Overview

overview

7

Static

static

3

2026-10-23...lc.exe

windows10-2004-x64

7

2026-10-23...lc.exe

windows11-ltsc_2024-x64

5

Analysis

  • max time kernel
    149s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/10/2026, 09:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-23_97f8586a3116bcb750515f69151c645b_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
  • Size 10.8MB
  • Sample261023-lfnkmsxtdv
  • SHA256 92195e0f7e57b183dfaae1acbb9f290d0e442439bec34c8e9d20f531b5b43fbf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionransomware

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 10 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
    defense_evasion
  • Drops file in Windows directory 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 36 IoCs

    Using powershell.exe command.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-23_97f8586a3116bcb750515f69151c645b_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-23_97f8586a3116bcb750515f69151c645b_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3756
    • C:\Users\Admin\AppData\Local\Temp\2026-10-23_97f8586a3116bcb750515f69151c645b_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-23_97f8586a3116bcb750515f69151c645b_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe" --security-observer=EAC,1D0,1D4,1DC
      2⤵
        PID:4584
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4492
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:404
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$d=$env:SystemDrive.TrimEnd(':');$p=Get-Partition -DriveLetter $d -ErrorAction Stop|Select-Object -First 1;$disk=Get-Disk -Number $p.DiskNumber -ErrorAction Stop;Write-Output $disk.PartitionStyle"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:212
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1648
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2052
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4372
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$names=@('Microsoft-Hyper-V-All','VirtualMachinePlatform','HypervisorPlatform');$features=Get-WindowsOptionalFeature -Online;foreach($n in $names){$f=$features|Where-Object{$_.FeatureName -eq $n}|Select-Object -First 1;if($null -eq $f){Write-Output ($n + '=NotPresent')}else{Write-Output ($f.FeatureName + '=' + $f.State)}}"
        2⤵
        • Drops file in Windows directory
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2752
        • C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\dismhost.exe
          C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\dismhost.exe {2C3CA571-8B65-4641-AD58-541A874DF2FB}
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:4844
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2280
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:880
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try{Enable-WindowsOptionalFeature -Online -FeatureName @('Microsoft-Hyper-V-All','VirtualMachinePlatform','HypervisorPlatform') -All -NoRestart -ErrorAction Stop|Out-Null;exit 0}catch{Write-Output ('ERROR:' + $_.Exception.Message);exit 1}"
        2⤵
        • Drops file in Windows directory
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3888
        • C:\Users\Admin\AppData\Local\Temp\2BD2DB72-DC4A-4E00-99EB-1C9F08A01EF5\dismhost.exe
          C:\Users\Admin\AppData\Local\Temp\2BD2DB72-DC4A-4E00-99EB-1C9F08A01EF5\dismhost.exe {34E47FA2-E9BA-4349-918F-7DD6F5FC29F1}
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:1004
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2776
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4464
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1000
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1728
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1988
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3200
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4116
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2736
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:64
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1228
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5084
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4688
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:176
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2656
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3496
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1044
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:936
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4856
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4628
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2544
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3944
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:224
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4776
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1924
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3024
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1196
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:1768
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      1⤵
        PID:4660

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            • Size 3KB
            • SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 6471a6f8e3bb52bf99246765009f4193c4c89bf6f47969c7eb6fff1a1bf2372f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 787aebedb1159b0cf4c6116b977826621c2e860e5c604504565bd09ea5438cb2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 f871af8dc0cddc0ff7035ffe6b5c351b64a04ec765e8835422bdc8b178940bc7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 192B
            • SHA256 ca6c8f7f4a63e6d84618ce2ef97db2f2bd4225ac0dc74a88cbce6e51b3565a1a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 17d61b3136f4fde3c23793ba39e866328991aada37ccae3f2b8c4ae34aa4f8c0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 48034bc4dc62498ef7b9583fe448d03e79b12c9ed102a837a86be5d4eb3a24cc
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 eb7153b04811fea3917af0181842c7a6906bec931d3866bbfc98785c0469bacf
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 28a80e58a2d7aa2e775d13d7dfdb7487e723fb0dbfb10be81a474cec499dcf38
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            AppxProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\AppxProvider.dll
            • Size 554KB
            • SHA256 913f97dd219eeb7d5f7534361037fe1ecc3a637eb48d67b1c8afa8b5f951ba2f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AssocProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\AssocProvider.dll
            • Size 112KB
            • SHA256 dc6a5930c2b9a11204d2e22a3e8d14c28e5bdac548548e256ba7ffa79bd8c907
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CbsProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\CbsProvider.dll
            • Size 875KB
            • SHA256 4c9a4ab6596626482dd2190034fcb3fafebe88a961423962ad577e873ef5008f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DismCore.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\DismCore.dll
            • Size 402KB
            • SHA256 af7f342adf5b533ea6978b68064f39bfb1e4ad3b572ae1b7f2287f5533334d4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DismCorePS.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\DismCorePS.dll
            • Size 183KB
            • SHA256 e3b3a4c9c6403cb8b0aa12d34915b67e4eaa5bb911e102cf77033aa315d66a1e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DismHost.exe
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\DismHost.exe
            • Size 142KB
            • SHA256 e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DmiProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\DmiProvider.dll
            • Size 415KB
            • SHA256 04f851b9d5e58ed002ad768bdcc475f22905fb1dab8341e9b3128df6eaa25b98
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FfuProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\FfuProvider.dll
            • Size 619KB
            • SHA256 56cc8d139be12e969fff3bbf47b1f5c62c3db887e3fb97c79cf7d285076f9271
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FolderProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\FolderProvider.dll
            • Size 59KB
            • SHA256 a235317ab7ed89e6530844a78b933d50f6f48ea5df481de158eb99dd8c4ba461
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GenericProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\GenericProvider.dll
            • Size 149KB
            • SHA256 d39f38402a9309ddd1cba67be470ede348f2bc1bab2f8d565e8f15510761087a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IBSProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\IBSProvider.dll
            • Size 59KB
            • SHA256 5425382aaa32ffc133adb6458ff516db0e2ad60fac52dd595d53c370f4ba6fa0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ImagingProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\ImagingProvider.dll
            • Size 218KB
            • SHA256 874137ee906f91285b9a018735683a0dd21bdeaf2e340cbc54296551ccf8be2d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntlProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\IntlProvider.dll
            • Size 296KB
            • SHA256 1bb39f3389aa4258a923fa265afa2279688e6cdb14ff771f1621a56b03ddcf52
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LogProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\LogProvider.dll
            • Size 77KB
            • SHA256 a9c8787c79a952779eca82e7389cf5bbde7556e4491b8bfcfd6617740ac7d8a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MsiProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\MsiProvider.dll
            • Size 207KB
            • SHA256 7ff3939e1ef015da8c9577af4edfdd46f0029a2cfe4e3dac574d3175516e095f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\OSProvider.dll
            • Size 149KB
            • SHA256 2165d567aa47264abe2a866bb1bcb01a1455a75a6ea530b1b9a4dda54d08f758
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OfflineSetupProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\OfflineSetupProvider.dll
            • Size 182KB
            • SHA256 b38d322af8e614cc54299effd2164247c75bd7e68e0eb1a428376fcedaca9a6f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ProvProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\ProvProvider.dll
            • Size 753KB
            • SHA256 a3e652c0bbe2082f2e0290da73485fb2c6e35c33ac60daa51a65f8c782dbd7a7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SetupPlatformProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\SetupPlatformProvider.dll
            • Size 159KB
            • SHA256 367e73f97318b6663018a83a11019147e67b62ab83988730ebbda93984664dd3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SmiProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\SmiProvider.dll
            • Size 246KB
            • SHA256 ac1e7407317859981d253fd9d977e246a4d0da24572c45efe0ade1745376bffb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SysprepProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\SysprepProvider.dll
            • Size 778KB
            • SHA256 f9b4d0afe87f434e8319556961b292ddc7d3a8c6fc06b8a08a50b5a96e28a204
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TransmogProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\TransmogProvider.dll
            • Size 1.3MB
            • SHA256 943ea79ccbbb9790723f411720777af386acc03efab709ac2cbfeb7bd040a3e4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UnattendProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\UnattendProvider.dll
            • Size 228KB
            • SHA256 05da5af89fafe492adf5255a7dbf16468be6d130ee8a9d713ab2182c72346db0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VhdProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\VhdProvider.dll
            • Size 560KB
            • SHA256 4ed23b46188dae12523f96a2755434c0574cd27584f9921133b0b4c1017b8a36
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WimProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\WimProvider.dll
            • Size 589KB
            • SHA256 8b7821a1fb9170c6aa1ec25eea378f43661812eba25064bb95999156b472c377
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dismprov.dll
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\dismprov.dll
            • Size 255KB
            • SHA256 ef1e263e1bcc05d9538cb9469dd7dba5093956aa325479c3d2607168cc1c000a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppxProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\AppxProvider.dll.mui
            • Size 22KB
            • SHA256 8af0073f8a023f55866e48bf3b902dfa7f41c51b0e8b0fe06f8c496d41f9a7b3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AssocProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\AssocProvider.dll.mui
            • Size 8KB
            • SHA256 b18c6ce1558c9ef6942a3bce246a46557c2a7d12aec6c4a07e4fa84dd5c422f5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CbsProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\CbsProvider.dll.mui
            • Size 53KB
            • SHA256 d7a0253d6586e7bbfb0acb6facd9a326b32ba1642b458f5b5ed27feccb4fc199
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DismCore.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\DismCore.dll.mui
            • Size 7KB
            • SHA256 f91e3c35b472f95d7b1ae3dc83f9d6bfde33515aa29e8b310f55d9fe66466419
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DmiProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\DmiProvider.dll.mui
            • Size 17KB
            • SHA256 73709c25dc5300a435e53df97fc01a7dc184b56796cae48ee728d54d26076d6c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FfuProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\FfuProvider.dll.mui
            • Size 9KB
            • SHA256 ba6695148f96a5d45224324006ae29becfd2a6aa1de947e27371a4eb84e7451a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FolderProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\FolderProvider.dll.mui
            • Size 2KB
            • SHA256 c81a992ecebd9260ff34e41383aaca1c64a9fa4706a4744ac814f0f5daa1e105
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            GenericProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\GenericProvider.dll.mui
            • Size 5KB
            • SHA256 9102fa05ed98d902bf6e95b74fdbb745399d4ce4536a29607b2156a0edfeddf0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IBSProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\IBSProvider.dll.mui
            • Size 2KB
            • SHA256 4ccfe7883bce7785b1387ad3872230159899a5337d30a2f81a937b74bcbc4ce5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ImagingProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\ImagingProvider.dll.mui
            • Size 18KB
            • SHA256 32d8c8fb9a746be209db5c3bdad14f361cf2bef8144c32e5af419c28efd35da3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntlProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\IntlProvider.dll.mui
            • Size 27KB
            • SHA256 aa43b64db4fdcd89e56ba5309f3ba2ffac2663ba30514e87c160687f4314221f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LogProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\LogProvider.dll.mui
            • Size 6KB
            • SHA256 6e51af7cfda6be5419f89d6705c44587556a4abffd388020d7f19e007e122cd6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MsiProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\MsiProvider.dll.mui
            • Size 15KB
            • SHA256 1ec7b04a8c25812db99abec82c7b7bf915ae3f7594c5d071231cafab9c1fa145
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\OSProvider.dll.mui
            • Size 3KB
            • SHA256 b6758aba17f6cd74923ca0976dd580222851ef6435cd16b3b2b04e85280ce706
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OfflineSetupProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\OfflineSetupProvider.dll.mui
            • Size 2KB
            • SHA256 692744ce4bba1e82ad1a91ab97eec2bac7146bc995e8e8ed59bc2c7d366af7ec
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ProvProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\ProvProvider.dll.mui
            • Size 4KB
            • SHA256 50ad19e21b6425d12aa57cd4656748877db1f147189ec44abb19ba90be8505ea
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SetupPlatformProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\SetupPlatformProvider.dll.mui
            • Size 5KB
            • SHA256 5d4dfc9bde18be1ec0b3834a65de6abab581e04c8c4f66ee14a62fb4b1b4cd06
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SmiProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\SmiProvider.dll.mui
            • Size 2KB
            • SHA256 a1a302e940f6d6718700737b787af7a2053ef68b5ea2ec61497e7ae2444c5835
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            SysprepProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\SysprepProvider.dll.mui
            • Size 3KB
            • SHA256 4389362a9dc662aa3c7a1d830498472bc586e00f0d269a8541975a34b03a1aa4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TransmogProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\TransmogProvider.dll.mui
            • Size 16KB
            • SHA256 a75288f9e83cccf2a6a644ff78e6c26dadd5772a2626f80120b81975664e7dab
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UnattendProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\UnattendProvider.dll.mui
            • Size 5KB
            • SHA256 11f7957b8cc57dd7176f62b0612e658d6588b7caa8be4db3a337953b02b98c24
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VhdProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\VhdProvider.dll.mui
            • Size 7KB
            • SHA256 2ba085379434b3f9fcb0c70c2bd02a7f4f0170e6160578a583eb42c8d333fab7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WimProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\WimProvider.dll.mui
            • Size 27KB
            • SHA256 a9eebcb85a0271061ac620ff9d2a6d22332721c782aeb06ab1ccf1149bff2aa4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dismprov.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\7EA41021-C583-47FE-B7FE-203DB4A6C1F7\en-US\dismprov.dll.mui
            • Size 2KB
            • SHA256 cf8cc85cdd12cf4a02df5274f8d0cdc625c6409fe80866b3052b7d5a862ac311
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_zpwyex4f.p4n.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zpwyex4f.p4n.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dism.log
            • Path C:\Windows\Logs\DISM\dism.log
            • Size 2.1MB
            • SHA256 b77b487367d54fab038cc29ae59c5cf9449c328d20457c4a0e5ab7fff4409bc9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/2752-73-0x00000259C4DF0000-0x00000259C4E14000-memory.dmp
            Download

            memory/4492-6-0x000001F369030000-0x000001F369052000-memory.dmp
            Download

            memory/4492-9-0x000001F36B770000-0x000001F36B794000-memory.dmp
            Download

            memory/4492-8-0x000001F36B770000-0x000001F36B79A000-memory.dmp
            Download