Overview

overview

7

Static

static

3

2026-10-25...lc.exe

windows10-2004-x64

7

2026-10-25...lc.exe

windows11-ltsc_2024-x64

5

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/10/2026, 12:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-25_c94577d63d65aacd9e13bc490d8219b0_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
  • Size 11.0MB
  • Sample261026-pp2qeasx5m
  • SHA256 7dc09bd85e6921f50743fab8ed5f59b3799f7f12e076a0ee30dd82199d0b1359
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionransomwarespywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 10 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
    defense_evasion
  • Drops file in Windows directory 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 36 IoCs

    Using powershell.exe command.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 25 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-25_c94577d63d65aacd9e13bc490d8219b0_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-25_c94577d63d65aacd9e13bc490d8219b0_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Reads the TCP/IP host and domain name from the registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Users\Admin\AppData\Local\Temp\2026-10-25_c94577d63d65aacd9e13bc490d8219b0_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-25_c94577d63d65aacd9e13bc490d8219b0_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe" --security-observer=1364,1E4,1E8,1EC,1F4
      2⤵
        PID:1812
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1648
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$d=$env:SystemDrive.TrimEnd(':');$p=Get-Partition -DriveLetter $d -ErrorAction Stop|Select-Object -First 1;$disk=Get-Disk -Number $p.DiskNumber -ErrorAction Stop;Write-Output $disk.PartitionStyle"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1488
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3344
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3772
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2684
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$names=@('Microsoft-Hyper-V-All','VirtualMachinePlatform','HypervisorPlatform');$features=Get-WindowsOptionalFeature -Online;foreach($n in $names){$f=$features|Where-Object{$_.FeatureName -eq $n}|Select-Object -First 1;if($null -eq $f){Write-Output ($n + '=NotPresent')}else{Write-Output ($f.FeatureName + '=' + $f.State)}}"
        2⤵
        • Drops file in Windows directory
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3432
        • C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\dismhost.exe
          C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\dismhost.exe {568B2149-8291-436A-9CC8-1F60A1FA9777}
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:2560
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4852
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try{Enable-WindowsOptionalFeature -Online -FeatureName @('Microsoft-Hyper-V-All','VirtualMachinePlatform','HypervisorPlatform') -All -NoRestart -ErrorAction Stop|Out-Null;exit 0}catch{Write-Output ('ERROR:' + $_.Exception.Message);exit 1}"
        2⤵
        • Drops file in Windows directory
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4840
        • C:\Users\Admin\AppData\Local\Temp\2EB19E9F-B4AC-4263-8D0C-A35B7ABE0D77\dismhost.exe
          C:\Users\Admin\AppData\Local\Temp\2EB19E9F-B4AC-4263-8D0C-A35B7ABE0D77\dismhost.exe {652B241F-044F-44DB-9DAC-E4CB493DA11B}
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:4040
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5440
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1296
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1420
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3948
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2976
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5064
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2728
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:5576
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5540
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5528
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5600
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4476
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5264
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2528
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3928
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2992
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2932
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1920
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4348
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4212
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1212
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:516
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5528
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3288
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4164
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2684
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5604
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5112
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:4008
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      1⤵
        PID:3864

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            77EC63BDA74BD0D0E0426DC8F8008506
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
            • Size 330B
            • SHA256 b25c2def5989b3fc52ba8cbcfcb821438e586a2c8cea7185856593652ba9730b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            • Size 3KB
            • SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 48034bc4dc62498ef7b9583fe448d03e79b12c9ed102a837a86be5d4eb3a24cc
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 01b70cda643f37daf960cb135e15a0a6fcf01d7ceaf5b8a718051cbf9fdf9aa9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 787aebedb1159b0cf4c6116b977826621c2e860e5c604504565bd09ea5438cb2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 4a6b330739c68024f37427b39b504d5cfb571c715a6b40aaa14e1dbc3c92c11c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 17d61b3136f4fde3c23793ba39e866328991aada37ccae3f2b8c4ae34aa4f8c0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 28a80e58a2d7aa2e775d13d7dfdb7487e723fb0dbfb10be81a474cec499dcf38
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            AppxProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\AppxProvider.dll
            • Size 554KB
            • SHA256 913f97dd219eeb7d5f7534361037fe1ecc3a637eb48d67b1c8afa8b5f951ba2f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AssocProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\AssocProvider.dll
            • Size 112KB
            • SHA256 dc6a5930c2b9a11204d2e22a3e8d14c28e5bdac548548e256ba7ffa79bd8c907
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CbsProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\CbsProvider.dll
            • Size 875KB
            • SHA256 4c9a4ab6596626482dd2190034fcb3fafebe88a961423962ad577e873ef5008f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DismCore.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\DismCore.dll
            • Size 402KB
            • SHA256 af7f342adf5b533ea6978b68064f39bfb1e4ad3b572ae1b7f2287f5533334d4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DismCorePS.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\DismCorePS.dll
            • Size 183KB
            • SHA256 e3b3a4c9c6403cb8b0aa12d34915b67e4eaa5bb911e102cf77033aa315d66a1e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DismHost.exe
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\DismHost.exe
            • Size 142KB
            • SHA256 e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DmiProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\DmiProvider.dll
            • Size 415KB
            • SHA256 04f851b9d5e58ed002ad768bdcc475f22905fb1dab8341e9b3128df6eaa25b98
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FfuProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\FfuProvider.dll
            • Size 619KB
            • SHA256 56cc8d139be12e969fff3bbf47b1f5c62c3db887e3fb97c79cf7d285076f9271
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FolderProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\FolderProvider.dll
            • Size 59KB
            • SHA256 a235317ab7ed89e6530844a78b933d50f6f48ea5df481de158eb99dd8c4ba461
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GenericProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\GenericProvider.dll
            • Size 149KB
            • SHA256 d39f38402a9309ddd1cba67be470ede348f2bc1bab2f8d565e8f15510761087a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IBSProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\IBSProvider.dll
            • Size 59KB
            • SHA256 5425382aaa32ffc133adb6458ff516db0e2ad60fac52dd595d53c370f4ba6fa0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ImagingProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\ImagingProvider.dll
            • Size 218KB
            • SHA256 874137ee906f91285b9a018735683a0dd21bdeaf2e340cbc54296551ccf8be2d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntlProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\IntlProvider.dll
            • Size 296KB
            • SHA256 1bb39f3389aa4258a923fa265afa2279688e6cdb14ff771f1621a56b03ddcf52
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LogProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\LogProvider.dll
            • Size 77KB
            • SHA256 a9c8787c79a952779eca82e7389cf5bbde7556e4491b8bfcfd6617740ac7d8a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MsiProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\MsiProvider.dll
            • Size 207KB
            • SHA256 7ff3939e1ef015da8c9577af4edfdd46f0029a2cfe4e3dac574d3175516e095f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\OSProvider.dll
            • Size 149KB
            • SHA256 2165d567aa47264abe2a866bb1bcb01a1455a75a6ea530b1b9a4dda54d08f758
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OfflineSetupProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\OfflineSetupProvider.dll
            • Size 182KB
            • SHA256 b38d322af8e614cc54299effd2164247c75bd7e68e0eb1a428376fcedaca9a6f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ProvProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\ProvProvider.dll
            • Size 753KB
            • SHA256 a3e652c0bbe2082f2e0290da73485fb2c6e35c33ac60daa51a65f8c782dbd7a7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SetupPlatformProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\SetupPlatformProvider.dll
            • Size 159KB
            • SHA256 367e73f97318b6663018a83a11019147e67b62ab83988730ebbda93984664dd3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SmiProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\SmiProvider.dll
            • Size 246KB
            • SHA256 ac1e7407317859981d253fd9d977e246a4d0da24572c45efe0ade1745376bffb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SysprepProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\SysprepProvider.dll
            • Size 778KB
            • SHA256 f9b4d0afe87f434e8319556961b292ddc7d3a8c6fc06b8a08a50b5a96e28a204
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TransmogProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\TransmogProvider.dll
            • Size 1.3MB
            • SHA256 943ea79ccbbb9790723f411720777af386acc03efab709ac2cbfeb7bd040a3e4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UnattendProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\UnattendProvider.dll
            • Size 228KB
            • SHA256 05da5af89fafe492adf5255a7dbf16468be6d130ee8a9d713ab2182c72346db0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VhdProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\VhdProvider.dll
            • Size 560KB
            • SHA256 4ed23b46188dae12523f96a2755434c0574cd27584f9921133b0b4c1017b8a36
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WimProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\WimProvider.dll
            • Size 589KB
            • SHA256 8b7821a1fb9170c6aa1ec25eea378f43661812eba25064bb95999156b472c377
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dismprov.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\dismprov.dll
            • Size 255KB
            • SHA256 ef1e263e1bcc05d9538cb9469dd7dba5093956aa325479c3d2607168cc1c000a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppxProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\AppxProvider.dll.mui
            • Size 22KB
            • SHA256 8af0073f8a023f55866e48bf3b902dfa7f41c51b0e8b0fe06f8c496d41f9a7b3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AssocProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\AssocProvider.dll.mui
            • Size 8KB
            • SHA256 b18c6ce1558c9ef6942a3bce246a46557c2a7d12aec6c4a07e4fa84dd5c422f5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CbsProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\CbsProvider.dll.mui
            • Size 53KB
            • SHA256 d7a0253d6586e7bbfb0acb6facd9a326b32ba1642b458f5b5ed27feccb4fc199
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DismCore.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\DismCore.dll.mui
            • Size 7KB
            • SHA256 f91e3c35b472f95d7b1ae3dc83f9d6bfde33515aa29e8b310f55d9fe66466419
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DmiProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\DmiProvider.dll.mui
            • Size 17KB
            • SHA256 73709c25dc5300a435e53df97fc01a7dc184b56796cae48ee728d54d26076d6c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FfuProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\FfuProvider.dll.mui
            • Size 9KB
            • SHA256 ba6695148f96a5d45224324006ae29becfd2a6aa1de947e27371a4eb84e7451a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FolderProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\FolderProvider.dll.mui
            • Size 2KB
            • SHA256 c81a992ecebd9260ff34e41383aaca1c64a9fa4706a4744ac814f0f5daa1e105
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            GenericProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\GenericProvider.dll.mui
            • Size 5KB
            • SHA256 9102fa05ed98d902bf6e95b74fdbb745399d4ce4536a29607b2156a0edfeddf0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IBSProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\IBSProvider.dll.mui
            • Size 2KB
            • SHA256 4ccfe7883bce7785b1387ad3872230159899a5337d30a2f81a937b74bcbc4ce5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ImagingProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\ImagingProvider.dll.mui
            • Size 18KB
            • SHA256 32d8c8fb9a746be209db5c3bdad14f361cf2bef8144c32e5af419c28efd35da3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntlProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\IntlProvider.dll.mui
            • Size 27KB
            • SHA256 aa43b64db4fdcd89e56ba5309f3ba2ffac2663ba30514e87c160687f4314221f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LogProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\LogProvider.dll.mui
            • Size 6KB
            • SHA256 6e51af7cfda6be5419f89d6705c44587556a4abffd388020d7f19e007e122cd6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MsiProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\MsiProvider.dll.mui
            • Size 15KB
            • SHA256 1ec7b04a8c25812db99abec82c7b7bf915ae3f7594c5d071231cafab9c1fa145
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\OSProvider.dll.mui
            • Size 3KB
            • SHA256 b6758aba17f6cd74923ca0976dd580222851ef6435cd16b3b2b04e85280ce706
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            OfflineSetupProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\OfflineSetupProvider.dll.mui
            • Size 2KB
            • SHA256 692744ce4bba1e82ad1a91ab97eec2bac7146bc995e8e8ed59bc2c7d366af7ec
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ProvProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\ProvProvider.dll.mui
            • Size 4KB
            • SHA256 50ad19e21b6425d12aa57cd4656748877db1f147189ec44abb19ba90be8505ea
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SetupPlatformProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\SetupPlatformProvider.dll.mui
            • Size 5KB
            • SHA256 5d4dfc9bde18be1ec0b3834a65de6abab581e04c8c4f66ee14a62fb4b1b4cd06
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SmiProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\SmiProvider.dll.mui
            • Size 2KB
            • SHA256 a1a302e940f6d6718700737b787af7a2053ef68b5ea2ec61497e7ae2444c5835
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            SysprepProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\SysprepProvider.dll.mui
            • Size 3KB
            • SHA256 4389362a9dc662aa3c7a1d830498472bc586e00f0d269a8541975a34b03a1aa4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TransmogProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\TransmogProvider.dll.mui
            • Size 16KB
            • SHA256 a75288f9e83cccf2a6a644ff78e6c26dadd5772a2626f80120b81975664e7dab
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UnattendProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\UnattendProvider.dll.mui
            • Size 5KB
            • SHA256 11f7957b8cc57dd7176f62b0612e658d6588b7caa8be4db3a337953b02b98c24
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VhdProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\VhdProvider.dll.mui
            • Size 7KB
            • SHA256 2ba085379434b3f9fcb0c70c2bd02a7f4f0170e6160578a583eb42c8d333fab7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WimProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\WimProvider.dll.mui
            • Size 27KB
            • SHA256 a9eebcb85a0271061ac620ff9d2a6d22332721c782aeb06ab1ccf1149bff2aa4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dismprov.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AFF49A97-D96C-42A6-8BC0-0073519A2526\en-US\dismprov.dll.mui
            • Size 2KB
            • SHA256 cf8cc85cdd12cf4a02df5274f8d0cdc625c6409fe80866b3052b7d5a862ac311
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_55fsbg02.prr.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_55fsbg02.prr.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dism.log
            • Path C:\Windows\Logs\DISM\dism.log
            • Size 2.1MB
            • SHA256 a71663c71ea122d783aed59ab6a2ff586644d2ba43bf9b62bc0f97907c30ba33
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dism.log
            • Path C:\Windows\Logs\DISM\dism.log
            • Size 2.2MB
            • SHA256 71185619158acbcc909a92b503cad8d369bdf869b301fecfa5481d3425652072
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1648-42-0x000001F2F88A0000-0x000001F2F88CA000-memory.dmp
            Download

            memory/1648-43-0x000001F2F88A0000-0x000001F2F88C4000-memory.dmp
            Download

            memory/1648-32-0x000001F2F7E00000-0x000001F2F7E22000-memory.dmp
            Download

            memory/3432-82-0x000001F6AC230000-0x000001F6AC254000-memory.dmp
            Download