Overview

overview

10

Static

static

10

2026-10-01...lc.exe

windows10-2004-x64

7

2026-10-01...lc.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    148s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/10/2026, 09:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-01_8dce46e7ccac6b501ab10cf02665a85e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
  • Size 8.2MB
  • Sample261002-k6lcjaef79
  • SHA256 1d5b2584db736fce25002ca6f744f8e9713a87290bb9a847dc0ac6db5839d824
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionransomwarespywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 10 IoCs
  • Enumerates connected drives 3 TTPs 5 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
    defense_evasion
  • Drops file in Windows directory 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 51 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_8dce46e7ccac6b501ab10cf02665a85e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_8dce46e7ccac6b501ab10cf02665a85e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies trusted root certificate store through registry
    • Reads the TCP/IP host and domain name from the registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4660
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$d=$env:SystemDrive.TrimEnd(':');$p=Get-Partition -DriveLetter $d -ErrorAction Stop|Select-Object -First 1;$disk=Get-Disk -Number $p.DiskNumber -ErrorAction Stop;Write-Output $disk.PartitionStyle"
      2⤵
      • Enumerates connected drives
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1872
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
      2⤵
      • Enumerates connected drives
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2868
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
      2⤵
      • Enumerates connected drives
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:3028
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$names=@('Microsoft-Hyper-V-All','VirtualMachinePlatform','HypervisorPlatform');$features=Get-WindowsOptionalFeature -Online;foreach($n in $names){$f=$features|Where-Object{$_.FeatureName -eq $n}|Select-Object -First 1;if($null -eq $f){Write-Output ($n + '=NotPresent')}else{Write-Output ($f.FeatureName + '=' + $f.State)}}"
      2⤵
      • Enumerates connected drives
      • Drops file in Windows directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:228
      • C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\dismhost.exe
        C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\dismhost.exe {A6D59FA4-F149-40EC-A9DC-FDB65D2B540F}
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:964
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try{Enable-WindowsOptionalFeature -Online -FeatureName @('Microsoft-Hyper-V-All','VirtualMachinePlatform','HypervisorPlatform') -All -NoRestart -ErrorAction Stop|Out-Null;exit 0}catch{Write-Output ('ERROR:' + $_.Exception.Message);exit 1}"
      2⤵
      • Enumerates connected drives
      • Drops file in Windows directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3204
      • C:\Users\Admin\AppData\Local\Temp\EBC68204-50EE-4A1A-8560-51619B6CDA0C\dismhost.exe
        C:\Users\Admin\AppData\Local\Temp\EBC68204-50EE-4A1A-8560-51619B6CDA0C\dismhost.exe {3BB86463-2070-4A63-AD53-D2663CC0AE32}
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:436
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    PID:1060
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:1360

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          0CB652C796BAB51B3514BE21AACE5383
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0CB652C796BAB51B3514BE21AACE5383
          • Size 656B
          • SHA256 97658de8c68dfa98ace1e5028a63d54a1aae911b3e21471076c6850cd08cbab4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          4E3E4B05E877647EF3D7B912F256A94C
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E3E4B05E877647EF3D7B912F256A94C
          • Size 1KB
          • SHA256 ee5f7abd6981bb0255632cd8f49283451b4b18844d12040b44ee00f07b8fe2c6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          BDE28772A83DB7274166C9CC07B6A827
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BDE28772A83DB7274166C9CC07B6A827
          • Size 682B
          • SHA256 0fc0901cca2bae9e9fdbb02d50d02f1094f7b36672086991b9e897626dc485f0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          0CB652C796BAB51B3514BE21AACE5383
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0CB652C796BAB51B3514BE21AACE5383
          • Size 194B
          • SHA256 b374f6f520b14e690878b770bb8af8d39eb20c2e861cb6843d27cd039aad8ad0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          4E3E4B05E877647EF3D7B912F256A94C
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4E3E4B05E877647EF3D7B912F256A94C
          • Size 192B
          • SHA256 bc9b4dc5d829dd469590e5e390cfe7c647df5927d035e23bbfe1ce4737c430af
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          57C8EDB95DF3F0AD4EE2DC2B8CFD4157
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
          • Size 342B
          • SHA256 bdac809b170290f2a666ec22e5d2675ecf9bd712314575e4829bb450d9df5db7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          BDE28772A83DB7274166C9CC07B6A827
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BDE28772A83DB7274166C9CC07B6A827
          • Size 192B
          • SHA256 849ce3e079442a5f1a0bec54a189d13d3ce0b8923c6ab92ef821111254cefae8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          BDE28772A83DB7274166C9CC07B6A827
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BDE28772A83DB7274166C9CC07B6A827
          • Size 192B
          • SHA256 2dba87d2b20103e2b88df3823570ad7ce96cc958d8e423ca6f0f66112ebb93bb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 3KB
          • SHA256 417c4cb2b29babf944e6c41ea1b362908782127c5894ef0fe3372abc855fbfd3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 e382d62eaa972059b99c6728a224ea0cd0bf0600e00cd8c19e075777cf697909
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 3f3f66e017a34c115662b5106b14c7dc88129db29b1cdc2f462ce02a9bc1fe95
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 4a6b330739c68024f37427b39b504d5cfb571c715a6b40aaa14e1dbc3c92c11c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 716edb857ea3bcada8edcfa239f8ca1097b53234a5c86214beab4a530c163737
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          loader_diag.log
          • Path C:\Users\Admin\AppData\Local\Ring-1\loader_diag.log
          • Size 1KB
          • SHA256 f63c9f49361f928317996d5c46b3c45b910cc14a0f3ac08c71154df97a750ca8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          loader_diag.log
          • Path C:\Users\Admin\AppData\Local\Ring-1\loader_diag.log
          • Size 400B
          • SHA256 fab9ea57375e787283d1437f52f30b9cde5be670b1baf5d490aada2ea2cee0c3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          AppxProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\AppxProvider.dll
          • Size 554KB
          • SHA256 913f97dd219eeb7d5f7534361037fe1ecc3a637eb48d67b1c8afa8b5f951ba2f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AssocProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\AssocProvider.dll
          • Size 112KB
          • SHA256 dc6a5930c2b9a11204d2e22a3e8d14c28e5bdac548548e256ba7ffa79bd8c907
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CbsProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\CbsProvider.dll
          • Size 875KB
          • SHA256 4c9a4ab6596626482dd2190034fcb3fafebe88a961423962ad577e873ef5008f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DismCore.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\DismCore.dll
          • Size 402KB
          • SHA256 af7f342adf5b533ea6978b68064f39bfb1e4ad3b572ae1b7f2287f5533334d4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DismCorePS.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\DismCorePS.dll
          • Size 183KB
          • SHA256 e3b3a4c9c6403cb8b0aa12d34915b67e4eaa5bb911e102cf77033aa315d66a1e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DismHost.exe
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\DismHost.exe
          • Size 142KB
          • SHA256 e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DmiProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\DmiProvider.dll
          • Size 415KB
          • SHA256 04f851b9d5e58ed002ad768bdcc475f22905fb1dab8341e9b3128df6eaa25b98
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FfuProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\FfuProvider.dll
          • Size 619KB
          • SHA256 56cc8d139be12e969fff3bbf47b1f5c62c3db887e3fb97c79cf7d285076f9271
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FolderProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\FolderProvider.dll
          • Size 59KB
          • SHA256 a235317ab7ed89e6530844a78b933d50f6f48ea5df481de158eb99dd8c4ba461
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GenericProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\GenericProvider.dll
          • Size 149KB
          • SHA256 d39f38402a9309ddd1cba67be470ede348f2bc1bab2f8d565e8f15510761087a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          IBSProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\IBSProvider.dll
          • Size 59KB
          • SHA256 5425382aaa32ffc133adb6458ff516db0e2ad60fac52dd595d53c370f4ba6fa0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ImagingProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\ImagingProvider.dll
          • Size 218KB
          • SHA256 874137ee906f91285b9a018735683a0dd21bdeaf2e340cbc54296551ccf8be2d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          IntlProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\IntlProvider.dll
          • Size 296KB
          • SHA256 1bb39f3389aa4258a923fa265afa2279688e6cdb14ff771f1621a56b03ddcf52
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LogProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\LogProvider.dll
          • Size 77KB
          • SHA256 a9c8787c79a952779eca82e7389cf5bbde7556e4491b8bfcfd6617740ac7d8a2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MsiProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\MsiProvider.dll
          • Size 207KB
          • SHA256 7ff3939e1ef015da8c9577af4edfdd46f0029a2cfe4e3dac574d3175516e095f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OSProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\OSProvider.dll
          • Size 149KB
          • SHA256 2165d567aa47264abe2a866bb1bcb01a1455a75a6ea530b1b9a4dda54d08f758
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OfflineSetupProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\OfflineSetupProvider.dll
          • Size 182KB
          • SHA256 b38d322af8e614cc54299effd2164247c75bd7e68e0eb1a428376fcedaca9a6f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProvProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\ProvProvider.dll
          • Size 753KB
          • SHA256 a3e652c0bbe2082f2e0290da73485fb2c6e35c33ac60daa51a65f8c782dbd7a7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SetupPlatformProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\SetupPlatformProvider.dll
          • Size 159KB
          • SHA256 367e73f97318b6663018a83a11019147e67b62ab83988730ebbda93984664dd3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SmiProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\SmiProvider.dll
          • Size 246KB
          • SHA256 ac1e7407317859981d253fd9d977e246a4d0da24572c45efe0ade1745376bffb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SysprepProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\SysprepProvider.dll
          • Size 778KB
          • SHA256 f9b4d0afe87f434e8319556961b292ddc7d3a8c6fc06b8a08a50b5a96e28a204
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          TransmogProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\TransmogProvider.dll
          • Size 1.3MB
          • SHA256 943ea79ccbbb9790723f411720777af386acc03efab709ac2cbfeb7bd040a3e4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UnattendProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\UnattendProvider.dll
          • Size 228KB
          • SHA256 05da5af89fafe492adf5255a7dbf16468be6d130ee8a9d713ab2182c72346db0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VhdProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\VhdProvider.dll
          • Size 560KB
          • SHA256 4ed23b46188dae12523f96a2755434c0574cd27584f9921133b0b4c1017b8a36
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WimProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\WimProvider.dll
          • Size 589KB
          • SHA256 8b7821a1fb9170c6aa1ec25eea378f43661812eba25064bb95999156b472c377
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dismprov.dll
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\dismprov.dll
          • Size 255KB
          • SHA256 ef1e263e1bcc05d9538cb9469dd7dba5093956aa325479c3d2607168cc1c000a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AppxProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\AppxProvider.dll.mui
          • Size 22KB
          • SHA256 8af0073f8a023f55866e48bf3b902dfa7f41c51b0e8b0fe06f8c496d41f9a7b3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AssocProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\AssocProvider.dll.mui
          • Size 8KB
          • SHA256 b18c6ce1558c9ef6942a3bce246a46557c2a7d12aec6c4a07e4fa84dd5c422f5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CbsProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\CbsProvider.dll.mui
          • Size 53KB
          • SHA256 d7a0253d6586e7bbfb0acb6facd9a326b32ba1642b458f5b5ed27feccb4fc199
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DismCore.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\DismCore.dll.mui
          • Size 7KB
          • SHA256 f91e3c35b472f95d7b1ae3dc83f9d6bfde33515aa29e8b310f55d9fe66466419
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DmiProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\DmiProvider.dll.mui
          • Size 17KB
          • SHA256 73709c25dc5300a435e53df97fc01a7dc184b56796cae48ee728d54d26076d6c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FfuProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\FfuProvider.dll.mui
          • Size 9KB
          • SHA256 ba6695148f96a5d45224324006ae29becfd2a6aa1de947e27371a4eb84e7451a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FolderProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\FolderProvider.dll.mui
          • Size 2KB
          • SHA256 c81a992ecebd9260ff34e41383aaca1c64a9fa4706a4744ac814f0f5daa1e105
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          GenericProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\GenericProvider.dll.mui
          • Size 5KB
          • SHA256 9102fa05ed98d902bf6e95b74fdbb745399d4ce4536a29607b2156a0edfeddf0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          IBSProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\IBSProvider.dll.mui
          • Size 2KB
          • SHA256 4ccfe7883bce7785b1387ad3872230159899a5337d30a2f81a937b74bcbc4ce5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ImagingProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\ImagingProvider.dll.mui
          • Size 18KB
          • SHA256 32d8c8fb9a746be209db5c3bdad14f361cf2bef8144c32e5af419c28efd35da3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          IntlProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\IntlProvider.dll.mui
          • Size 27KB
          • SHA256 aa43b64db4fdcd89e56ba5309f3ba2ffac2663ba30514e87c160687f4314221f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LogProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\LogProvider.dll.mui
          • Size 6KB
          • SHA256 6e51af7cfda6be5419f89d6705c44587556a4abffd388020d7f19e007e122cd6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MsiProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\MsiProvider.dll.mui
          • Size 15KB
          • SHA256 1ec7b04a8c25812db99abec82c7b7bf915ae3f7594c5d071231cafab9c1fa145
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OSProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\OSProvider.dll.mui
          • Size 3KB
          • SHA256 b6758aba17f6cd74923ca0976dd580222851ef6435cd16b3b2b04e85280ce706
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          OfflineSetupProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\OfflineSetupProvider.dll.mui
          • Size 2KB
          • SHA256 692744ce4bba1e82ad1a91ab97eec2bac7146bc995e8e8ed59bc2c7d366af7ec
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ProvProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\ProvProvider.dll.mui
          • Size 4KB
          • SHA256 50ad19e21b6425d12aa57cd4656748877db1f147189ec44abb19ba90be8505ea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SetupPlatformProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\SetupPlatformProvider.dll.mui
          • Size 5KB
          • SHA256 5d4dfc9bde18be1ec0b3834a65de6abab581e04c8c4f66ee14a62fb4b1b4cd06
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SmiProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\SmiProvider.dll.mui
          • Size 2KB
          • SHA256 a1a302e940f6d6718700737b787af7a2053ef68b5ea2ec61497e7ae2444c5835
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          SysprepProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\SysprepProvider.dll.mui
          • Size 3KB
          • SHA256 4389362a9dc662aa3c7a1d830498472bc586e00f0d269a8541975a34b03a1aa4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          TransmogProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\TransmogProvider.dll.mui
          • Size 16KB
          • SHA256 a75288f9e83cccf2a6a644ff78e6c26dadd5772a2626f80120b81975664e7dab
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UnattendProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\UnattendProvider.dll.mui
          • Size 5KB
          • SHA256 11f7957b8cc57dd7176f62b0612e658d6588b7caa8be4db3a337953b02b98c24
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VhdProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\VhdProvider.dll.mui
          • Size 7KB
          • SHA256 2ba085379434b3f9fcb0c70c2bd02a7f4f0170e6160578a583eb42c8d333fab7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WimProvider.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\WimProvider.dll.mui
          • Size 27KB
          • SHA256 a9eebcb85a0271061ac620ff9d2a6d22332721c782aeb06ab1ccf1149bff2aa4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dismprov.dll.mui
          • Path C:\Users\Admin\AppData\Local\Temp\A104D49B-9F04-418E-8D4C-7142B67E5A11\en-US\dismprov.dll.mui
          • Size 2KB
          • SHA256 cf8cc85cdd12cf4a02df5274f8d0cdc625c6409fe80866b3052b7d5a862ac311
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_ill5334n.yte.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ill5334n.yte.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dism.log
          • Path C:\Windows\Logs\DISM\dism.log
          • Size 2.1MB
          • SHA256 bcbb0463c0fc6355fb0dd2f2a6741d41824dc26217d8e0540c27c358d846ca98
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dism.log
          • Path C:\Windows\Logs\DISM\dism.log
          • Size 2.2MB
          • SHA256 d39a30372295ef92a2a28e158bbada51917dacf15a19963a9619c5ef873db225
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dism.log
          • Path C:\Windows\Logs\DISM\dism.log
          • Size 2.2MB
          • SHA256 d2a300f9a608e48c0a73736b5aa97201b12ec75fcefcc51663e452fa5acc1e82
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/228-145-0x000002C1D1740000-0x000002C1D1764000-memory.dmp
          Download

          memory/1872-113-0x00000285B1660000-0x00000285B1670000-memory.dmp
          Download

          memory/1872-106-0x00000285993A0000-0x00000285993C2000-memory.dmp
          Download

          memory/1872-104-0x00000285B1660000-0x00000285B1670000-memory.dmp
          Download

          memory/1872-103-0x00000285B1660000-0x00000285B1670000-memory.dmp
          Download

          memory/2868-126-0x0000021543B30000-0x0000021543B54000-memory.dmp
          Download

          memory/2868-125-0x0000021543B30000-0x0000021543B5A000-memory.dmp
          Download