Overview

overview

10

Static

static

10

WinDebloat...UI.ps1

windows10-2004-x64

8

WinDebloat...UI.ps1

windows11-ltsc_2024-x64

4

WinDebloat...rt.ps1

windows10-2004-x64

8

WinDebloat...rt.ps1

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    56s
  • max time network
    65s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/10/2026, 23:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WinDebloater-main/Windows10DebloaterGUI.ps1
  • Size 85KB
  • Sample261027-3y8f7swt2r
  • SHA256 60eda38fe71bb13755d3e2457df4dffc83efec4258bfb9578b062ee53b274ab5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 41 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 10 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\WinDebloater-main\Windows10DebloaterGUI.ps1
    1⤵
    • Drops file in Windows directory
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4672
    • C:\Users\Admin\AppData\Local\Temp\64303339-28C8-4EC7-8BAE-C31026332FF2\dismhost.exe
      C:\Users\Admin\AppData\Local\Temp\64303339-28C8-4EC7-8BAE-C31026332FF2\dismhost.exe {28703081-C7F2-472E-AB58-FDAFB53109F5}
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:5812
    • C:\Windows\SysWOW64\OneDriveSetup.exe
      "C:\Windows\SysWOW64\OneDriveSetup.exe" /uninstall
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3292
      • C:\Windows\SysWOW64\OneDriveSetup.exe
        "C:\Windows\SysWOW64\OneDriveSetup.exe" C:\Windows\SysWOW64\OneDriveSetup.exe /uninstall /permachine /childprocess /silent /enableOMCTelemetry /enableExtractCabV2 /cusid:S-1-5-21-681733028-2344970462-962213935-1000
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4140
      • C:\Windows\SysWOW64\OneDriveSetup.exe
        C:\Windows\SysWOW64\OneDriveSetup.exe /uninstall /peruser /childprocess /enableOMCTelemetry /enableExtractCabV2
        3⤵
        • Modifies system executable filetype association
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5152
        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe
          "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe" /uninstall
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2640
    • C:\Windows\system32\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2724
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3492
    • C:\Windows\system32\Dism.exe
      "C:\Windows\system32\Dism.exe" /Online /Enable-Feature /FeatureName:NetFx3 /All
      2⤵
        PID:1620
        • C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\dismhost.exe
          C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\dismhost.exe {C1AD7FED-50A6-4E49-A02A-FE13201AEF01}
          3⤵
            PID:1464
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:1860
      • C:\Windows\system32\srtasks.exe
        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4064
      • C:\Windows\SysWOW64\DllHost.exe
        C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
        1⤵
        • System Location Discovery: System Language Discovery
        PID:4820
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3960
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:3652

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                PowerShell

                1
                T1059.001

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Active Setup

                1
                T1547.014

                Event Triggered Execution

                2
                T1546

                Change Default File Association

                1
                T1546.001

                Component Object Model Hijacking

                1
                T1546.015

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Active Setup

                1
                T1547.014

                Event Triggered Execution

                2
                T1546

                Change Default File Association

                1
                T1546.001

                Component Object Model Hijacking

                1
                T1546.015

                Defense Evasion

                Modify Registry

                2
                T1112

                Credential Access

                Discovery

                Peripheral Device Discovery

                2
                T1120

                Query Registry

                2
                T1012

                System Information Discovery

                2
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                refcount.ini
                • Path C:\ProgramData\Microsoft OneDrive\setup\refcount.ini
                • Size 25B
                • SHA256 1ab56b140cac14bdaa4c3c86ee43eee5c051bfd97e58f14603f917715ee9dd6a
                • MD5 SHA1 SHA512
                Submit Download

                E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                • Size 471B
                • SHA256 da9f856bb9692128c10055d69dc0087c6976d93a1529d8727c2fe9e30855319b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                • Size 412B
                • SHA256 83c1465100b964caf485d78aa2b379c24c3d849ed05fd60987e204f82173539b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Uninstall-2026-10-27.2356.3292.1.aodl
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2026-10-27.2356.3292.1.aodl
                • Size 5KB
                • SHA256 7f4d10a2cc1bda5a7ed663fd3e9c1eed5a2302ec31c73fa7009681589bcef7cd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Uninstall-2026-10-27.2356.3292.1.odl
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2026-10-27.2356.3292.1.odl
                • Size 10KB
                • SHA256 303e01982f15c1581f030b6ec5f6016c4a8581e93c46d7abbbd343e73ea4975e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Uninstall-PerMachine-2026-10-27.2356.4140.1.aodl
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2026-10-27.2356.4140.1.aodl
                • Size 4KB
                • SHA256 71f236b21d948bee17bdd301041851e5d74110064387d0a388304e349d6d205b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Uninstall-PerMachine-2026-10-27.2356.4140.1.odl
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2026-10-27.2356.4140.1.odl
                • Size 546B
                • SHA256 9fd26f63607082762a5afabd4035137851a04155c7f549c9482a9bf5e12f006d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Uninstall-PerMachine_2026-10-27_235655_102c-1028.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine_2026-10-27_235655_102c-1028.log
                • Size 24KB
                • SHA256 eab4a30eaae606e344f67f8096ad878444bd016f8f543fe8f90a43a4733887a8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Uninstall-PerUser-2026-10-27.2356.5152.1.aodl
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2026-10-27.2356.5152.1.aodl
                • Size 256B
                • SHA256 1fdb724f60681b65e338457e662892f8de8f8e2f2e885fbba59154fc2e228b3d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Uninstall-PerUser-2026-10-27.2356.5152.1.aodl
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2026-10-27.2356.5152.1.aodl
                • Size 4KB
                • SHA256 d3c6ce69ab5fb29e78d16b518ac85d443f82b0d23cbf4063bd8bd28608722dce
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Uninstall-PerUser-2026-10-27.2356.5152.1.odl
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2026-10-27.2356.5152.1.odl
                • Size 546B
                • SHA256 373933845cacf44b8e73fa283893d75cd27603af5c940aa99039e296049e7129
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Uninstall-PerUser_2026-10-27_235655_1420-f00.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser_2026-10-27_235655_1420-f00.log
                • Size 35KB
                • SHA256 e3649d02944fcc6760497e1749f7fe48d526972d5245f5a2b7e5e3f171479ec0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Uninstall_2026-10-27_235648_cdc-d68.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall_2026-10-27_235648_cdc-d68.log
                • Size 32KB
                • SHA256 e1d5b898f3067db15e14e3fc6ea2db6fd1090b69aafc82e04c43f52b2bcc95be
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                machineTelemetryCache.otc.session
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\machineTelemetryCache.otc.session
                • Size 20KB
                • SHA256 fdd8abbbea8ffbf93d2b6efe6c73f151d7f6928b2bd3919cb0188609cfb982ef
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                parentTelemetryCache.otc.session
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\parentTelemetryCache.otc.session
                • Size 20KB
                • SHA256 98fd1c0d650ce096d3892b36be12fbded57dedf15357efb3eb04801c4ca22186
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                userTelemetryCache.otc.session
                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc.session
                • Size 20KB
                • SHA256 0c3e89c655c19d0895d7d880456e2d298c1c730d111af88764bfd14ff7c45435
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                19.043.0304[2].json
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U1Q3VPCN\19.043.0304[2].json
                • Size 4KB
                • SHA256 343eda00dcf1e88f13a00ddd7f3da0d85691891bb83390ffc27f3f861b3d99d4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                0.0.filtertrie.intermediate.txt
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{470b3816-588c-4513-a414-05f355275a31}\0.0.filtertrie.intermediate.txt
                • Size 30KB
                • SHA256 63a7556902270dd091337222b0dbf0f6632297107d2cc14e27d1b9ab4a153697
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                0.1.filtertrie.intermediate.txt
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{470b3816-588c-4513-a414-05f355275a31}\0.1.filtertrie.intermediate.txt
                • Size 5B
                • SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
                • MD5 SHA1 SHA512
                Submit Download

                0.2.filtertrie.intermediate.txt
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{470b3816-588c-4513-a414-05f355275a31}\0.2.filtertrie.intermediate.txt
                • Size 5B
                • SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
                • MD5 SHA1 SHA512
                Submit Download

                Apps.ft
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{470b3816-588c-4513-a414-05f355275a31}\Apps.ft
                • Size 40KB
                • SHA256 305f0e1d486eecf8feeb8b761b9803ab69752f30e73d2dd28746b9809bf02034
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Apps.index
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{470b3816-588c-4513-a414-05f355275a31}\Apps.index
                • Size 1.0MB
                • SHA256 58515951ddf828e92888b35fe387e9c0d1fbd7d55da97d1b5bbf11b16411bb87
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppCache134376190480393336.txt.~tmp
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134376190480393336.txt.~tmp
                • Size 83KB
                • SHA256 089abbe196cfd133f30183fc6063ed9964ee08fefdd43a4e9ec5e0859c1f2163
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AssocProvider.dll
                • Path C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\AssocProvider.dll
                • Size 112KB
                • SHA256 dc6a5930c2b9a11204d2e22a3e8d14c28e5bdac548548e256ba7ffa79bd8c907
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CbsProvider.dll
                • Path C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\CbsProvider.dll
                • Size 875KB
                • SHA256 4c9a4ab6596626482dd2190034fcb3fafebe88a961423962ad577e873ef5008f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DismCore.dll
                • Path C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\DismCore.dll
                • Size 402KB
                • SHA256 af7f342adf5b533ea6978b68064f39bfb1e4ad3b572ae1b7f2287f5533334d4e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DmiProvider.dll
                • Path C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\DmiProvider.dll
                • Size 415KB
                • SHA256 04f851b9d5e58ed002ad768bdcc475f22905fb1dab8341e9b3128df6eaa25b98
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                FfuProvider.dll
                • Path C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\FfuProvider.dll
                • Size 619KB
                • SHA256 56cc8d139be12e969fff3bbf47b1f5c62c3db887e3fb97c79cf7d285076f9271
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                FolderProvider.dll
                • Path C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\FolderProvider.dll
                • Size 59KB
                • SHA256 a235317ab7ed89e6530844a78b933d50f6f48ea5df481de158eb99dd8c4ba461
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                GenericProvider.dll
                • Path C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\GenericProvider.dll
                • Size 149KB
                • SHA256 d39f38402a9309ddd1cba67be470ede348f2bc1bab2f8d565e8f15510761087a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IBSProvider.dll
                • Path C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\IBSProvider.dll
                • Size 59KB
                • SHA256 5425382aaa32ffc133adb6458ff516db0e2ad60fac52dd595d53c370f4ba6fa0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ImagingProvider.dll
                • Path C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\ImagingProvider.dll
                • Size 218KB
                • SHA256 874137ee906f91285b9a018735683a0dd21bdeaf2e340cbc54296551ccf8be2d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppxProvider.dll.mui
                • Path C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\en-US\AppxProvider.dll.mui
                • Size 22KB
                • SHA256 8af0073f8a023f55866e48bf3b902dfa7f41c51b0e8b0fe06f8c496d41f9a7b3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AssocProvider.dll.mui
                • Path C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\en-US\AssocProvider.dll.mui
                • Size 8KB
                • SHA256 b18c6ce1558c9ef6942a3bce246a46557c2a7d12aec6c4a07e4fa84dd5c422f5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CbsProvider.dll.mui
                • Path C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\en-US\CbsProvider.dll.mui
                • Size 53KB
                • SHA256 d7a0253d6586e7bbfb0acb6facd9a326b32ba1642b458f5b5ed27feccb4fc199
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DismCore.dll.mui
                • Path C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\en-US\DismCore.dll.mui
                • Size 7KB
                • SHA256 f91e3c35b472f95d7b1ae3dc83f9d6bfde33515aa29e8b310f55d9fe66466419
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DmiProvider.dll.mui
                • Path C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\en-US\DmiProvider.dll.mui
                • Size 17KB
                • SHA256 73709c25dc5300a435e53df97fc01a7dc184b56796cae48ee728d54d26076d6c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                FfuProvider.dll.mui
                • Path C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\en-US\FfuProvider.dll.mui
                • Size 9KB
                • SHA256 ba6695148f96a5d45224324006ae29becfd2a6aa1de947e27371a4eb84e7451a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                FolderProvider.dll.mui
                • Path C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\en-US\FolderProvider.dll.mui
                • Size 2KB
                • SHA256 c81a992ecebd9260ff34e41383aaca1c64a9fa4706a4744ac814f0f5daa1e105
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                GenericProvider.dll.mui
                • Path C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\en-US\GenericProvider.dll.mui
                • Size 5KB
                • SHA256 9102fa05ed98d902bf6e95b74fdbb745399d4ce4536a29607b2156a0edfeddf0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IBSProvider.dll.mui
                • Path C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\en-US\IBSProvider.dll.mui
                • Size 2KB
                • SHA256 4ccfe7883bce7785b1387ad3872230159899a5337d30a2f81a937b74bcbc4ce5
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ImagingProvider.dll.mui
                • Path C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\en-US\ImagingProvider.dll.mui
                • Size 18KB
                • SHA256 32d8c8fb9a746be209db5c3bdad14f361cf2bef8144c32e5af419c28efd35da3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dismprov.dll.mui
                • Path C:\Users\Admin\AppData\Local\Temp\31488076-4C7D-46BA-8C74-5D9ABEC4B01D\en-US\dismprov.dll.mui
                • Size 2KB
                • SHA256 cf8cc85cdd12cf4a02df5274f8d0cdc625c6409fe80866b3052b7d5a862ac311
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                AppxProvider.dll
                • Path C:\Users\Admin\AppData\Local\Temp\64303339-28C8-4EC7-8BAE-C31026332FF2\AppxProvider.dll
                • Size 554KB
                • SHA256 913f97dd219eeb7d5f7534361037fe1ecc3a637eb48d67b1c8afa8b5f951ba2f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DismCorePS.dll
                • Path C:\Users\Admin\AppData\Local\Temp\64303339-28C8-4EC7-8BAE-C31026332FF2\DismCorePS.dll
                • Size 183KB
                • SHA256 e3b3a4c9c6403cb8b0aa12d34915b67e4eaa5bb911e102cf77033aa315d66a1e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DismHost.exe
                • Path C:\Users\Admin\AppData\Local\Temp\64303339-28C8-4EC7-8BAE-C31026332FF2\DismHost.exe
                • Size 142KB
                • SHA256 e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                LogProvider.dll
                • Path C:\Users\Admin\AppData\Local\Temp\64303339-28C8-4EC7-8BAE-C31026332FF2\LogProvider.dll
                • Size 77KB
                • SHA256 a9c8787c79a952779eca82e7389cf5bbde7556e4491b8bfcfd6617740ac7d8a2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OSProvider.dll
                • Path C:\Users\Admin\AppData\Local\Temp\64303339-28C8-4EC7-8BAE-C31026332FF2\OSProvider.dll
                • Size 149KB
                • SHA256 2165d567aa47264abe2a866bb1bcb01a1455a75a6ea530b1b9a4dda54d08f758
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dismprov.dll
                • Path C:\Users\Admin\AppData\Local\Temp\64303339-28C8-4EC7-8BAE-C31026332FF2\dismprov.dll
                • Size 255KB
                • SHA256 ef1e263e1bcc05d9538cb9469dd7dba5093956aa325479c3d2607168cc1c000a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                __PSScriptPolicyTest_e0quslst.4ii.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e0quslst.4ii.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                aria-debug-4140.log
                • Path C:\Users\Admin\AppData\Local\Temp\aria-debug-4140.log
                • Size 470B
                • SHA256 a2061a3018865d0c8b540505bbb6395e0278dc13e0a349653d4506f8d5b98d3f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                aria-debug-5152.log
                • Path C:\Users\Admin\AppData\Local\Temp\aria-debug-5152.log
                • Size 470B
                • SHA256 9e84f3e646ed2e65aa7f6b55480cfc9d50469128165110a29a4ffcd4e827e77f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                tmpFEAE.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\tmpFEAE.tmp
                • Size 25.9MB
                • SHA256 6676ba3d4bf3e5418865922b8ea8bddb31660f299dd3da8955f3f37961334ecb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dism.log
                • Path C:\Windows\Logs\DISM\dism.log
                • Size 2.1MB
                • SHA256 8af03d5f4025db837426bf9674396c3068505bfbf06960ade409d1ae62ed81c0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dism.log
                • Path C:\Windows\Logs\DISM\dism.log
                • Size 2.1MB
                • SHA256 b6be69a8e7e0b63e85f7c84cb5bc103b0e753b581d8c65161fe125f060f5d2e7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dism.log
                • Path C:\Windows\Logs\DISM\dism.log
                • Size 2.1MB
                • SHA256 385deb55fbaef5bbe99a827e9c0c8e69b18ff0ab322e71fb489dfe50c1708f1f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dism.log
                • Path C:\Windows\Logs\DISM\dism.log
                • Size 2.1MB
                • SHA256 ae895d016dc66214232e05d800f53dd04e3405594ea9c70f2d8a01e57c30ed33
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/3492-314-0x0000000004480000-0x0000000004481000-memory.dmp
                Download

                memory/3652-320-0x00000157ADD60000-0x00000157ADD80000-memory.dmp
                Download

                memory/3652-315-0x00000157ACB00000-0x00000157ACC00000-memory.dmp
                Download

                memory/3652-349-0x00000157AE120000-0x00000157AE140000-memory.dmp
                Download

                memory/3652-334-0x00000157ADD20000-0x00000157ADD40000-memory.dmp
                Download

                memory/4672-207-0x0000018DFF820000-0x0000018DFF830000-memory.dmp
                Download

                memory/4672-13-0x0000018D829E0000-0x0000018D82A04000-memory.dmp
                Download

                memory/4672-431-0x0000018D824D0000-0x0000018D8261E000-memory.dmp
                Download

                memory/4672-204-0x0000018DFF820000-0x0000018DFF830000-memory.dmp
                Download

                memory/4672-206-0x0000018D824D0000-0x0000018D8261E000-memory.dmp
                Download

                memory/4672-203-0x0000018DFF820000-0x0000018DFF830000-memory.dmp
                Download

                memory/4672-1-0x0000018DFF820000-0x0000018DFF830000-memory.dmp
                Download

                memory/4672-210-0x0000018D824D0000-0x0000018D8261E000-memory.dmp
                Download

                memory/4672-12-0x0000018DFF680000-0x0000018DFF6A6000-memory.dmp
                Download

                memory/4672-11-0x0000018DE5930000-0x0000018DE593A000-memory.dmp
                Download

                memory/4672-10-0x0000018DE5950000-0x0000018DE5966000-memory.dmp
                Download

                memory/4672-9-0x0000018DFF630000-0x0000018DFF652000-memory.dmp
                Download

                memory/4672-205-0x0000018DFF820000-0x0000018DFF830000-memory.dmp
                Download

                memory/4672-0-0x0000018DFF820000-0x0000018DFF830000-memory.dmp
                Download

                memory/4672-704-0x0000018D824D0000-0x0000018D8261E000-memory.dmp
                Download