51a3187d2464c48cc8550b141e25c5
SHA1 a42e5ae0a3090b5ab4376058e506b111405d5508
SHA512 87a9e997d55bc6dbd05af1291fb78cd02266641d018ccfeb6826cb0de205aaf8a57b49e587462dbb6df2b86b54f91c0c5d3f87e64d7dbb2aea75ef143c5447ba
SSDEEP 768:s34QoxGHbXqhu7dCJ6zoROa9fOLBzZoL/ug:s34QoxGHb6huJCJ6zoROa9fou/ug
TLSH
T14A33BF5163FE5509F2F77FB85AB606694F7BBCA2E839D61C1294111E0AB3E408D60B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismCore.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\DismCore.dll.mui
Size 7KB
SHA256 f91e3c35b472f95d7b1ae3dc83f9d6bfde33515aa29e8b310f55d9fe66466419
MD5 7a15f6e845f0679de593c5896fe171f9
SHA1 0c923dfaffb56b56cba0c28a4eacb66b1b91a1f4
SHA512 5a0373f1fb076a0059cac8f30fe415e06ed880795f84283911bec75de0977baf52432b740b429496999cedf5cca45efd6ef010700e2d9a1887438056c8c573ca
SSDEEP 96:w4aiiiWwdwCg/PCpQcBK8Cq9ovnwEWDOWwo:JpaJWDOWn
TLSH
T170F1BE0667FE8219F9F73B349AB50AB51E7A7C92B979D32D9740101E1DB1A408CB0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DmiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\DmiProvider.dll.mui
Size 17KB
SHA256 73709c25dc5300a435e53df97fc01a7dc184b56796cae48ee728d54d26076d6c
MD5 b7252234aa43b7295bb62336adc1b85c
SHA1 b2c42a5af79530e7cf9bcf54fd76ae9d5f234d7f
SHA512 88241009b342eb1205b10f7725a7cb1ec2c7135606459d038c4b8847efd9d5e0ad4749621f8df93746dd3ba8ab92d1b0f513ed10e2ba712a7991716f4c062358
SSDEEP 192:C53q+0W6eHJr6dVD4hN2J63092HdHUcbR1b0apWuzWRvWt:g6eHJr6dVwH3J9bbvbHpfzWRvWt
TLSH
T1FD828F02A3FE4219F5F33B7469BA02751A7ABC92FDB9D61C1244211D1EB3E508DA1B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FfuProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\FfuProvider.dll.mui
Size 9KB
SHA256 ba6695148f96a5d45224324006ae29becfd2a6aa1de947e27371a4eb84e7451a
MD5 dc826a9cb121e2142b670d0b10022e22
SHA1 b2fe459ede8ba99602ae6ea5fa24f0133cca2bc9
SHA512 038e9abff445848c882a71836574df0394e73690bc72642c2aa949c1ad820c5cbb4dedc4ee7b5b75fd5ac8a43813d416f23d28973de7a7f0e5c3f7112da6fe1b
SSDEEP 192:/9Ulo7nI+5XnEhLADlDS+d4LfS65Xocb1CEdWcCWn:DLI+5XQL+d4LfS65XJBCEdWcCWn
TLSH
T17112CC0273FE551DF6F7BB786AB612210A3BBC95A879D71C0298111C1FE3A5088B1B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FolderProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\FolderProvider.dll.mui
Size 2KB
SHA256 c81a992ecebd9260ff34e41383aaca1c64a9fa4706a4744ac814f0f5daa1e105
MD5 22b4a3a1ec3b6d7aa3bc61d0812dc85f
SHA1 97ae3504a29eb555632d124022d8406fc5b6f662
SHA512 9329b60a60c45b2486000ed0aff8d260fdac3d0a8789823eaa015eab1a6d577012f9d12502f81bad9902e41545c3c3e77f434bc1a753b4f8430d01db2cdbe26c
TLSH
T11551DD4297F7062AF4EA0B3429B70A621A3E7D21AA66D32E8F00112D7C707049CB1F73
MD5 SHA1 SHA512 TLSH

Submit Download

GenericProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\GenericProvider.dll.mui
Size 5KB
SHA256 9102fa05ed98d902bf6e95b74fdbb745399d4ce4536a29607b2156a0edfeddf0
MD5 d6b02daf9583f640269b4d8b8496a5dd
SHA1 e3bc2acd8e6a73b6530bc201902ab714e34b3182
SHA512 189e87fcc2902e2a8e59773783d80a7d4dd5d2991bd291b0976cbd304f78bd225b353703735b84de41b5f59c37402db634c4acc805d73176cde75ca662efff50
SSDEEP 48:ycW8d55p3lDPjLULeCH8C/FcWNlGHQlzQttIZWO9u8bK5WwHgw:l3lD3COWAcQLEWAeWwf
TLSH
T1CEB10405A7FF151AF4F72B3496B645A50B7FBC12B4B6D32E8B48111C1EA2A444CA0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IBSProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\IBSProvider.dll.mui
Size 2KB
SHA256 4ccfe7883bce7785b1387ad3872230159899a5337d30a2f81a937b74bcbc4ce5
MD5 d4b67a347900e29392613b5d86fe4ac2
SHA1 fb84756d11bfd638c4b49268b96d0007b26ba2fb
SHA512 af0a2a3f813e1adfff972285c9655f50ce6916caaeff5cb82f6c7d76491ffc9b365a47f19750fc02d7122182bf65aae79ed167886c33f202d5a781ab83d75662
TLSH
T10051C10297F71226F0EA073456F74A62567E7D26BAA6A32F8F40112C3C741199DB0F73
MD5 SHA1 SHA512 TLSH

Submit Download

ImagingProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\ImagingProvider.dll.mui
Size 18KB
SHA256 32d8c8fb9a746be209db5c3bdad14f361cf2bef8144c32e5af419c28efd35da3
MD5 f2e2ba029f26341158420f3c4db9a68f
SHA1 1dee9d3dddb41460995ad8913ad701546be1e59d
SHA512 3d45d7bcf21d5df56b516fc18f7dc1bf80e44258b0c810b199a7bc06047a547060956c9d79575b82d9b6992fb5fe64f5b0ef1e408363887ae81a64b6ff9fa03e
SSDEEP 384:WEPs6ATPNW8mc8jRd9kPQ/ih6uXJeEkWblWk:WEPs6MFW8l8jr9L/ihcEZJ
TLSH
T1BB82DC0123FE1109F2F77F7969B712254B3BBCA6A874D65C12A8A15D1BF3E408864B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntlProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\IntlProvider.dll.mui
Size 27KB
SHA256 aa43b64db4fdcd89e56ba5309f3ba2ffac2663ba30514e87c160687f4314221f
MD5 2eb303db5753eb7a6bb3ab773eeabdcb
SHA1 44c6c38e6ae5f9ce9d7ca9d45a3cc3020b1353e4
SHA512 df1c8cefed4b5ef5a47f9bc0c42776611b3af709938a0900db79c6c9f4fae21acbbb6c4b1cad3c5a2051b622fe7e6e01486d34622742a981623fed933f1b1427
SSDEEP 192:FmXnvvMzYr9Hw2PWJh0nCI2rFvAp2ZHwdg/nGaZ5XJVFLdcgUrWLD/QWQ0QdQJWC:FOn3MMbnGjGClJVFa0bQWQ0QdQJWZ4Wq
TLSH
T1E1C2BC41A2FA511DFAF73F756CBA01614B7BBC66BC79E60C1288015E4FA3A448D60B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\LogProvider.dll.mui
Size 6KB
SHA256 6e51af7cfda6be5419f89d6705c44587556a4abffd388020d7f19e007e122cd6
MD5 8933c8d708e5acf5a458824b19fd97da
SHA1 de55756ddbeebc5ad9d3ce950acba5d2fb312331
SHA512 ead5017d9d024a1d7c53634ae725438ea3a34eed8c9056ebbc4ebe5aab2055c0e67687ce7608724e4f66f55aa486a63024967b76a5638cde3dd88b3d3432ca1f
SSDEEP 96:zXM6czix6RXToVSHvoXBD3LXnvoJnoN6yvG8vIUEWNrWwv:LMniIh0IHAXB7DnAJoN6yO8wFWNrWA
TLSH
T13AC1D502A7FF521DF5FA3B30A97506B50BB6BC96F93AD32D574012185CB1A049DA0BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\MsiProvider.dll.mui
Size 15KB
SHA256 1ec7b04a8c25812db99abec82c7b7bf915ae3f7594c5d071231cafab9c1fa145
MD5 c5e60ee2d8534f57fddb81ffce297763
SHA1 78e6b0e03c8bf5802b3ef429b105d7ae3092a8f2
SHA512 ce654295e8b16da7bd004453ae4a422fe8296a8c2343e56d819883b835c391a02537ecf4d155a281a9d38f2291ee0004506b7fd48a99c0f8881ff1e38ae8ebcc
SSDEEP 96:2TRzAa2VDHWUt1qaoe3em2G6BHWPrem2vopuLcvy6em2bxVoa/b1mA5ICHH00H0X:2TRSDzRXQdoa/5ICH/AbQZL8ZK1WcoWc
TLSH
T1E7628B1273FE5109F5F32B39AAB712A10E3F7C52A979D65D1298150D4EA3E809CB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\OSProvider.dll.mui
Size 3KB
SHA256 b6758aba17f6cd74923ca0976dd580222851ef6435cd16b3b2b04e85280ce706
MD5 0633e0fccd477d9b22de4dd5a84abe53
SHA1 e04fb5c3acb35d128c1ea6ee6fb0e9b3fe90d5a9
SHA512 e95ed1d8069d6f200f0a2ea8dd7688404af9db9ce5e229afcb625a1f9eb46ac9e7a1c2c4c5ce156b190514415679e82e213732e8e890ed1a89af9026e4e73fe3
TLSH
T15D5109055BFB061AF0FA2B3156F705E55B7E7C13B9B2A32F8B50111D68A46149CA0F73
MD5 SHA1 SHA512 TLSH

Submit Download

OfflineSetupProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\OfflineSetupProvider.dll.mui
Size 2KB
SHA256 692744ce4bba1e82ad1a91ab97eec2bac7146bc995e8e8ed59bc2c7d366af7ec
MD5 015271d46ab128a854a4e9d214ab8a43
SHA1 2569deff96fb5ad6db924cee2e08a998ddc80b2a
SHA512 6ba678da0475a6b1872c2e2c151b395a4d97390bed4671d3f918aab5e69cbc9ceafe72c3100ba060ac6586fd37682499fdeef7d7b1ab10f5ec2411c1438ed438
TLSH
T12B51CF42A7F71629F4EE073466FB4A66563F7D21A972E32E4B40112C3C705059DA1F33
MD5 SHA1 SHA512 TLSH

Submit Download

ProvProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\ProvProvider.dll.mui
Size 4KB
SHA256 50ad19e21b6425d12aa57cd4656748877db1f147189ec44abb19ba90be8505ea
MD5 b8a8c6c4cd89eeda1e299c212dc9c198
SHA1 f88c8a563b20864e0fc6f3d63fadda507aa2e96e
SHA512 4a6f0dac5b3b18e4942ce5f51b566ce3ba465baa43457384ee785d1c0e7c33f9b9396a143aac0398a34e4e2f7d704ba06d3cc68761fd3cb6f53f4043a906e475
SSDEEP 96:aQt9FbyFAMLhFAgd+J8W8kyMLLyDEWQWSZWwA:aQt9wDlYOKWQWSZW/
TLSH
T1A391450267FA0159F0F71BB99AF749B20B7EFC53A671E32E4704111D2CA2A459DA0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupPlatformProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\SetupPlatformProvider.dll.mui
Size 5KB
SHA256 5d4dfc9bde18be1ec0b3834a65de6abab581e04c8c4f66ee14a62fb4b1b4cd06
MD5 73e78fbbf6e6679fa643441c66628d37
SHA1 57b70e6226c0cf3f8bc9a939f8b1ec411dedeff5
SHA512 a045a6cdf9ca989b3ed9a50cda208affa17372f65b1d86e1bf4c10b5d5e3fee58c5d4b8ec0749a54e2e2156ed0e9776b59a8d3b78f062349873cb574ab3f77fa
SSDEEP 96:pZlYgKFEK42hK+UKd2K0bKGSnk5KABKzSnku7jh7rUC47j797UOSEW6XWwZ:JH3UgRlI6rjzp543pDW6XWK
TLSH
T196C1B446ABEA0169F1F73F74BAB616A10FBE7C52B936E71E4754051D18B0608DCA0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\SmiProvider.dll.mui
Size 2KB
SHA256 a1a302e940f6d6718700737b787af7a2053ef68b5ea2ec61497e7ae2444c5835
MD5 f32e38247d0b21476bbfb49989478f7e
SHA1 b950fd72ea2a6a94ee049454df562aed79ca1e35
SHA512 f483807d790a4bc3e68d6d1f986bd4a57b4a67c91fb3dbef88220a4b510f11d1190cdd98a857eb1937e921e668dff2bcb5e4a7df640b1f3639ce6d2239ff8106
TLSH
T1A051C30297FB162AF4EE0B3556F70A56173E7D12A666A32E8F00112D38705099DB0F77
MD5 SHA1 SHA512 TLSH

Submit Download

SysprepProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\SysprepProvider.dll.mui
Size 3KB
SHA256 4389362a9dc662aa3c7a1d830498472bc586e00f0d269a8541975a34b03a1aa4
MD5 93d076056dd01dfc64d95d4c552a2dff
SHA1 a90fd06a62c6d63d87e00f5f7e9646b44d2c726a
SHA512 b089574d4be0ccae205219c9e256de34c039081a547f05acfe4165d036b175de5d9676160effc3c19d87bbb41d0f415da598e507ed8f7b302cdbfdfb81f694ee
TLSH
T12451D4496BE71527F0AA0F3197E605E15FBD7C13B6A7A73FCF00111928A150899E0FB6
MD5 SHA1 SHA512 TLSH

Submit Download

TransmogProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\TransmogProvider.dll.mui
Size 16KB
SHA256 a75288f9e83cccf2a6a644ff78e6c26dadd5772a2626f80120b81975664e7dab
MD5 2138fda89b1a5a18b32aed1d8762cde5
SHA1 a476f7dc86e62c7dc0edf27bb778174348cac566
SHA512 d7cbf569b5d57730c81fc121e92e1042a37e07922c02f36efac3769622f40234c70dafe9ed88a659d90c3855b5240f67f99b55ddecc46eea0e28e5b80ecc820b
SSDEEP 384:fwVXFYiKdshYuUljq9ZBjEx2F2u00yta8drwz5Kfo9IT5p9bfL0rdrBhrPZgmvwZ:fwVXFYiKdshYuUljYZBjExk2u00yta8R
TLSH
T17972BE0163FD4109F6F73B3999BA1A610E7BBC9AE879D71D12D4111E4EA2F408DA0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnattendProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\UnattendProvider.dll.mui
Size 5KB
SHA256 11f7957b8cc57dd7176f62b0612e658d6588b7caa8be4db3a337953b02b98c24
MD5 8acee3337dfd444254bb8abdd3c29ada
SHA1 25d98d3426f32fa199c026b6eb829b469609b2e3
SHA512 2849978060fa6e1fcfa37c870ae59ef22a67c0f8653468e07803422497fcc7275409ed0c36fe2d8e88026c13c82705abed771b4492761eead24cb5c32bdf2ea7
SSDEEP 48:y/h+1FX3/zNs8l8kBcxRKlQILO5A222QKl7OT9IZWQlApuoPy5WwHg7:F3bNqkYkQIy522QuihEW5aWwE
TLSH
T1E2B1E40667EB1129F4F72B316AB616A10B7EBC63B4BAE35F8740105C1CA16588CA0F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VhdProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\VhdProvider.dll.mui
Size 7KB
SHA256 2ba085379434b3f9fcb0c70c2bd02a7f4f0170e6160578a583eb42c8d333fab7
MD5 0656529f4d1b3ff2d4deffbaf18ce95b
SHA1 ffcf4f53bf767bcd4f6044082b82c4f25598b5c6
SHA512 f17b6c4087498af8951ea0f80f65923713e410458669f3e19624ab6e225222d1f2bb1e6779e5aae328aca88acec940dcf9c9447b83dd27dc6616625f005dec1c
SSDEEP 96:8z2oKwO8hZOE5LzpJeaAUMNwnWu/ELv4+B/YRjI6eiEWvtWw2:8z25XocEXJePUMGP/MB/YRjOvWvtW1
TLSH
T1E3E1354263FD9619F6FB7F345AB51A311A3ABC92E879D39C0690112E5DB1A40CCB0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WimProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\WimProvider.dll.mui
Size 27KB
SHA256 a9eebcb85a0271061ac620ff9d2a6d22332721c782aeb06ab1ccf1149bff2aa4
MD5 da1c1b3e004b71b15638d091c0c82c56
SHA1 a1195ca1caa80e9f463c443737d97b4b966fae0f
SHA512 df373693e971a85397850107f233914a09478cbeee9b1e1903154f8693842b66fdb2ea0de4403aea7cdeca0c70d0723733c8a2938e90e07987d5eace6b481ef5
SSDEEP 384:XEQsHE3IuApdiWQB46zDteyERtet3kLA5XJoH0sJnaWsMWB:XEQsk4uADiWQTzDEyEret3kL/2j
TLSH
T1CCC2AB0167FE021DF6F37F786A7A16254A3BBCA2A874D65C1198601E1FF3E508864B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dismprov.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\0F4D9FCB-CBB4-4CC1-AAC4-D6F4F7F14032\en-US\dismprov.dll.mui
Size 2KB
SHA256 cf8cc85cdd12cf4a02df5274f8d0cdc625c6409fe80866b3052b7d5a862ac311
MD5 7d06108999cc83eb3a23eadcebb547a5
SHA1 200866d87a490d17f6f8b17b26225afeb6d39446
SHA512 9f024aa89392fbbbabe62a58857e5ad5250e05f23d7f78fc9a09f535463446796dd6e37aab5e38dfc0bf5b15533844f63b3bddcb5cb9335901e099f65f9d8002
TLSH
T16A517D02D7FB062AF0EA0B3556F70A66177E7D12BA62932F8F00112C3870505ACA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

AppxProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\AppxProvider.dll.mui
Size 25KB
SHA256 51776526d963bdd7f1b1becb7e2a6ab37922188fef7c444c0474946ec94032e5
MD5 c0eeea45b07503cdf6033132cdd444c6
SHA1 4b81514fad963e87e7e070fce9a8614d5cf23baa
SHA512 a72e5ca651b3a36e55f206fa3f6a27bc3535f2bc3486a0e1e28a5df72d59b7968d5442384bd1902f4466c20319bacd1db3c7adbfa3101f9471521892dcd8d8d4
SSDEEP 768:+LUbd4CBN+MyHpMyYWbX2avtxImO3lqXE3:2Ubd4CBN+MyHpMyYWbX2avzImO4U3
TLSH
T1D4B2BF1267EA4218F2F33BB86EF612915F7BFDA2AA35D50D0258515C0FB3B418964B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssocProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\AssocProvider.dll.mui
Size 8KB
SHA256 682f5b62ec816f2e9c603d54100ca2a04f0ef53d293ab9fda4d88d5b954f574a
MD5 69feb6843b1b243b7ee81dff3d30898a
SHA1 5b9fd290c0038d39a7cc8f3fdbaa8efb1e8579df
SHA512 97e20f0052ae3fa499aed6cfe3b905f2b4c9d817aa0e8d81ca8af2de5f2d62ecbc3250d243e5fa9f64fc371b97d7b7a3d19c767eba1b096949a2f62701951651
SSDEEP 192:JB3y+XdT8ECriWKx9sadUdUTFLrN1WqVjkuovx+3WtLVV:JB579xpWIZXocWtLD
TLSH
T17902B14267FA5659F1F72F786AB752104ABB7C96BC32E61D129C512C1FA3A00C870B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CbsProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\CbsProvider.dll.mui
Size 59KB
SHA256 f3ece84f5b96a2bcd79dd09598aa3b8d7e562f420a4d004e4f9f28889d14a7b4
MD5 1773dec13e58de37ea1cd9f7e6aaaee3
SHA1 9b1cf9e8c734bd6e23dbba3daabb8d9405cfccee
SHA512 21083657e88f223ddfbad07aa7cdcf9052e6347a7de4ca9eab87bd0ff612fe9d81e6821e584e0595d181657fc6d78b61edb6a8f4ee01d260bab1083286a575da
SSDEEP 1536:XGcNHwJfGH+wJGfEE+baCZQSz6K1mQxXP5zTyEoaChU1ivsuggWLe5bstgumJP9Q:XGcNHiGHpZE+baQQSz6K1mQxXPM2Chbo
TLSH
T19E53E22163EA4608F2F77FB86EBA43955F77BCE6A939D51D1250205D0DB2B40CA60B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismCore.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\DismCore.dll.mui
Size 8KB
SHA256 8b47478a4a01aed9e05d57f874e5171bbed36b5ab8d658053f8677ef9179e2b1
MD5 5b56a6ddfed91aec68fa7b50a5fa2dfe
SHA1 70e0a4a04b4215e7457be47a6eb5d8cf13032c5c
SHA512 c57ea23952b262c4cf01fe84c7c69014c6f1fec712343179e2bd565c35182421f6382e827f9badb6fedf3057a9a4cabe018193105c03997ecb3c769f4ea6714d
SSDEEP 192:phQOQOQKQUQ7M3QUQ7M+nxfIxfIqaeyYx9W3WrwJb:phQOQOQKQUQ70QUQ7dxAxwqaeyYxYWrO
TLSH
T1BCF1CA1103FA8619F6F32F34AEB913955BB6BCD2BD79A61E5340106D1CB0A04DA70B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismProv.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\DismProv.dll.mui
Size 2KB
SHA256 774266655f7114036ba9054cb1edc73ef188168efa8762d096a8169f0d50bb58
MD5 90a53f35c435b710ead5f59a5f0a1eee
SHA1 9c3ce85a0d05973f0e516ad61f2150319212d764
SHA512 9851673e2a9ac58417a9ea115e401a8b0e6eed0f5d9d75c4063d62afb45ef5e4e2706bed3ca56bd3ff521fefeb26ab6ea7cd513a60bab90553bd2fac2beb3fc9
TLSH
T16A517D0697FB162AF0FA0B3557F70A66277E7D12BA62936F8F00212C38705049CA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

DmiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\DmiProvider.dll.mui
Size 19KB
SHA256 56f92229f79906dce5824f81c5c968ff233fc8127e72129a8552b98e332b987a
MD5 9861832e96c289f4e834a2263549a355
SHA1 684dce192f4522cac5c776511502981be1bae64b
SHA512 d525730dd85ff4b661305fa1ba64249668c36b8d2b440ae679bb0fce83b720dea4284c0357fbd0703b738ef374564ad1f0a5bcc83fbc7ac55bd2c8aabbabc6a2
SSDEEP 384:loZgcnqjKuVOSKAmuv5TOTqX6syz4z3A7I9cd9AdXVZ/AWzVAznKC+1hvbCAb5/y:Cq7yz4ha9k/A+WM/GSsZi0cbu
TLSH
T14292D11163EF5208F1F33B346EBA02A46B77BCD1B979E51D5258206C1EB3B409A61B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FfuProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\FfuProvider.dll.mui
Size 9KB
SHA256 d9cc3f6b08116296d921f3c56bc211d1f56f36f9a6b08392bf6f8f7515861bee
MD5 bc34cbf542427b8e6c85441d15aedbcb
SHA1 6bbacc62093646ca2ad993cffb4a15337ddec11c
SHA512 21c99c423b3e49c9c90e4289b8066b7c7081d59c82cf5e6c2872159eadbcd56e65bf5b93a9392c5b0a935ff6a5dc19adf515c55710e9d77612cf14215e194975
SSDEEP 192:29UCo7nI+5XnEhLADlDS+d4LfS65Xocb1CEj3WcCW1:1LI+5XQL+d4LfS65XJBCEzWcCW1
TLSH
T19012BB0273FE561DF6F3BB786AB612210A3BBC95A875D71C0698111D1FE3A5088B1B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FolderProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\FolderProvider.dll.mui
Size 2KB
SHA256 044382ce1f1d731a50861e19a3cbc7b40138392bd0f317fe8c9eaad305a5b3a7
MD5 24b20f5fad20048fc14a7777d11d0350
SHA1 116c017fa5fa6eb1d8a9db4be27aa55654d53c23
SHA512 8d70563874b7755714e477f1212dd30fa5e51da81516defedc7f6936bf06d275e2b958c732eb1372dc0bf8928c2d9fc00fb2e2c6a2e68d340fa9a5d782a15479
TLSH
T1D5519D4297F7162AF4EA0B3429F74A66267F7D11AA62D32E8F40212D7C706049DB1F73
MD5 SHA1 SHA512 TLSH

Submit Download

GenericProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\GenericProvider.dll.mui
Size 5KB
SHA256 9f18fdba0b24a584659da2997d7073ce657c060687f9036ed5c47c4db3d0b155
MD5 9547095b7e78759943044a014ab80099
SHA1 19f3517cf067be623c8cfb5f9e90241a21be3d94
SHA512 ad499c7708e28fbcf90e3349b83eb029d50e876351749d78e240e12b8a32f7b2ef055a80c96d747585f10f1f4ce26e7ab61c0eddce731e1fe192153c225acf75
SSDEEP 48:y4WOdQ5NZPLXYvf96z3NQm4ys8fDfi0PiQO3osz9qpZW6BuVfhbMK3g8:MZc3903NQBK73iposBq3WBhZ7
TLSH
T141B14641A3FA561CF1F72B746DBB46656B37FC91A932D22D0248111C2FB7B808860B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImagingProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\ImagingProvider.dll.mui
Size 20KB
SHA256 4d3a30c1d716255488dfa53ffb71a2fe8f5eda48617a9991de69525fb40b9c34
MD5 20cb06e83e67d929510963f6571b9ae4
SHA1 f034408047576d34174ad38b21fc7c06dd04b663
SHA512 7f9488aa59a12faaf9825ff3ef7d0540329162d35d9a7fc4d27d041c5c4050ceb8362ddb7e8c1a1ed924f54b5717ab14e796c6454fa9efd385f111f290450e62
SSDEEP 384:0BClURsIqJvaYk+1WXW+mrdkfhmE/hrczz45FV1feJWWvhn:0BCIsIqJvaYnWm+mrIrc4jV1feTn
TLSH
T1B792F21163EE421CF2F32F7969B742616B73FCA2A931D55D12A8619C1FB3B409824B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntlProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\IntlProvider.dll.mui
Size 33KB
SHA256 d44228a806821c3278d39984d025da79c8970649bce4183f70b8d666aa2abf46
MD5 4ecda6437cfccc9757082807dc2452d7
SHA1 82b4d4ee6770c95f81858e78679768114c448e6b
SHA512 bad594522ab63f4a3d578ba617e5dde8a0e65a1d5edfe456dee34e0c0023b23c2858fefdb2dddef366498f92660aab83648fcc7d010706cb03e6592af53d269b
SSDEEP 768:8JUfmqiocK2CCrYLXXgrBkR2gvkMqF8CA:8JkmqiocK2CoYLXXgrBkR2gvkMqOCA
TLSH
T179E2FE2163EA1618F2F33F796DBA42A05F77BCA5BC75D61D1288109D0FB3B049960B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\LogProvider.dll.mui
Size 6KB
SHA256 a4f2cf869d38a9a8416201b88dfcb1fa430f23d4e4666fe9e16fad4632507817
MD5 59e64d30a6474624a8f9fc4e08ed6404
SHA1 d9f033841af974249b7d239db1c0ad1e58fef813
SHA512 47984417cc55cb1d88394bca67399d3e9a45c912a236aec922b4dc3df11884c9fe78a201179c3ac81c970f032c88078639c0a85c81ba3e07ff30722af027d038
SSDEEP 96:nrmMSHz8jijIqjFqjijWjdVfipG9Q2q3Wk9Sn:nrvSTWiyfioQ3Wk9Sn
TLSH
T1DBD1E01257FA9609F1F26B30BEB907A92B73BED6BA38D21E5740112C1CB16449D60F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\MsiProvider.dll.mui
Size 17KB
SHA256 4ee8c55d8c83cffef3f00faa581c12f2c76c14b2b9a26fdcc512c45f5850e6ec
MD5 05ff17eb521d849cd7669ae3c0f987f1
SHA1 10a05faac056172a526b4cd5aea76e42a5eacdd6
SHA512 8a94a0f83fa08e0738510f0bfac9ed2c4015d1f03b2045c2ad0c0f4ab432cbdf2d19d9d403dc86a112ad1ad9793fe1096578d52ea27da5fba5677ba951e7bbb6
SSDEEP 384:DkWnuT5525LYYc+qgTlVEhEqnQZKbW69v:DkWnuV52lYYc+qgJVEhEqnQZKtv
TLSH
T15872F21163EB5208F5F32B38AEB613A55F77BC92B935E91D5298142C0EB3B409970B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\OSProvider.dll.mui
Size 3KB
SHA256 386c557aee0130efcbf08cd773c4409e3b191ef5671daddaa5212bd90f46e023
MD5 5cfb24402d08d912795b5afd13e13363
SHA1 6c3eab43d71bae4fc20a36308ac1369f1d8d3ea2
SHA512 187111b9557967dfe7a9ef2c02df477d9f306beb32876a480c44216f59c7b3dfb2100916a877b7f6aa2e2f8e543bd78bec40741868ad2ab5af297a3fb38ecf64
TLSH
T1F251260587E7061AF0F61F306AFA06E15ABA7C63BD72A22E8B44112C2C74604D9B4F72
MD5 SHA1 SHA512 TLSH

Submit Download

OfflineSetupProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\OfflineSetupProvider.dll.mui
Size 2KB
SHA256 f33f03621a2d57ddac266af2af7b32f6dd1734b562a667465157e4961acd8a14
MD5 b6a9f328e947bd6af861e9a1ec486d87
SHA1 e81ba25d1b7a5df38ff6bc3ab963bd441e903fda
SHA512 35cdbd81c5959886ad26866d280b1a2beeb1725991489426e9386c2240d2ddadcebaf4793733ac9f778e0b47ed8114f6a531721e9ac6c4da65d044f800eaa304
TLSH
T13B51AF42A7F71629F4EE0B346AFB4A6A563F7D21EA32D32E4A40112D3C74504DDA1F36
MD5 SHA1 SHA512 TLSH

Submit Download

ProvProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\ProvProvider.dll.mui
Size 4KB
SHA256 fe6f1404c1f4c8db52919f157e4b7c7bc2f7fb989aff66c9d93a08daad80923d
MD5 8b06fdc5e1da9820ceb1ea9fc44ca999
SHA1 48ef01c83bec84ea711652bceb214d0c86585cf0
SHA512 ee4eaabbd9e20c57326a75376ede7bde7aeefc1e9e183fcb66608ceff12256ef5dfa7c6b6ade3f02fe843223f4a609374cb9fef8f58c5a78aacfffb1405041bd
SSDEEP 96:HQ49FbyFAMLhFAgd+J8W8kyMLLyDq3WQWSZWwO:HQ49wDlYOk3WQWSZWd
TLSH
T19191360267FA1119F0F71BB89AF749B21B7FFC52AA71D22E4744211D2CA2A444DA0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupPlatformProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\SetupPlatformProvider.dll.mui
Size 6KB
SHA256 3f607ebdf37ceafdbb57227bdb2f581ece3cbe82fecea2bf9c9e697883738271
MD5 b7ea724078b33c1d66fd3b262ee84ce3
SHA1 f5cb0091b1796c2f38f91c728bda8a53005b229c
SHA512 3b0485ed8e07ef9dab7bd87b4a3d8190e7986259fe72da7b139c249dbbc3b76abbcee30e0d3fc7ba678b139dc50cb95533e146db49001151ea78ce509c10639f
SSDEEP 96:r8iunK5AKniIK3KvK/KPYW4KwK8qrWbS6KrHDMJaDM0q3WbD+x:rPeLwiICSSyYxtbqrOS6KrHbM3WbD+x
TLSH
T1A8D190069BEA0229F1F31F74BEBA45A01FBA7D96BD72E63E4750111C18B0604D5F1B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\SmiProvider.dll.mui
Size 2KB
SHA256 3351ea8ebcc292ace596981fbfeadb13fab2132a3f4ca7a73389e203156ab272
MD5 a6d24ca7b0a14a3fd8a53e50ae511aa2
SHA1 5b89222c5078172741088093a45aa630fbc65f5c
SHA512 07261d826b3b22bc84d1574a5089905c95a1ee9a2b92e8c7baac8558add8ed43e182234292793171d4fd6544c2f4cb77c89952fd53399d95648c7dda88285eee
TLSH
T17A51C30297FB1626F4EA0B3456F70A56273F7D16AA62A32E8F00111D3C705049DB0F77
MD5 SHA1 SHA512 TLSH

Submit Download

TransmogProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\TransmogProvider.dll.mui
Size 18KB
SHA256 d8e33f28d9deb661feaca095c6a73c54679d00147bdf35bec774f4f481090477
MD5 a7c5cd3a8c35738f7be6637f9d74e739
SHA1 d55fc603d0b14c2b159c38915d992029dac04d94
SHA512 cbb3b9cde1840425fabd79663f43278b38a0ff21a704273e7c757797f76f7cfcd1bfab39298fbae465700ed62d40612c57712a309a52d6be0015a576cdde24f1
SSDEEP 384:AV1jS3lG9PG5lqqoW13lj19ai+SWxBFMP3yPdyp+YOznpvHRAFkjrZNRUEW9UBj6:AV9S3lGNG5lqqoW13ljfai+SWxDm3Ed0
TLSH
T14B82CD1103EA8608F2F33F39AEBA53615B77BCD6A939D91E2394116C1DB1B40D960B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnattendProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\UnattendProvider.dll.mui
Size 5KB
SHA256 eff8993acf5602ff526ceac5bb0964555fa41b9f62b9c26a32bb6ff7a077f357
MD5 c65d4b456f46c339e3995a25fd4cb6af
SHA1 35c524248ef5ce7240018c7c0dadd8507fab6e96
SHA512 28ac91810c06a28b18fa70b63ff0af74e9068b6bd08937edcfee9ce6285c07216399e7108eb8d6b8a3fc3129513f61ab4af3ec480e00f6fb704fd3cd78bb8ebb
SSDEEP 48:ya+oFmcaRNas9AijfKyiKykBcBxFsV8X1dMaDgEGMOFB1dMaDYttOqpZWYcbuYfG:wc6n9HjfKxKyko5dM0mdM0EOq3W/Ylb
TLSH
T1A0C1480657EB4219F0F72B367FB616911B7BBDA2B475E22F8744105C1DB16488C90BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VhdProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\VhdProvider.dll.mui
Size 8KB
SHA256 81ba836c643fc05e892b6847b581ea6de4cd893d05a88c29f828f75c1934e834
MD5 f8ccefd0f946e4de14c9cc3aa10b6cce
SHA1 8b4386cba281c9d9976cc275b8ae4251ef33b4ba
SHA512 aa169db993e280da776e3b2fd0813b8e9ff72e7d5050f738459b651fc6039d574ecc159288a32ba9efe8a08a5b2e94ad858cdc6d2ee1f6422b0855a71fe59d08
SSDEEP 192:jlVPgLHh2NlBTTrPDMtnnf0WkdFkxn4u73WK9Aa:RVPgzcNfDPDknf0/dux4uLWK9N
TLSH
T175028A2213EA8218F2F63F342DB953A06B66BDD6F979D65D134020AD1CB1B50AD60B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WimProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\de-DE\WimProvider.dll.mui
Size 32KB
SHA256 3c6acb208af7429951c84269de19728cdaa8496a092dcc48fe322969145a1e65
MD5 343f4a62507463d6735db2abc8aa56dc
SHA1 e9d0042a4a42993763474265a0f717ab24f7b8cc
SHA512 67315ee7514f882ba41e29539d9e22b5b95cc51c6795394c8371d16341f250688a817aa43b5bb18ae9240070d27b81cddad7765f26809b396f03718ce66c0fab
SSDEEP 768:JUu3bGz5U7LwYZe0Mv+wyR2jwSD/D9evbhFSmhoq:lbGz5U7Lw+e0Mv+wyR2jwSD/D9evbhF/
TLSH
T121E2F01263EE421CF2F32F796DB602606B77BDA2B975D55D5298209C1FB3B409920B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppxProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\AppxProvider.dll.mui
Size 25KB
SHA256 41c8b7200845f5ffd7466dcae1db7b8c25833f2f8118593f8c2770246a322a4d
MD5 842ef8185050a821269f5e2ed5f0490a
SHA1 b39d06f75aa4b9b46f342d07f26c84f64ba517d9
SHA512 0ce48d990885e90a06f9829e626a73c3be7a8b214816d2792af75ff7c708ac55d047895d773052a2b67f80e3c61def222a0b78450ae3e48b5ad7c20faaeafc6e
SSDEEP 384:OLM4xuAOpMyYWbTGjI1GoOAuQs5o7cNmWKV:OLM4xuAOpMyYWbT+I1GoOAuQs5oBV
TLSH
T1ADB2CE512AFA5245F2F33F79A9BA25664F3FBDA29C38C10C0258515E0FA3E458D64B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssocProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\AssocProvider.dll.mui
Size 9KB
SHA256 f4b88cb87179472655041518d123149eb49f1f484fe581805e3a2e35c4b1e344
MD5 2168d71b7fd5330ab5fcfcb5ab1b1c07
SHA1 2d8042e479875499aa2093c8bd245c2291739144
SHA512 409ee809194bbc5bbfa5081a368f8834828f396e56d00436ac8f1c30bf7b0974bbae1b8790dfc08a1b6d83f771493ef7b0372cce4feb079533254f5ed665e360
SSDEEP 192:p4+tRMe1+Crt4F9sCqcZrNSeklhVeKPQaxmWnA1:prZoajeK9xmWna
TLSH
T15D127C8166FE1646F2F76F79A6BA12540E7F7C52AC39911D469C422A0FA3E44CC70B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CbsProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\CbsProvider.dll.mui
Size 59KB
SHA256 b6517203d9dde04a3b8a715cf47f83825928e4316e09763fe3cf0f6e1b1d8cd3
MD5 e5fe9e638b4744b799579563e433aeaf
SHA1 380b3f0fb659fc43f5fadfbcccb4fee049a668c4
SHA512 5bc2100c11847c4744673e894d3c8722053271f3bf15788e4f25bcc2a14089cffb761784b260af593463abbf3a9efaf7988f946005f94be016743b8369e695b2
SSDEEP 1536:GX5ZMLJGfJZ1dmYlBHXpiogqGux7Yfu45EhSFyKt8EqWuDGL:UZMlsZ1dmYlBHlGux7Y245EhSFyKt8di
TLSH
T1AD438C5066FD564AF6F33F79A97A12694E3BBCA2DC39D50C0264115E0EF2E848D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismCore.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\DismCore.dll.mui
Size 7KB
SHA256 4ca363ac6299a3eff6f099c6897ad45793fe0e2093f6f2782614b7a98bc40ff1
MD5 f91875c04330d1f8cbb6bcfa1637be8c
SHA1 abb88cf8347b02b9a3939d8eaa0a762f09520e9a
SHA512 c1439fb8c0ac0872247d64fb98ad49b158cb0d742f40d836e2086c97606b6bec0ad29b8c5fae6ea72c6695cf34efe2e3dacf87be5874fcadacd0439ca19d08f2
SSDEEP 96:b53BWWAmX2iS9IAEeAmAEeA54ccKemW40sN:t2imU3UpemWrsN
TLSH
T1ADF1AA516BFE624AF6F73F396A7812654E3A7D92EC39D21E8310116E0CB0A448D64F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismProv.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\DismProv.dll.mui
Size 2KB
SHA256 b9c42d0a45fbdf2db979922d60e3f3dea41c2dbccae80de432674758fb23bc0f
MD5 bc47aa123dc9506548cade2321707cc7
SHA1 dd401731adcb6623d37e35dcbe8bcdf6b6adee7e
SHA512 4d3cc7027323020c6c6bdaf6c52541ffbfe144d2285b549004ae6b724f24b9efddb7d3a7ca5053786d67e6181e1a3ff2acc9b231ba42e36113603dd6402204db
TLSH
T13351700297FB062AF0EA0B3157F70AA6177E7D16AA61936F8F40113C28B05149CB1F72
MD5 SHA1 SHA512 TLSH

Submit Download

DmiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\DmiProvider.dll.mui
Size 20KB
SHA256 3717e900e1490eab331474a0cf20010a5f775d6c45bd6d3406cfda8e6241f864
MD5 f1414df5b1c4c9aa010b60fc0f49c28a
SHA1 75649556f45c3c0e4566307598472937f994b725
SHA512 d0b33c06fbbaf9a721803e7ecf1130c91e2234fd3dcedff291fae1d828a6c486229f670d8d3fa0143bb2604bc7b370f71e9f618fd7aa609acdfdf1667d014fc1
SSDEEP 192:quPnqj/yhm7+f0kO2U7fx4jcUCxiripEoIs5zWodYFqYtOHC2Ud3CmWR3j:Kny4UcisfJWouFBtOHC2E3CmWRz
TLSH
T156928C1117FA4206F6F37F39697A16654E3BBD92AC39C14D8268119E0EF2E448E64F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FfuProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\FfuProvider.dll.mui
Size 9KB
SHA256 a7a6297f75e30830ddde1f5dded0a9131a1e9d9dba0182ce7d9f5fb8fdb72726
MD5 4fe1ece3b234048791d5d97844fe3304
SHA1 dba744f5c41dd136e498acc442da8bd5e0455ba8
SHA512 74e74eb1c561be31edb1c944838170e9ffc554ed0484fd7a99381e4cd61bb559e4ce7aa6a785f294df991b0d76b4bec841032e1f9e4c23217051017c3fbf5feb
SSDEEP 192:S9Upco7nI+5XnEhLADlDS+d4LfS65Xocb1CETmWcCW6:vlLI+5XQL+d4LfS65XJBCETmWcCW6
TLSH
T17B12AA0263FE561DF6F3BB786AB612210A3BBC95A875D71C0698111D1FE3A5088B1B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FolderProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\FolderProvider.dll.mui
Size 2KB
SHA256 09eb31cca48ab46aa3ffeb1efa50ee1a0bb58fef66328fa2f71e06e9f0ef5a2e
MD5 c514bf1f906c4505b159ac558b3192d2
SHA1 0c97fa7adda3da788f6cdbec0aef00e68bc46402
SHA512 e9b6c78179f394d5c69718d9ce82bd6f6b278067b68a79e9138cf92d48554ffd65c47a722dc02b9031a89ed23065c5fffb529f2ff35856c20c41d5d849fbe915
TLSH
T13951D14257F71629F0E70B3419F70AA1163E7D219A62D31E8F40112D2C702049CB1F73
MD5 SHA1 SHA512 TLSH

Submit Download

GenericProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\GenericProvider.dll.mui
Size 5KB
SHA256 26995bef958d5c2b5748f3f17d2767a9918ef8f2a82b98859913656b70e23358
MD5 5699303a2d4970f89360068b6dde8674
SHA1 371a7b79e71bad4d7da3fc5d79b0be08251fd7b6
SHA512 8a8d07a4127510950a96701870aca16e315732c88a3d359133c08820a4f0fc4df8eb62364b80af1e7792da5a5bb4c453938c96acea208434f9e6995efc7002bf
SSDEEP 48:yfSWkf4d45M6zo/LLY9oOFO9r97Rb5Eo310mfpegKpmHeZWxiuybpaPgp:BfpjTE9rJRj0mGOmWs8i
TLSH
T194B11441A7FE561AF5F32F7959B746254B3BBC919836D21E425811291EF3E808C60F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImagingProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\ImagingProvider.dll.mui
Size 19KB
SHA256 116a74db2b5024a38307080651aeeb98d15212b1c2547822421f38dd43699714
MD5 cc4d83d9206a2352295b036204b1e1bb
SHA1 89647c71480550dbd8ed0fe5039d53996715be9f
SHA512 87285d309a6410e006eb5b3277de4219bc836f531211677e615e875ea903462a38ac8be66ed08dce804d7b782eb4f4c01f73de5c3a0f90a36859b87b56fa0c4b
SSDEEP 384:M/SJrT8H/Ro2hJmy2iAYkhAy3GWw022mWzC:hJUH/y2hJbnAYkhAy3GWw02QC
TLSH
T11992B11126FE420AF6F36F79A97A16554F3BBCA19838D10D52A8615D0EF3F808D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntlProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\IntlProvider.dll.mui
Size 33KB
SHA256 db2888717225eb457283c28424f1ce53397d0aa321b7619ebe0884cd10fe6c15
MD5 7a667def21a5d84e95c0153e463667e5
SHA1 f980aab6026c343c535441fd52283713183e128b
SHA512 dde58035cf1e53d4afe66aa69fee934ca31264fb4c12dff62c39a4bd47381e4c07a977b58dd4020d41f0c7bbc502d5ee6f3c43628d4fba8261a82662ea4c666a
SSDEEP 192:sdHnJ20kjEPyKhfSFYdNvT2Ox96hQFQxfQZomWYG4:sNnJZk4yKAF0v4QFQxfQZomWY5
TLSH
T133E29B2056FE521AF2F37F79A9BA05544E3BBD91A839811E429C115E0FF3E848D64B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\LogProvider.dll.mui
Size 6KB
SHA256 bf2d54f231f3e814a401b6598793dc3604e2d381c3b3d9b5479c9fea87dad2bb
MD5 49546b639236f0f120a4982ba840f563
SHA1 cc080e0ce4cfc5a5e1bcc02823875234c05759f6
SHA512 8e6f8cd409a601be098fb1e61e733e5ce7fc06e365442e7a2ec508dd44bad2b10bd45288419bb672be5a278501da965831c8e92da545af8a3070ba66a4b01a8a
SSDEEP 96:63qJsKggOL/IpSiiTV+UTtAI44oTVYTROtAI4oSPNmWCLD:wqCKemHgkatVdeVuRpqMmWCLD
TLSH
T137C1E24157FA534AF2F33F35AA7545A90E7BBCA6EC39921E875011290CB0A44DDA0F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\MsiProvider.dll.mui
Size 16KB
SHA256 634ca4c93f54c358d1c541059a2e60fdc4a11f38ab676ed379a9e38a2fb3797d
MD5 8cf549ca23aa04d862ebf6e6e607cc54
SHA1 6348fbe4f32a01460de297e472343b3c0b32e34b
SHA512 5cb719abbaac3498cdded40ea191158621255f1fb958835e01809ef7532e5e8b3ad03af1170f0464dc7bdcf49230457e86c8c58640716c629fe659e94112fce9
SSDEEP 192:NTO+x2JpjxQpqwMLikMtOc3W7WLkGTrA/0uQzBQnZ6ndlIJSJbemWSp2M:N6iP3E3nZ6ndlIJSJimWSph
TLSH
T131728C5126FA5206F1F37F39AABA12654E3BBC919C39855D42A8121D0EB3E84CD74F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\OSProvider.dll.mui
Size 3KB
SHA256 344d70160791fa6d5e4b39afa0ebe996a4e6092672ce1e0750b4c640ca8e6a18
MD5 d1f7a1ea380d32e97056793baba7cb6b
SHA1 f5bae8cfdff3e45aaea570d0425b47833e2da197
SHA512 95def4c80bf43a8e9e7cf6dc272e4eb7e1847e5fa997c8a3f2ba53b9bb337289bacd8fd8a719b75818d44ae33ff817fdbf572296b258254543aaff98792a4649
TLSH
T1CB5128455BF71216F0FB2F34A6FA05A64A7E7C13B976922F8B50012D2CA064498B0F77
MD5 SHA1 SHA512 TLSH

Submit Download

OfflineSetupProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\OfflineSetupProvider.dll.mui
Size 2KB
SHA256 2ca9f61d307e874e29fbfcc90645a797c82a0891d9ecfd7c3aefa8ea759a2bc5
MD5 19575370d599f89404fe876b132fd170
SHA1 968fdaee7daed95a62cfa33cd03c42804dc96652
SHA512 d35a383e49e2614019fdfdf585b607caab3ecaee6e577793863b8a1b84df2bc76de09577c9474b098d026523539f6e7b7d63071dfdc601821b5aad73f060e00a
TLSH
T1D951BD4367F61629F4EA0B346AFB4A66563F7C219972D32E8B40112D2C70504DDA1F32
MD5 SHA1 SHA512 TLSH

Submit Download

ProvProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\ProvProvider.dll.mui
Size 4KB
SHA256 49d4ef65391503ab867354dceeb241e7690c92383458fd3349a85c669b80bd49
MD5 465ff43b338a4059ee0308a8de105a98
SHA1 0811614122cf0b8e23f805789b1910f788b20ffb
SHA512 05ccaeea8e613ca50612b73b16175d77f68171a1e5af5111d382fccc88ecc41f83ae84f4c4d91885649197557e0b4c19bee3b23adfd13022b482cb8a92c3b728
SSDEEP 96:8feQw9FbyFAMLhFAgd+J8W8kyMLLymmWQWSZWwt:8WQw9wDlYOEmWQWSZWu
TLSH
T16F9117026BFA0159F0F71BB89BF749B20B7EFC53A671D22E8744111D2DA2A454DA0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupPlatformProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\SetupPlatformProvider.dll.mui
Size 6KB
SHA256 79bd40a61064b856fa169d2ab92e0f41202f08fe78b5c749c9bfb96f471792fd
MD5 54e7735303befc4017c8f7f79c70ac7a
SHA1 0e165c98d94ccadb80aaa8bba7644f50dd16c119
SHA512 125cff3faea70c3a7e0a3279022685d23bd0829ae7316ee2dc9afb568d03cdad4ce5d948776a736fecfc4f90d9dd655639ab4f2ab7610ad1ee41c48959ab71e0
SSDEEP 96:91f8FfwKn5K+MKtcKxgKmDKrIpuKQnK01ph4xND52sY6LElvmW0fZ:91xI4rLH+lVJ5mW0fZ
TLSH
T18DC17642AAE92366F1F37F78BDBA46554E7ABC909D39D61E0350121E0CB0A44D9B0F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\SmiProvider.dll.mui
Size 2KB
SHA256 ee5a25b54776a63bc5bdd9a5ac3c6cacc7bf2b7f3761d2b489ef0060e5ac031c
MD5 fe9a7502d09360933fec35a1dd9cb46e
SHA1 58721b66c428b32619d7f09568e86fa1a9339849
SHA512 9f8c752a19e8404c7c9497fc9b457404eeaed2d6a071aeb4927fea7c2d3fabb1547e479d8525547f4c190a56113a26a53575b4a7e4bb76c65ea656304b753a0a
TLSH
T1B051A30257FB1626F4EA0B3456F709A6177E7D16AA62A32ECF00112D28B05189DB1F77
MD5 SHA1 SHA512 TLSH

Submit Download

TransmogProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\TransmogProvider.dll.mui
Size 17KB
SHA256 1be0b61e8978639eb2f66956a1604f6f0a2d668f868a9ff48b5db33dea812901
MD5 dd549e06e8b1a71eef97ebcd494fcc10
SHA1 b020953e0bb6dd6ae80f881f59591d067e75c63a
SHA512 0d3f4700bd676a03d39460a7af08780eb06bfba2c9bbb6827ff8a39f37d0dc946de057ec2fd70715ce8839f55927cbea57c7d8b85a859252b0dc8d9a23c7b540
SSDEEP 384:36uXtCLjlW199Gx2FnZy+WI5DLkPU8PZ8dmWM2:36uXtCLjlWf9GxknZyJIh4PU8PZ8i2
TLSH
T12E828A2162FD5646F2F37B39A97A16264E3BBC92D839C50D0394126E0DE1F849E64F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnattendProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\UnattendProvider.dll.mui
Size 5KB
SHA256 e2988f7e6ad35863b56534824069aaaf34fadd2d27524e5d030b706576fd359c
MD5 7601ef496c3f171373605aca6299eb4b
SHA1 92c25a096a96c690cb405b2d5e2df35a06044104
SHA512 0729514091ed0e0468a9466ba3d6b73bfd10eb0a60e1905671c443f66121d84fab57f511bf989580a715e4ea9ff9172aebfe2cc177674c8c14adce5b8a8de157
SSDEEP 48:ydPf+AFnvBi0ao/ZqOEY1okBcB1jQsZIREickrRRXMjQslckrFXeZWqmGuOPRaPh:eP+0Rx1EPko1jQqIckbXMjQ9kZmWD+Qp
TLSH
T17CB1E00267FA1766F0F32F756ABA16654E3BBCA1E839D21E8350116D1CF1A448DA0F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VhdProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\VhdProvider.dll.mui
Size 7KB
SHA256 631d6c84c00fcf1e7260734e92bee36243b8c40e97b853be1723dcae277ffaef
MD5 bc6b19d90559744702c1687b0e5b376f
SHA1 a3752de9ad56f2256a5190b01c641f173b60bfed
SHA512 9be6cdcbfb665a57e132388a0045a5ce6560740cf2d2d0537acaa7331cf1db2c6d0e1b2200d7cb892c7b6be47b73073a38e1ed6296631b7550a474110ef10800
SSDEEP 96:6pE4VTzXkXW+vwXFuXGHiGvJritNpifisTmT5/+U+BsmGiJiG1gN6rmWmNr:6pJP0GWw02JmWmNr
TLSH
T152F1895256FD924AF5F77F35A97916254E3BBD92DC3C820E4760126A0CF0E848D60B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WimProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\es-ES\WimProvider.dll.mui
Size 30KB
SHA256 43bc4c6ed713d8f04d359151edd47d6d63eb64a87ec37fb95c0fc8f056c8c023
MD5 263b263e5fe8c078a3866eadf7b2bf79
SHA1 9dad2d78e5f130b72a39c15fc548935dc9b96005
SHA512 d8ba69b15420aaa6c1afb1bded5d0afb821c73e1ef538f06dff0f4d87520622cf0a5a989a480755a3cb35b9949098575c6beb51bb747352c280916e87fbf68cf
SSDEEP 384:3O6yYM/sUZIt84dkaYaCo2MlzdapMO0GWw02+mWom:+6yYLeikaYaqMlzdapZ0GWw02Tm
TLSH
T15DE25B1167FE520AF6F3BF79A97A16554F3BBC929838D10C12A8611D0EB3E448D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppxProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\AppxProvider.dll.mui
Size 25KB
SHA256 3427511dafbbbd40a7fe1d7ddd4702befe6f0e00a7f1c437a2ffd9cbcb5f53b8
MD5 8f047a75723e8729a4c84fa2c08124b5
SHA1 63db578e441068b91bad9c6844697e4e2ead45bc
SHA512 6bec1487f66f5da86d4cc7dd48c684dd63335b87c77ca01d80482c72250609051cdc2a9b56af3423b45e8d14e39ead725cc9a9dbc15fe6ecea74615335edfde4
SSDEEP 192:MLCLObtltft5fPGrVbtrtutAtKt5tptjGD6frroQDrbkQMNgkmtTfHEUfiyNNkN4:MLDTtOpMyYLbfMNCBI/ZFNWLD9
TLSH
T1D6C2571276EA5205F2F33FB9A9BB15120E7FBD929D31C51C1298119D0FA3E85C9A4B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssocProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\AssocProvider.dll.mui
Size 9KB
SHA256 a4384de24af2c0ee9e5ebf233e718c8cf4c5277a72139caf96d6458365f765e1
MD5 8fc0592e6bae1c2c0b6faf5abaae06bd
SHA1 3d2b07af39c682fd1aa7b7d17949752ca02462d3
SHA512 854d9994ac9297b5f141bbbb80f4be1ef137b359bfa1483e930a9626a84998192ad3b94d0a54397f50bcc7077b9988e2bfbd35f667a04c8840e0299c506f9813
SSDEEP 192:kQbdTgMJuCCLmTQksCtQp6GPWHKxrNRV9CBkaMqJMBIZSR0xkKVbWeV/IS:ZNowi+USWC/l
TLSH
T1D6127A4266FA1642F2F62EB5BABB11500EBF7C46AC71D12D568C516D1FA3E40C9B0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CbsProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\CbsProvider.dll.mui
Size 60KB
SHA256 17cd538edec822763227d6ee4bb0fb7963e931333b5c21baf50ea16a48e8b785
MD5 87f62a21bd015ec3f873021082063456
SHA1 8869a96cf37a9fb0c8d9704913f6e735fb49afb6
SHA512 afc2e31fb189fbdb8bfd301b33a3d79b05ef831a5fa0dfd152c0fbacfcd8a52a17192bd9373b2ee84c5c917e8250ff4d58d6fd24ff9f66b903a748379e6555a3
SSDEEP 768:apiYVOSiJ/+d6Q2HLrZ8okOktbQPKVt7t:a1VOSiJ/+dILrZ8okORQBt
TLSH
T10B53781167FA520AF2F73FB9A9BA01164E7BBC969C35C51C1294115E1EB2E80CDB4B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismCore.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\DismCore.dll.mui
Size 8KB
SHA256 6ecad6a9fd347084d2d6c1fa5f079d4add05d4719b3b06280329cf84dad88025
MD5 9a27fcb82be619943135eddfeb4c13c0
SHA1 a76c0fbf51cc25491fcf4fe600d0a026682a5fba
SHA512 0fa126f2f1fb6933603e7a3da9b3a17fa8b0b4f22102e4010d533b32f3aac8a5f7526236b43017dbdd787782707886f42a9167f920e764c61947064b386e5372
SSDEEP 96:ZEbSJ1FFMvFHgrDTtgruyIWyosPw1V7+WlTrMm:GeuCDTEbsTwSWlTIm
TLSH
T1BAF1BF15ABFA4212F6F73F75A9BA11164A7B3C93ED7AC12D464010AE1DB1E44C9B0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismProv.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\DismProv.dll.mui
Size 2KB
SHA256 33e3841724f69bc0694eeee17e902379b67bab7941506353f0d85d1e2665dc27
MD5 6b1ce8eca0d43b32f6e78472d469a3f9
SHA1 d4db763a34638e23caafe06026eb1d6e74cfae00
SHA512 64e0f3beb34fb0469677a991b50794f8e0a0301db4a9bb0366de235c4816a2f4e4ac25db4c3517e2b931cbbc43389b69b22f81310359bb10f6758d9503274817
TLSH
T1B4517B0297FB062AF0EA0B3157E70A66577E7D17AA62932F8F00212D38B05149DA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

DmiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\DmiProvider.dll.mui
Size 20KB
SHA256 a63191a3670b36a499e1326fa84937f70601e213f768c05763f9dfbd0f57ccc9
MD5 f1d841f0c026d16c2ec95f5bad6fe9b1
SHA1 a4f09b8382b88e1d1bde579030201170c9d5d234
SHA512 8df567bde90f18b1a19165962ecdfd4af839f3b51de1049bc30112069a84f32b32139ce11d144166af6ef19fdf871b14c7290fc84bb36d6fdea9c950423ba365
SSDEEP 192:+eLNrq1WCS1Y712Xz8tr6vqWmmFMe5dcYoLc42eRfQ317B4RSyWS3Te721TI+ImM:9Q1tt12XgtuquFl4Irj+wWZY/
TLSH
T1D492581567EA4205F6F73F75A9BA02610E3B7C92EC75D21D0248119A1EB7E90CEB4B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FfuProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\FfuProvider.dll.mui
Size 9KB
SHA256 9306a28afc60ca27ddadff59474b0b1aa19c63bd7b6d34246f3996b59293a639
MD5 fba95fa26da2db4d74545053dfa8cf74
SHA1 c45151ccde9f151a59e9b533bbd176172c9547cc
SHA512 cf0c4d36e036d44bc08a7185014890c7e3edf9b1ada22e777a2cd123fda6242e519d9f422d27113c794b9bd0369ac2e9d318ec04110271f438dff8b90b82e22f
SSDEEP 192:b9Uqo7nI+5XnEhLADlDS+d4LfS65Xocb1CEnWcCWc:qLI+5XQL+d4LfS65XJBCEnWcCWc
TLSH
T1B112BC0273FE551DF6F3BB786AB612210A3BBC95A875D71C0698111D1FE3A5088B1B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FolderProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\FolderProvider.dll.mui
Size 2KB
SHA256 a45ad33b482e3b78f42b8454ab17c1cdc7df99a425d4abe6a9633446d555e4cc
MD5 a859ba4b521f42506f14043bf9455386
SHA1 8ce68325bc57ff984e99c8ebaf688e91161196e8
SHA512 300b36dc9d65102a20219ead89c5cbbab2fca447ee6715b96e77c17956f5abd38bb9f8c120049b72a097844b7c638d2aae477556236c98a52f22814f565eddbe
TLSH
T11851BF4297F7162AF4EA0B3469B70A66167E7D22AA61D32E8F00112D3C706049DB1F73
MD5 SHA1 SHA512 TLSH

Submit Download

GenericProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\GenericProvider.dll.mui
Size 5KB
SHA256 199f15c865e74f2e5e599fff293c426b0cb9e2a970365a8a027ef422cc248533
MD5 5c9453b61bec25ef560c33162dc4ea26
SHA1 1dafa73f4c8a1b1aa75b598d0aafeb698a576791
SHA512 9abdc5f9fbcb51e2ae53db3eeca8346113a1b76ab5a4e0bede4cb0e0e9d43be67a40ce42d3554cf09236772ec47684841658b624530aa762fee71471e75801c9
SSDEEP 96:sc3rGkKfK/1t+rMZeuqowTtK/U+WRjrML:NPKfK/14NcWRjIL
TLSH
T14DB1FE51A7FE161AF5F73F34A9BB45254B3BBC529C32C21D0298115C2EB3A808C65B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImagingProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\ImagingProvider.dll.mui
Size 19KB
SHA256 0b8e427990dc58a5f9407f401b3045df82739235b6f0ef403a705f267ec0d518
MD5 b7b141977bf68735fadc10829bcd6004
SHA1 61defa25b89e7c4dd88c5c30f12befac754a8b6b
SHA512 0300f846dc381b2499c61e7d8685dcec015492a95ed01f2c71a5810d7f476c01b02b0b9e2e3b2eafd30e5d2c74e2c4c248becf0ff1d9bfdc28fe478ba4d2202d
SSDEEP 384:l6sezAvSomdp75onSE40npxeLIkoMXD+MEWYW3:lnezAvSowp75onSE40nveLIkoMX8O
TLSH
T179929B1177FE4109F6F73F7AA9BB11164A3BBC969C31C11D11A8519D2EB3E808868B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntlProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\IntlProvider.dll.mui
Size 33KB
SHA256 fdfc3f1c72c431a504edbcfaa7ad6ddb23715cf87ece4602623ac738988bd1aa
MD5 e40d406d5e17feef89dafb3c1b647177
SHA1 1aaacc9cf5727471bf7a0c7d834052d948c8c12e
SHA512 a72d81b3f0726da7d9cd3d67e44a242fde5844e707509a67d64df8a83db737ccf6d69103880d42221251b369efe8c84056fe8ab47f862c87e752217c8a67fbed
SSDEEP 384:5zTt6tTqUg+dTq4z9oMSK+ExP+9mi9IqDnZCTskwTIQYQcDdQ4koWClx:Z9OohExonlpoDFD
TLSH
T1BBF2555167EE515AF6F73F79ACBA01214B7BBC82AC35D10D0289059D4EB3E48C968B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\LogProvider.dll.mui
Size 6KB
SHA256 88b1498ec989dffc5e9a575ff6b94e19b8c7bae63f9552eebd4d92d45c41055f
MD5 60814859778baf89ea550c23e562e0b1
SHA1 fb2be079366fb419a5823b2a5b9da65c6c691d08
SHA512 3fdce0b48878615c7dd41aa6de8da33dc8c7b2ae9100ecc56fe5b7f192fe996395538fdc11b737506ec3720db9bb6309d7bda99e7dd59610446dca0c42788784
SSDEEP 96:PfPjHn4MJWhKFVzIqQtuDYQcA+iNyW+W2ErMH:PfPjH4M0hKFZnQtuDYQcARyRW2EIH
TLSH
T10CD1D002ABFA1215F6F62F71A9BA05610B7B7C97EE39C22D0680115C6CB1B50DDB4B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\MsiProvider.dll.mui
Size 17KB
SHA256 62b1b69560dd478e22b86661ac08b89e781ccef7dcd43fc117e48eb422c174b2
MD5 2345537a4d053ec947fa9d7742e92193
SHA1 b6ab1b2295ddfad72e08343f0fa534d44433904e
SHA512 73ba6665044b083ba4682f064086e33d26c76e17a8a84e58fd3ff2b2ca61b76ee9c48e51b71e45464ba74e2cc004d906716aed35e338974e43b178f9dd9018c9
SSDEEP 192:2T2sKPCmKvK67K9KIge+B5G6dWIvp15FDel/5WHl3KUqWhVIn:2RCrCr4KeWLDDC/5WHl34WhVs
TLSH
T12582661167FB1201F6F72FB5A9BA11610E3B7C96AD36D61D1298019D0EA3E84CDB4B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\OSProvider.dll.mui
Size 3KB
SHA256 d05ed84ab71c5e77c870f46c327943c5f9c36d25ccd65b14758c3e0eda58c3ef
MD5 d4f685297e15dea6d61e1c02f5c55284
SHA1 59e4899d92de5cffc9c4756b28a74c3ed1d4fa8a
SHA512 e5b8227502c7113e6333061e4c6c28dea51fd3458a751fed14dbcc30f8a92be772d1d87359a69fd3a4634b041ea1693ae1b5ab75b996be85f8f3d71ac60338a0
TLSH
T10C5126055BFA0616F0FA3B70A5FB05924A7F7C17E972D22E8B40112D6C60A049DB4F77
MD5 SHA1 SHA512 TLSH

Submit Download

OfflineSetupProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\OfflineSetupProvider.dll.mui
Size 2KB
SHA256 ddac20708f8522f780dfd1246242ff8394aa1390044189675b52a7daf6148a5a
MD5 1bfd1893b356d1f873485eafbbd4ded7
SHA1 7151a11102265ed68078acaefb2246fd26048150
SHA512 1fdc72d22934650e8530ed799eebb9d30a2ba53e3b4c35f96f1053368acb94fc319091ecb0f01b04548cca45242ebd778d939ee4a2c6a1145c8f819c8a857c22
TLSH
T1EA51CC42A7F71629F4EA0B346AFB0A2B573F7C21A932E32E4A40112D3C70504DDA1F32
MD5 SHA1 SHA512 TLSH

Submit Download

ProvProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\ProvProvider.dll.mui
Size 4KB
SHA256 eb2111050a0da0dc74e5cbb6d818f00969e1b11d96b060f0e7a3ed1362f38525
MD5 d8effff8244fc2aef3444f1c601ba5f8
SHA1 6b0e75773f8d1df1705e507d3c28f5e62d74034e
SHA512 a87ad843904121db3cd650849475b3cbd9c34a5d793aa6a66b5aa5a80246f802599533afb972fc77711c92cc2554eb4f9d7ac2df32b0bc67103316b7fe06804d
SSDEEP 96:OQw9FbyFAMLhFAgd+J8W8kyMLLyD+WQWSZWwv:OQw9wDlYOwWQWSZWQ
TLSH
T19E91250267FA1159F0F71BB89AF749B20B7EFC53A671E22E4744111D2CA2A458DA0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupPlatformProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\SetupPlatformProvider.dll.mui
Size 6KB
SHA256 96e2f86d6c31e543df2e36b791a4ff0f20ff26d5c6980d292f6038fdd868967e
MD5 630c2bb0521139f26ba1e5906da18653
SHA1 1ba4d9931aac9d9069eb2a44db4ae60401761ab7
SHA512 12c3a3bc8558c4392dc985fbf76c953649269678d2731f04ef88695aab5be5ae43f4c3a00964b2fcee4089cff2b6ea128a8a28f75de9915347911a137986a6e8
SSDEEP 192:8beGPnTrBG6l0qObwAAG3Q/GlTitrWvQIT:8C8ncu/gdAQQ/ITurWvQA
TLSH
T101D1A862ABFE1166F2F37F31BDBE45910ABA3C4A9C35D22D0751158C1CB1A14D8A4B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\SmiProvider.dll.mui
Size 2KB
SHA256 68dfc4501a394945da024e65832cc42bf500e0959ee82e8fefb3e55194c1d7f2
MD5 154ee2f646cdea13189856e0aca4ff34
SHA1 23726c33aff02ef6452701b5dd97160721ec49bd
SHA512 4cc690b7d48bc9bd4364da6b979143d9b50a40bbbe3138cbc7830dea0f7f57056de422dd1a19403522655bbfafcef02ea00a37eea4a7dc0aa2365f02cf3578c4
TLSH
T18051A10297FB1626F4EA0B3456F70A56177E7D16AA62A32E8F00112D38705189DB1F76
MD5 SHA1 SHA512 TLSH

Submit Download

TransmogProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\TransmogProvider.dll.mui
Size 18KB
SHA256 1acd9c423337c986ea6632c064f2a98ef2423cd918cd7323c04a5ec38b41905d
MD5 4b712687a01cc1fe0745bf56a3c27b77
SHA1 f8855dca91c144db93c83a35b2ac9a84af9e50d9
SHA512 af99a7b9ad2d81fa1bef8e7334f5b41e4c0612cb36940ce6210ce5d8bd83a026ade7cca33b965175b60c2533ee0558291dcb977a5a6c4096bb4c6fd89ede1518
SSDEEP 384:UE9fzyV0yKSjABglXq9IlEOxBFwdpJy1D9vmM/YO8tpx43iYDeGFNkNbxGhh4zK9:UE9fzyV0ZSjABglXYIlEOxDwdpJy1RvN
TLSH
T14082AA2167FE9206F6F63F75A9BA06220E3B7C86DC3AC51D1684119D5DA2F40CDA4B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnattendProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\UnattendProvider.dll.mui
Size 5KB
SHA256 4628177f430b600d0bc7311bc13b4d5a96ebfbce8789ad9513188e0d881ca9fa
MD5 e799fc8e9f7d67f4b60352c7b3e72943
SHA1 39f23199ad3c368d6216b24d31b52685a6ffab9d
SHA512 663c21c646bb2de92afafc7f5519906f5af7b2ec439ee14e2e86720a898cd6176b1171746bb09c0218d3ba303910814ac495f9ba15724d8725fd9445ee821523
SSDEEP 96:U8prKpaZKThfk4c7nIuV73snm+W5PPrM6:nprKpaZKTpkpjIuVTshW5PPI6
TLSH
T152C1C3066BEB5215F5F72F71AABA15910B7F7C53AC72D22F8744005C1DA2A48CCA0B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VhdProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\VhdProvider.dll.mui
Size 8KB
SHA256 5a022bfcea4f9278c2153ee7b1c91a7f8dcf12f43075753f4eaf7371bb4bdf5e
MD5 f385649363d810a8399ff819613e2603
SHA1 da1757aed8f37b8b716b5361c53122230a41af19
SHA512 9c719312bd0af4df2f480bee8bf3881896570daa4197c0b62a1a546edb2d788938adcd5160df2d9ff9e3b5d3ed0e020cf857f7191650bbd687d2a8b9dfacbfe8
SSDEEP 192:BjZFbgxMKB4+GasBpG+kvyaY4Exba3nyaaTWgOIM:RL+M2yB6yTWgO3
TLSH
T1B3F17A12A7FA8205F2F77FB1A9BA12214A3B7D97DD79C21D069051AD5CA1E40CDB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WimProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\fr-FR\WimProvider.dll.mui
Size 31KB
SHA256 ae0e8efe64b516f451d458b82d325fdc59cbace6bae7e621d055722901083e16
MD5 c63ca7fc87f9e66e72499d1927d04b88
SHA1 b37e25ea852dd4a466bf2ab6bb14a7ee895a534e
SHA512 e98bbd0717544df7119293f54cdf5d95d8b67bb5273f4f25373424dd367b0ce664bb1d56bff484cf506d929baf02ac873231ec737f1098fcde474785a871c7fc
SSDEEP 384:HqNU6ptMEndrLhoF3pcMbo93pFgoGdoBqmyloFE+MMypuuWRJl:Dqt1dr9oF3uoo93XgoGdo8HoFsgBb
TLSH
T1A9E27701B7FA420AF6F37F79A9BA11154E3BBC968C71C11C1299609D2EB3E40C964B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppxProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\AppxProvider.dll.mui
Size 25KB
SHA256 cbb34cf67dc87b2a060d4b75e3c94730f4565650210bd251a0b73e07588213d4
MD5 beaa6c9c4e67cc2e6a18775dc7b6da19
SHA1 e30f58a2a6d9b634be80c965f23aac9fc2d0c3c4
SHA512 ab24d242cb9129ae8f851fba689a5e868e03cf9b9342bb68c145436f2adec77b70f51c7c31d1b27acd210732f421828be645e21716a5a95a3d4cfac6614ef81b
SSDEEP 384:QLR3QBwXNaAJ3YI8pMyYWbooUwGnTzD9XjSWMj:QLhQ+XNaAJ3YDpMyYWbooUwGnTzD9TYj
TLSH
T12DB28D1277FA1209F2F37BB8AABA16550E7FBE629934C50D0198415E0FB3B518C64B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssocProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\AssocProvider.dll.mui
Size 9KB
SHA256 2239cbeb285351230632a7dfd39feeee1fca91cee314676121a7cb71bd31d6bc
MD5 5b467c45cdd1f5df351c88e2aba85a11
SHA1 6d6732a51199b1a90c0fbea2b4f555bd36231ced
SHA512 6bb3854c22ead036d38c9ae6b968eca3f573d7f17d69a5c2e9fc5e9d79f392240f3b010f67a2fb272aedd65c2d752fc70a8b4e5fd0188aad0108e24c97ba676a
SSDEEP 192:aSRdWd3CtI1gQm+sCah4srNQ1kA1/NrkYWHUAu:aMIm/kVW0F
TLSH
T12A12B25272FA2655F1F73F78AABA12550EBF7C12AC35961D068D416D0FA3A10C8B0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CbsProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\CbsProvider.dll.mui
Size 60KB
SHA256 41d2932082117e8a0495524255a5b384862413e471083aba58f05c0805a403e2
MD5 94ff160e9844b094a59a6ade787a1fb8
SHA1 8d8e5d3bad491325f8701767908c5c8db902aa3a
SHA512 a8f8ace61f53989174b7211312ebd35c868d079a575e93ffd95a7abc193075527ea686e7d7142412c1e3f8bdc8b37bf8cd1d07f601eb1e79f152754d97307447
SSDEEP 1536:NoGe249nx7ka7V9GaKECHoqCgildJ1FaicQ20a:KN9nxt7/eECHoqCgilA2a
TLSH
T14453BF2167FE1609F6F37F78AA7A06594E3BBD52EC39D51D0295105E0DB2E608CA0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismCore.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\DismCore.dll.mui
Size 8KB
SHA256 aecec5cfbfabb1c8646b7efd4c2cee17ba3ad056c4dae44c420da736ecb61365
MD5 0e4351e98c2720e0dbe098746aac8de8
SHA1 77171dddee21dd1f8801cd3ab421ed59a1bd6735
SHA512 a4f26a0b4f153eb4aff21434a3c06cd00369c006d1b706b22c7e24fc315d4db13d34f233e78dac3f3f37c32acdc4df64877c0d6728a0865f075cec34b0fcab57
SSDEEP 48:y/y4iW5t7ySXlegEsPolgubPlgubPlgub8Y7gnuD4lgKKY7gnuD4lgKmi6LitOiW:KPPQafAD9ADR2pm+3mz1VgpnkWssM
TLSH
T1A702E221A3FE5619F6F73F30A97912695E3BBD53EC39D12E0281106D18B1A649CB0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismProv.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\DismProv.dll.mui
Size 2KB
SHA256 5feb00e3b46a7097453b6b4d4c133a8cfcba60a677e5e349634224746717db21
MD5 1f7ff9949dabba4ad3cdbf4d0759b033
SHA1 9b12cd640830ec801427155d77c693d68091c326
SHA512 edb16133a8deec5a8f19eee31a301766338bcb2c7631d171962b4142c698d08e32c4d38febc95adefabf089bcb190eb9b42d3f944a3aa4594347681fbed48a69
TLSH
T150517D0697FB062AF0EA0B3556E70A66577E7D12AAA2936F8F00112D38B45049DB1F72
MD5 SHA1 SHA512 TLSH

Submit Download

DmiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\DmiProvider.dll.mui
Size 19KB
SHA256 0b08fe0aa971ad3fda569c129b1f6e4605bf025c264b107828d3abdfcdebc58e
MD5 e008f678d3e0f7263ef4af05a8e86c6c
SHA1 6367a747b8a3c3cca488cba17e5cc4d1f9fd2d0d
SHA512 89d720b44e35d53ff6899e8eb6aae99482a55895190c9dc20575930c44c343231caa5e7f9ed212b02e2d2ee294d6c3db06a29a60de1d1c8c6e13a18248ece8a1
SSDEEP 192:yNd+fCQgwoxKygW3x1W/G6bcTRLdfnZ3/G2RqNZvZL5kGJWI3Y:Sd+fCboHa1W+6bY5f6/WII
TLSH
T13192C212A3FE1609F6F37B38A93E06251E3B7D96AD79D11D0285105D1EB3E608DA1B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FfuProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\FfuProvider.dll.mui
Size 9KB
SHA256 dbcbb5218ad6363845f4f7615d2d3c775fef1e421f7a0f1918c4ac54288e06f9
MD5 c6f85c85f5e5bcd13003dbb6ffaf0b94
SHA1 693007ff47a374dedfd408abd858f6a55adee82a
SHA512 607a4f990e36da572d980d24599769518c235653d3d0cf9c12287770eebd3962d7538eb112899bc0b6b8dbbff9c1ec0fad220e25ed39344264a5a4e321e47bc1
SSDEEP 192:39UcVo7nI+5XnEhLADlDS+d4LfS65Xocb1CE9WcCWo:3eLI+5XQL+d4LfS65XJBCE9WcCWo
TLSH
T13812BA0273FE561DF6F3BB786AB612210A3BBC95A875D71C0698111D1EE3A5088B1B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FolderProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\FolderProvider.dll.mui
Size 2KB
SHA256 996fe201d45099fd72b7ef93495fb11c875cffea770d6b41e90f815e64090174
MD5 8e8f3a993636d31c04c4454b94b3cee8
SHA1 76ac076a72cf98ee8c118bb97f7a83861a9a2ca0
SHA512 12dad2ac3cb3e6d5de4a4ce3a20d7c6bc8c4d1a36dd2726e279fa25232c585693ee8540ed35078633bd2ee0fd41f09747e91defab60da71fc0a6e790b12ae65f
TLSH
T12E51BD4297F7162AF4EA0B3469F70A661A7E7D21AA62D32E8F00112D3C707049DB1F73
MD5 SHA1 SHA512 TLSH

Submit Download

GenericProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\GenericProvider.dll.mui
Size 5KB
SHA256 81e744ae77bdfdfa7602b808b97e5c9f7066b8994e79630d155d87fc6eecc5e9
MD5 9c1cd51ae8e1b13f88aef5d06c724e13
SHA1 15b5b2150832e32aed0bd4e6f6750cf8fde92ac2
SHA512 ba17a831a77110a3a6ae592e97191663b0bbc8dd15f8b597c5cd1634625e696f47b1195265194f23a576aec02ae80b6c595e524409e25a5be5abaa4579288628
SSDEEP 48:yeWBrd3g5FTL00xiZXMHthIdfuwCp80SQoZWofgBuBxlbpaPgx:sZAImFkWy8e
TLSH
T118C1CF45A7FF161AF5F73F349AB645950B7FBC13B872A22F8644101C1EE2A8448A0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImagingProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\ImagingProvider.dll.mui
Size 19KB
SHA256 e29c8a3872a4c2e7d9f98c38fe90d40d471a46219b20fd0916708f55b9ae8a32
MD5 95e04f99f554382c19c632b5856ff54d
SHA1 d4292e03c213f92b43e965be2a6e506807d0f374
SHA512 a86c047020316dd575c96f5aeb78162ca199b04c3d7b44a680326b87fdfe2b9e1b6adf1ce54631fa1a5d9d8cf4dfe904192a5082f061484fd444265e0dd8e248
SSDEEP 192:aoIumoKFfoY5u2JqPoS5inClSOSHUxlbN5iQ7VYT68+pFP5iepskWWCFh:ZIWKFo+sTniilbDAfwxnpfWWCr
TLSH
T18C92DE1163FE0209F2F37B79AA7A12154F3BBC62E835D11D12A8905D1EF3E908864B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntlProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\IntlProvider.dll.mui
Size 32KB
SHA256 b7bef046cf104c8eaf0697007ea35261d0c8a5500d584fb707cfad9f9055fd78
MD5 4906d8cf79603c4b485440c04a832e7c
SHA1 0ccc3ddb7a4a0c425271537094b0a5670bb27993
SHA512 7c2ab03cbcf25e2bf4883c4a8410ef86be78cdd75dafe1b115bf6ea01d1272d4b36e90ae688673fc34a483c930663a1bfd518524a8de30bed54d8bbef6651106
SSDEEP 384:VPz2mV6rPmG8eE+qflNukgAQ4Q7kfQimiWwy:RqhrPmG8eE+qflN/AkNmEy
TLSH
T18CE29F12A6FE2219F6F33F38BD7A01254E7BBD56AC39E11E1298005D4EB39549D60B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\LogProvider.dll.mui
Size 6KB
SHA256 9c96c8b812c0603525985f6b6f83df016064d513cdbd321db6982750f39bad07
MD5 11e473163495717bd22c340353a9f0ea
SHA1 a162c63c1f5b15676b5898480061f47e131277cd
SHA512 3e23c991353ee843b464977e10b6f56a2977d93b7cf666ad92724a029bfd8c6a51d3c74d99a614756d5f675cccae23c3e5f5d1cd936ab57f3a3d940fd8c7b19c
SSDEEP 192:fF9IdHoa1wy5IZ5XBFOtu55JR5Na61WZLm:f/IdIHMI3x8EXJvN/WZi
TLSH
T137D1D20167FA5219F5F33F30A97A09A90A7BBD53FC35E21E4784102D58B162498B0F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\MsiProvider.dll.mui
Size 17KB
SHA256 6759d936ceb9e1568c6f8c2b536aa665528666a4bb1bc36a4e7cc1418584d3d8
MD5 a675898b9ba9d64864c18c74f1c412c5
SHA1 d774dd3d6266d36901176644440f2d04ec5d8b61
SHA512 e5de32652f7b3d3c56df9d1aa2a7f99046d235d58e088bf8a918a1b3fe273801142b09672bdf17b54d067e765936f469a050992fcb10f56c6d23d378079be4ae
SSDEEP 384:6OUbsM1x8tFu8lZy+pi4tVpxcMr3N01W00:6RbsM1x8tFu8lZy+pi4tVpxcMr3N0t0
TLSH
T19782CE2273FA1605F6F37B78AEBB15654E3F7D22A835D51D0199055C0EB3AA48CA0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\OSProvider.dll.mui
Size 3KB
SHA256 1593b71998aea17dbe2d79dcb724c8e322cf2b42f1085287aecc4846c6110fc7
MD5 107de92a12daac69d7d35db6383f3288
SHA1 1ac50d3531ba1fe26db66a80dc5bab328584f3a8
SHA512 4b63c5889e9fa68570459cc9d6b365443e2efee6a962a356c53749c0d873ce5766cf98e4de6dd4f0653073055241679a26c74df789791dd9f216fb5cd90a5ba2
TLSH
T1145156015BFE1219F0FB2B346ABB0A660A3BBD62A875E25E4B40102D6C70654DCB0F73
MD5 SHA1 SHA512 TLSH

Submit Download

OfflineSetupProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\OfflineSetupProvider.dll.mui
Size 2KB
SHA256 7786258c88638cef31b2f012dcc6982ddb504575b4197b2d35004531d644c676
MD5 f3c9a0354a32371faa1ef99d5f95e4ab
SHA1 ac20b37ff15cfdf11b9bcbe327335a474a1b3ffd
SHA512 53f9e8dae08aa8cb4297721ba5e47d4855ef6b35066ce727a416468d2ccfa574b0caf432e9bf2411490a06dc0fe00529e5ba7652f78423c1a320625d8b50b81c
TLSH
T14E51BB42A7F61629F4EA0B346AFB0A2A563F7D21A972E32E4A40112D2C745049DB1F32
MD5 SHA1 SHA512 TLSH

Submit Download

ProvProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\ProvProvider.dll.mui
Size 4KB
SHA256 dd3129c091c6a6606f5ed2155cf08b3fc8145de346afb0d1cf61c9ce41c94784
MD5 3a9147271851e3cf031227e616c7d710
SHA1 33f789539bf7cd1ec71532a361b858e96aecd450
SHA512 19587e2dc95f8be9158e3b8a723dd2a9ae31024267ee8939fbdad81ae962a9f2a4329df2b9ed9aba7edb97c52553de3f78410903d37aa76f7c6a81e92a7aee35
SSDEEP 96:CQG39FbyFAMLhFAgd+J8W8kyMLLyDkWQWSZWwj:CQG39wDlYO6WQWSZWs
TLSH
T16791250267FA1159F0F71BB89BF749B20B7EFC53A672E22E4744111D2CA2A454DA0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupPlatformProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\SetupPlatformProvider.dll.mui
Size 6KB
SHA256 69aa27c46af765eff41bb9d3d89b8103e088cf2d675ca7f8f75b2863685293c4
MD5 4de5ad5431eb5aa8b8598edcad003479
SHA1 933f68c3facd43eed511711fa4b684328b9350fa
SHA512 b643c984dcdfd43928a3d48d8bccf22c90fc9ec368216cd79b697f6b9f857ab09d522220a878c20d8a32d2defb4a94fc483f2e403169ceed7edd920a8346ad05
SSDEEP 96:xHcKKuKAJKUKt4xuKvKDKD4KFwzUol0WxYvQVkWafn:xJLtJ54a+u4/zUol0GoQ+Wafn
TLSH
T138D1BC92A7FE2264F1F33F34BE7A46950A7A7D56993AE22E0794004D48B0654D8B0F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\SmiProvider.dll.mui
Size 2KB
SHA256 523cb94c141e426b66e9b3be4ee07a6ff9212d77cb968c18f36927252abcf63e
MD5 3c544db581cd2b12c2e1243f146ae7f4
SHA1 e4160b0837f701a8ee886774396cdcc5564b961f
SHA512 f8515d62e6093983d631d38ff011fb2a7d2ce0f6893de4df0ff9acc980b5786288744c80a922148d0fbf82c08933202f56d68c679d1aea2837c5f4c92bfbcc3a
TLSH
T18D51A10697FB1626F4EA0B3456F70A56177E7D16AAA2A32E8F00112D38705089DB0F76
MD5 SHA1 SHA512 TLSH

Submit Download

TransmogProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\TransmogProvider.dll.mui
Size 18KB
SHA256 8f35db3053ba5c4fd7d6cffcd250fb483c0796754b2d70de6410314e86fb23d7
MD5 604a38894edcbf4a5e5a80ffc1152867
SHA1 baa59863ba8394035d81cea801af73ad03c5ab05
SHA512 0061d8b7c699b7b132e81e29aefe646067e7383c9d86e408bee1979c2d4068dbf6833d305e6ee749be73aa9d27553cbb3b454aa6c7df1f934871c65d5ea3daef
SSDEEP 384:7b5+jKoSfjFTC9p7xBFI/vF/pyz+G1rP09stCGA5skProkqWE5:f5+jKoSfjFTgp7xDI/vF/pyz+6rP09s5
TLSH
T13C82BD2263FE1609F6F33B38AA7E46250E3BBD56E839D51D11D5515D0DB2EA08CA0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnattendProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\UnattendProvider.dll.mui
Size 5KB
SHA256 bdeebe8e6233c79e8e951325ee86ea56921dffce60d6198ac506428b1c303d80
MD5 74ef7fe50beca88b126dc4fc16b39876
SHA1 d740740bd0e9fe889e5d88d6733261966f880c34
SHA512 9d7bb5cdb52b344e8a2700f5321cda483c77cf8949720a1968f678c85bfc23a1b1392643bc6b825ba454ea06d6fbd2fba22cde4bff799fd4269d4a80aa803773
SSDEEP 48:yD+34FY3mzdWgVHkBc1O9v6JEeu4o2xxzBdzrEeu4o2xx9QoZWFvghuUxcPRaPgf:nodWIkE6ecemkWFQs
TLSH
T10BC13512A7FB1219F4F33F34AA7A16550B7FBD62A436D21F8644005C1DB2A548CE0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VhdProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\VhdProvider.dll.mui
Size 8KB
SHA256 8e024654cf1869d28cc7b0ae5e170ad2ca815e5ea67823c79dd383faf0231171
MD5 cbdcb943ab6ca6c3d52e99a1a2cddddd
SHA1 a08440ffebc85b123427e11b6892ce7c49a73d37
SHA512 63535d89d28d1b1a34ba6afd3f6c4c31e49d4dce20e212220efa88128f15e36ef4d28ca3ed7ee02d7ed01650bb890bf614cbe18d9a93348fb278cda19c4e4c80
SSDEEP 96:GksxTOy7v5VxxiXiYplikbbkJiKgipxN5bHBZPB8hGfivfoFGHcglgMsi3XNkWXF:GkCObZbbeFNVS2i3rHpgWXN7
TLSH
T1F702BF12A7FA460AF1F37B306A7816650E7BBE93EC7AD15E4690111D1CB1E648CA0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WimProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\it-IT\WimProvider.dll.mui
Size 31KB
SHA256 34cffaf476ce3ffc41aa6d43818bd541d65eb4b8a7760d0d085049961da303b8
MD5 84ef0cde36b5c8073d4ab7ee2d55d5ce
SHA1 3802a7da41170976de01af537f44eabb1217d807
SHA512 3d69fa4a00f548fc4a2962870db17382fb66fcc0ad59023977587e18cf5495b63e09a5735f24f6073bb2b24e41e6261e4253df9dc5ef5730bcd8540bce29e286
SSDEEP 384:EQvcPQp7FpM8wFIpYvGnEGjeF7bPKEWEX:WQp7FpMbFIpYvGnEGje9X
TLSH
T12FE2B92167FE120DF2F37B78AA3A16154E3BBD62E835D51D1199605D1FB3EA08860B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppxProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\AppxProvider.dll.mui
Size 18KB
SHA256 cfc8ebe044a5fb8d2065ccb064c43c71b5574aeaf92f113e25a36c58dccfa406
MD5 e76079779fb26fd42788c06fa9ee43e8
SHA1 f8042c80afd9600e9181c32e5aa7dc3f985da59e
SHA512 3bab4ab3012772253a51aa708018c38ecabad8ee70343fb18556213e5c8adf99a300360fc2bc1cb1928c4b7afe7168b5889fc58add1c8dd6be4773a2d9575219
SSDEEP 192:YLnPBVEbtftOt5zsetUtrtutAtKt0tptjSdKRwuI8uVzY5hWF2ztd0tdEz/gOW8s:YLahcs2UpMyYWbVlUKOEYsW8+WM
TLSH
T190828B4A7AF60258F1B359B85AF330E11BBFFC608A71890C05DC914E4F937869B18B76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssocProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\AssocProvider.dll.mui
Size 7KB
SHA256 2527e7e7e58e9eaf17f41410e23f8f51ecf7c22a2f8853c175ddfd1c0c192f13
MD5 fff347e0c489304e30564cef7faccc30
SHA1 e9f8a46da580bf4b710bcd4604dfce85d7d65b12
SHA512 d491bf2777743f062da6927db2fdca128272e3040846176f76ce8fc6057e65e3f83c9f7dc5924ee6503a2a5c6e4bc5adc871cbb1169e792dcb7bed04caeec580
SSDEEP 96:BC7EIvNdNAW6wsUThHNgD5N5N/r1kAPVgYzZiWt1WDKWwV:SjvPCW6wsChHu5rNr1k+sW3WDKWi
TLSH
T1DEE18A867BFB2649F0F64E7996E351900FBFBC561C72991E468C811D1F939048AB0F72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CbsProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\CbsProvider.dll.mui
Size 37KB
SHA256 7ea948c5fbfa231253b263b464c682da315b7264ec32cb7fcbb507e32440a065
MD5 a2bf5378a8346ddc90d2731827c8e55d
SHA1 6e63711063977db8e6e48b4315e5a3f5d3620a02
SHA512 f946e2373c4a34e41eeea9ec59fe0ffffc4be2d61492ed4170d214ccca24de61401ff11338f11c4abe8bec34b84cafdebf2e4a954749ad3a7fde16e5b5f75a9b
SSDEEP 768:jMJKIzSGN/zxGHzIBHxH6eAPChbUQ1ghZT+:jERzSGN/zxGHcBZ6eAPChX1g3T+
TLSH
T18F03F04476FA145CF5F36AFD05B361DA1BAFF86185B1CC4C059C610E0EA3A865F08BBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismCore.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\DismCore.dll.mui
Size 5KB
SHA256 b1c48ea18d50d27d86dc07c3530605ef5fca0b3dcc27cc5acce8bb9edfc4a254
MD5 b13922c43c5f5cc1a832e2c2e3c8ad4b
SHA1 d2f7e192837b53ed43d8d8e44e0d7ca533159725
SHA512 fdc6690654d67db50e17377b2f744b6ad3f16de7e1ec8bc90a97643dcd1e5a03cdf71dc39c9db8c92be921af9a120a5832d78313cbacf2f79405a589b1be86c2
SSDEEP 48:yoy4kW5l1tfFdSFdSFdPl362l36X87L9At6d9pIt69nnoG5GhS5x1hydqLEjHZWI:BJ8rM7L9pd9fB5jhq1WxEOWwW
TLSH
T143C1FE8D7BD7060BF4F30A3A46A621D52FFEFD13A9E6589E8B48800D145440C2A11FFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismProv.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\DismProv.dll.mui
Size 2KB
SHA256 4a01b7d5d6ac1626423f00debafe452555c93a92164b944dbccd2027b7119edf
MD5 ac24c87ccf2c81cf8f9c8d825d641563
SHA1 7ec6cefdfc375053e27bf21a301e5bd952c247b6
SHA512 0b707702bc19f4b8141e96590e835b34220411b6d8a52f1482b350043d3e796d351dfa58e8e3414d05a63f651274692eb96a1485ac89e924c31aa6796f20dd9f
TLSH
T150517D0297FB162AF0FA0B3156A70A66577E7D16AA71936F8F00212C38B45049CA1F76
MD5 SHA1 SHA512 TLSH

Submit Download

DmiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\DmiProvider.dll.mui
Size 13KB
SHA256 8ea40581e4d55ce5bd1290f73bad7ccb99633095c28df3529c3882554a3a9b63
MD5 4848ea901705815f997f79fb293a5aca
SHA1 2ec7d10e0c95432f233a2f995d0b4f24a90f73b7
SHA512 d441060b18403cddda63d90d63253edfa7573acfd5afc5f910773a51976809d94f49ee9658e6600d9575efe8a6439e923852d091a87a1a60e0c2c0e3451f14d0
SSDEEP 192:HU5fRgxVOkm6YCu6UvdLeMN8YXaFe0+KWtvWI:056PxDYCu6EdLeMN7XagoWtvWI
TLSH
T1B552FF0DBBF5054DF8FA49B9427235A513ABFD5089F2584C069CA00E1FF3A5A1B04FB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FfuProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\FfuProvider.dll.mui
Size 9KB
SHA256 fe117ec4ef1deff67da7e5650cdf33de74b25c01bf42b63faf9c70ac4b1d2144
MD5 595648e525f1d9889bcc241ed9babaf2
SHA1 a925ab13b1df8b46ab8baf7eae4b9840b45aa038
SHA512 c8d737c1a2bbb7714daa992f35f81e9f6805fece7426a376c165a09107c539ea7c24b44f3304f13fe15e113f5201e44209f32c36ed1a8ccefa971f015ac6d22d
SSDEEP 192:i9Uho7nI+5XnEhLADlDS+d4LfS65Xocb1CEMWcCWv:gLI+5XQL+d4LfS65XJBCEMWcCWv
TLSH
T1FB12BB0273FE561DF6F3BB786AB612210A3BBC95A875D71C0698111D1FE3A5088B1B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FolderProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\FolderProvider.dll.mui
Size 2KB
SHA256 c32d4ab97caf8a9e568f0d69433ae5905d6e01f486d4c01103bad3d90174cfcc
MD5 d9e6efc1ea5a0f16754f6f7fb0362fb1
SHA1 30b03a8610f891bda9527440e5b045d6c26949a3
SHA512 bf92ca7e77439bb9a9fd5b603dc4f881563801116520c4d758d1dceed199fcf45deda42af250d5d86e7d8e53b1dc008be2ff131eb3e1d8044897969f34c8f6c8
TLSH
T19A51DF4267FB162AF0EB0B3029B70A611A3E7D21AA71D31E8F00112D3C702049CB1F77
MD5 SHA1 SHA512 TLSH

Submit Download

GenericProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\GenericProvider.dll.mui
Size 4KB
SHA256 a9016e66c6ece5113f4786e40546e1bbdd5500db9e6778622256abd2131ae966
MD5 efe9082a7f4c66fb7cbddb7bccf4beae
SHA1 48380a0162fe35da48f90ee8721233753b198c0d
SHA512 49cb7825cd74ae991e546e808603e840f4a9fa921eaeb7bc8e79c016fa0fc48e8fb2c4ada86b4d8d918402c793e532c9e0b17efd1c96611b7732d22bc66f515c
SSDEEP 48:yfWD0dl5r4LA2BVM/31vVOREhEO8jHZWmcu8bK5WwHgk:LEMEq1WleWwv
TLSH
T158915B45ABFB121AF4960F7486F345E15B7FBC1375B3A22FCB4800092EA76485984FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImagingProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\ImagingProvider.dll.mui
Size 14KB
SHA256 e51b54ad8eb5fb7a9236d990f2966d0f827e73cbd490d67d3b7bfdd2191db931
MD5 db635b4eca851068ece6086c2d492dde
SHA1 8b29132d97ac6dd7d70f03d8de70282499b919cf
SHA512 b194c292e6b69c545f8accff62ccf28f8bf2f2dd7c623c701129cb39e7367edd9bfe7394cef47a26c7f1aab83b7e568ef3eb25f24d8c4ea6600fb769076883c5
SSDEEP 192:yn4sZlF4AMB9FDCZ8p1FrjRUM1o6/t0B0je8NKFNjBWFlWr:y4s/FmfGCpHvxemG0je8IF3WFlWr
TLSH
T1D362974D36FE050DE4B35EBD447322E657BBFD1044B1895D1AECE10A2F93A816A09B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntlProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\IntlProvider.dll.mui
Size 20KB
SHA256 ab45816c291db1dca40e4132900e0b961e56415cc37aa96fab144aa206b1be89
MD5 d0a5b5cb5793bb504dac1822cb684372
SHA1 6a59b1849f5212a3ee6c25eebfb083c39ad63edc
SHA512 7d7f5586c612ae77624f371adc37f07e061436d2c7ffc725386be6212816dda656db1199984ea66a19501826e07f57ae69d0196ba1959f80e2eab37701b174ff
SSDEEP 384:pmxLDebIOxouJvfsek0QXQspvoBoQAWa4Wd:s5DebIOxouZEek1pvoB2b
TLSH
T16E92FE8876E7155DE0F28EB9417732D517BBF814A4B2881C1ECC800A9F976CD5709BBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\LogProvider.dll.mui
Size 5KB
SHA256 ca8b20a1fb15714910e0c137ae81e0ff82e0a5a8c49c732d5c510adc9ae54dd7
MD5 1f400064e806002b0043ec3ccb33b12a
SHA1 a15903406575b0752f4a7a085cb8938731aa0134
SHA512 8a46f3990a659f28673c666b0018d80692e39a8d61642bcf69e025cd4ab4afb4c64c8946a7dd3e4460aa972edb40bec002c090d0ad4ed41ef37992eef3bd3713
SSDEEP 48:yKLntV/S6gRXbcQVoHLU3kt6UAwEjHZW9PAuz0K5WwHgb:FVgr5VoHLml31WlZrWwI
TLSH
T1B3B12E4577E71546F0F20AB686B1A1C11BFEBE13A9E2A65F8B48511D18703092D50FFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\MsiProvider.dll.mui
Size 12KB
SHA256 7cba031d76404d1dbbedb48d9bac4d240c8ede0a427229a84e8208a38988ab63
MD5 d69cbc0e263ad9584c8c23f043a03c9d
SHA1 17279ca4ac8e63c6bbec95eac3a0254d6938f0fd
SHA512 5931fd16721444dff986b9196f7a9a931d0733f0aa89301bd617c78be022008d1ae61e7760fa1f95f859192dce0040e3720587f1dd42a0bcf053dd514fe842c0
SSDEEP 192:8pTUpzW0kMD5r4QIqwLaG3SHm5kVRv1xChlHTzWLoWb:ugVzD1MVlkVRv1xuzzWLoWb
TLSH
T1FB42EA41B7FB014DF1B78AB942B771E52BAFF92006B28C2812DC400E5F536C64B56B79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\OSProvider.dll.mui
Size 3KB
SHA256 8bcaffe6d9d2ed5ef57b79ad4de4cefe6431763347b6b1d091f224e021e391e0
MD5 db199a00be2aa8ac162375bc87ac8ac6
SHA1 8300a26f851bcedd39d7b1d61fa3d076d8f303a1
SHA512 ba937d0c7e6d5a81ac1926d5de88703f2108dd69f3ddd55f0f9fc099d0e88362c0b2badb06adbb8713fff8b039ef07f652a504f4fb157e366dd0d728dfd1f084
TLSH
T17051360A5FA7011BF0AA0B3097E306E55BBE7C1375E3623FCF401119289450899E1FB6
MD5 SHA1 SHA512 TLSH

Submit Download

OfflineSetupProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\OfflineSetupProvider.dll.mui
Size 2KB
SHA256 b749896c362801d82a54a4ce4e29906b24ef4b0e79850356032e7f6ac7d35174
MD5 b11e3bcb26db8122f2f240657937f555
SHA1 8e863f5f6c58dd8852e06e232288c540c73a4f4f
SHA512 130886619efbf115401123b28b084ededee8b0fcee4369c019f1cfa9c72695e78ad9ccb7e6611bd6b8227ad7b7f60b8022ce70d7b194154842cf02e1c2637943
TLSH
T11951CF4367FB1629F4EE073466FB4A26563F7D21A932E32E4B40112D3C745049DA1F36
MD5 SHA1 SHA512 TLSH

Submit Download

ProvProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\ProvProvider.dll.mui
Size 4KB
SHA256 28da3b15a8b2ccf8790fbd51d50c3987612f29ecc3a05ebbd25de1754bd35f94
MD5 07ca052ae319d1a94b60131cb2aefea3
SHA1 5a182fd3dafe34917a93cf461ceb28696def0fb2
SHA512 30ac6549a71f7ed054c6cad99244ad552936bc3bf982c2564359c19145730a2af418bd564265252ca7cfe229026d9283d8d5d48165b25e000295c5e294fed711
SSDEEP 96:IQQx9FbyFAMLhFAgd+J8W8kyMLLyD1WQWSZWwY:IQQx9wDlYOrWQWSZW3
TLSH
T1CE91350267FB1119F0F71BB89AF749B20B7EFC53A671E22E4744111D2CA2A444DA0B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupPlatformProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\SetupPlatformProvider.dll.mui
Size 4KB
SHA256 07c0ef2b375923dbac3623453075920d4ee1b3bcf85d40e1a57ab532d8c19524
MD5 ed8f61022b497021fa127d3c9967c23a
SHA1 375400076612a997b8def30e6c4ca5be57eec408
SHA512 63946e2d6204d325259de4e5fd3ea18772b18b954e9549e41fc05f28c63e6bb362c4a4c34e7195b8b8b9ea2645c105c89f83a9b679130e7917ec4e404fc6ac7f
SSDEEP 48:yEceEVRPBKcBKJUKsUK/9+KJKFcIKgwK8cm0d8QG0Oc0S0m0G/KQjHZW6nunwK5z:4rKiKiKbKEKJK+IKjKBj/91WNXWwf
TLSH
T12291104ABBF60A2EF1F30BB06A7615614B7DFC2066579A6D0F59111F2C702045B52B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmiProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\SmiProvider.dll.mui
Size 2KB
SHA256 6d899a83c00bb0cd13be07daa5bbb304eea5b22a82d117ba543f00b43239081d
MD5 936c9e7aa93c3aeacc9887a3ce014e42
SHA1 ba2ca3ecf6818b92f78ef7f618c8705bf4343232
SHA512 f40ff420621678c7b3c63e1b69f83a22ccbb1f1bbc3a7b4437fabed19f93004c474aea4406de6b582f4d11aff49474dbeff4e3883dc6e73ee80a658a3af68ec0
TLSH
T15C51C10297FB1626F0EA0B3456F70A66173E7D16AA72A32E8F00152D38741189DB0F76
MD5 SHA1 SHA512 TLSH

Submit Download

TransmogProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\TransmogProvider.dll.mui
Size 12KB
SHA256 1baded3205376914442a5c300a7602cca693720b5d97bff0fe891fe997fc3662
MD5 b84e4d6a853fac7d9b7e1092ab1e90c4
SHA1 6755f298d78fa28e59ddf523b42b7df30325b878
SHA512 8eecbd372c42160fffa8c5c041ba4b8a2b50d9e0a2237ac181d3a3514ed70ad59984ad223ba928f1c9adb6253fb66a234c0a63c7d62ce79d2ab525d0ecdb993d
SSDEEP 384:P4w35UWNNIlj19ikx2FYp92cyxs+MDoPqtmqacMTe/NfxZxoxOUsJb/nMkvWs4Wj:P4w35UWNNIljfikxkYp92cyxs+MDoPqV
TLSH
T1D942BA0573EB1408F0E64A3945B671E127FEF89554BBDC4D2FCC511E0992A896B80BFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnattendProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\UnattendProvider.dll.mui
Size 4KB
SHA256 0d16a08e631499cbe13dc8ad3f00b6556f0a55c66477704e187933b1613c4ef6
MD5 91518a87c297429aeb52dc30d84a131c
SHA1 10f347d82c1b04c746876ba94522280bf791d5a9
SHA512 822de4158fb82c865f0fc28a4fe522ac3e274e108733b1572a124e635e9828e8fc4019f25e490cce4e35b31da96ee56973af6aee88fe464a9169ccb0f9749c31
TLSH
T15181DB0673E61729F0E70B761AB366611B7FFC309971C24E0B48405C2CA66496E84FBA
MD5 SHA1 SHA512 TLSH

Submit Download

VhdProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\VhdProvider.dll.mui
Size 5KB
SHA256 9f25d99249430d51be68642fa8d17615583c7b0ccbb22facf3632601e4908203
MD5 f2eb563cf97f341bb240b80b402a9238
SHA1 2032061c6c5022b1671ee4798872dfc961000a96
SHA512 cec465a39d4eb1f7a5f382e0e532f9d031721b83722fdf2a111172b56e4af1ae21106a1f7429e6a580e9bb2d371de794372a9710313e0d5147be8d805229f1f9
SSDEEP 48:y3K1Ohc58VOwYMQywlGtltpXc3YDr6FUiRl28N9y9J6frTYGLs8jHZWnTSuFuK5n:0EMKcOFUWlNy01WFtWwD
TLSH
T1C8C1E04E33FA050AF0F3453640A266A207EDFD8155D7A6AD8E8CD00A682469A5F45FFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WimProvider.dll.mui

Path C:\Users\Admin\AppData\Local\Temp\A3262118-6C21-421A-AE0E-3243BD72DF03\ja-JP\WimProvider.dll.mui
Size 21KB
SHA256 ef96a9d1692b95abce3cf1ee0b5d69c6e1c89e24523dc1af966a6ad2129488fb
MD5 2a8e2a7037e5c1af91364a4b16a8a5f8
SHA1 5c487429258ec1e7e50d48975070ec685cac1ed7
SHA512 da5486fe1c5e3073ed4753d3d5306ec08438050e56c8196f21ac560a90dcd0cc312e96f6eb18a83649b460be1966ab5667328a0d5a08814f0df246c9f9767d4c
SSDEEP 192:+xjxKhHbfM+iSb7F4AOfO26xWi+woI6M6BTeHMyVY+k0he4EFDORNDRt/7vK3ouY:+EyI3Z+z3M6BCHMyK+keeF3oqWrMWj
TLSH
T1B7A2A64E3AFB010DE0B39DBD447361E6677FFD1048B2985C1AAC610A6FA39855309B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_2wc05xkv.kuk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2wc05xkv.kuk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 2.1MB
SHA256 5000ba33d9a7c1646e97ab5d2781430d62d90d34d4bbc8b4a6f012f4574ba6e0
MD5 931ff7052557cd1a5d8636b45f643ae4
SHA1 2a44292604c178aa4711ecf34bd289ada1d60b2c
SHA512 68b90ba7b91358af72388fcf8bc340c48b6c8ceac0bdc1bee506fdd9738689e7b953a365dcb14d6e0f2edd8c5ed696b81db3228e9704f5fe9be68897ff656065
SSDEEP 3072:TvQpYi0uZ0tyR27TiRfbSB5JwYMBKPn6QRq5HRpuzFXMUvuu0XmRgnt:heHNg2
TLSH
T103A5CD3E13BF09215104848376754BBCAE873187AEC9F758397FE22697C2D938A196DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 2.1MB
SHA256 945b6ed407d5087546716c38990bb39442d46253c70f98e16915c69f42e0b11b
MD5 dfd2209de4d476fda92f527ec4567acf
SHA1 78b44767b8f88795f4fce33e04e6427765220baf
SHA512 9f49f49581925258a5ac259b497d56f5efa193d93cc37b5f092ca6ea20efd9a6eadd2912bae46edb197292ebc7e96e377b59806825d842d36e6602e20ec8debe
SSDEEP 3072:TvQpYi0uZ0tyR27TiRfbSB5JwYMBKPn6QRq5HRpuzFXMUvuu0XmRgnsKZ1:heHNgI
TLSH
T1B0A5CD3E13BF09215504848376754BBCAE873187AEC9F758393FE22697C2D938A196DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 4KB
SHA256 3c85b31896983bcdefa9ffa98b8cc2e863845115cca4b16850c0cf43df565fed
MD5 4ece6e909c0496f08300c66e3aee7a12
SHA1 b46de8b6092c3cc97197087d7c9331935e9b17b3
SHA512 a3bf98205b283f5203fc3d0bd6b31ee78d4d52b19c82b4f61fe0df6aedda5d7a0ba632c88e8742e786f27f4d4970dcba9a14e9d08a00b5512ad573d49bd2e0ad
SSDEEP 96:vDZEurK9DvBDbzbbbGbwb0kb/bEbqbbbUtD6sfbACxVOqbLbzyKFhbmbsbjbjsbU:RrK9zBU
TLSH
T106913538827E059E5FA9B473DF1BD48470CE738B085E88E4545C8E6FA2333A5614A7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1244-527-0x000001C4BD5C0000-0x000001C4BD5E4000-memory.dmp

Download

memory/4952-0-0x000001A8866E0000-0x000001A8866F0000-memory.dmp

Download

memory/4952-2-0x000001A8864F0000-0x000001A886512000-memory.dmp

Download

memory/4952-1-0x000001A8866E0000-0x000001A8866F0000-memory.dmp

Download