Overview

overview

10

Static

static

10

WinDebloat...UI.ps1

windows10-2004-x64

8

WinDebloat...UI.ps1

windows11-ltsc_2024-x64

4

WinDebloat...rt.ps1

windows10-2004-x64

8

WinDebloat...rt.ps1

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/10/2026, 23:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WinDebloater-main/start.ps1
  • Size 6KB
  • Sample261027-3y8f7swt2r
  • SHA256 093f4b83dfc6a7fef1075a36e3b1c4037c07f78e09d821ee0ccf97fb764817f0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 43 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\WinDebloater-main\start.ps1
    1⤵
    • Badlisted process makes network request
    • Drops file in Windows directory
    • Command and Scripting Interpreter: PowerShell
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Users\Admin\AppData\Local\Temp\F2D5EB49-C591-4489-8348-5792889E74FE\dismhost.exe
      C:\Users\Admin\AppData\Local\Temp\F2D5EB49-C591-4489-8348-5792889E74FE\dismhost.exe {293DDCE7-A8D8-43E1-83C5-86392EE99311}
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:4520
    • C:\Windows\SysWOW64\OneDriveSetup.exe
      "C:\Windows\SysWOW64\OneDriveSetup.exe" /uninstall
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4736
      • C:\Windows\SysWOW64\OneDriveSetup.exe
        "C:\Windows\SysWOW64\OneDriveSetup.exe" C:\Windows\SysWOW64\OneDriveSetup.exe /uninstall /permachine /childprocess /silent /enableOMCTelemetry /enableExtractCabV2 /cusid:S-1-5-21-240542094-4193773837-3211495583-1000
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3748
      • C:\Windows\SysWOW64\OneDriveSetup.exe
        C:\Windows\SysWOW64\OneDriveSetup.exe /uninstall /peruser /childprocess /enableOMCTelemetry /enableExtractCabV2
        3⤵
        • Modifies system executable filetype association
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4524
        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe
          "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe" /uninstall
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:3008
    • C:\Windows\system32\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4420
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:176
    • C:\Windows\system32\Dism.exe
      "C:\Windows\system32\Dism.exe" /Online /Enable-Feature /FeatureName:NetFx3 /All
      2⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4704
      • C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\dismhost.exe
        C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\dismhost.exe {4425E7DC-45E4-4B29-8456-CC7DE63B9EE6}
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:3948
    • C:\Windows\SysWOW64\OneDriveSetup.exe
      "C:\Windows\SysWOW64\OneDriveSetup.exe" /uninstall
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2192
      • C:\Windows\SysWOW64\OneDriveSetup.exe
        "C:\Windows\SysWOW64\OneDriveSetup.exe" C:\Windows\SysWOW64\OneDriveSetup.exe /uninstall /permachine /childprocess /silent /enableOMCTelemetry /enableExtractCabV2 /cusid:S-1-5-21-240542094-4193773837-3211495583-1000
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3428
      • C:\Windows\SysWOW64\OneDriveSetup.exe
        C:\Windows\SysWOW64\OneDriveSetup.exe /uninstall /peruser /childprocess /enableOMCTelemetry /enableExtractCabV2
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4252
    • C:\Windows\system32\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM explorer.exe
      2⤵
      • Kills process with taskkill
      PID:4472
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1048
    • C:\Windows\system32\Dism.exe
      "C:\Windows\system32\Dism.exe" /Online /Enable-Feature /FeatureName:NetFx3 /All
      2⤵
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\Users\Admin\AppData\Local\Temp\F3261BBC-AF4F-4BDE-8679-5B004EA2FE02\dismhost.exe
        C:\Users\Admin\AppData\Local\Temp\F3261BBC-AF4F-4BDE-8679-5B004EA2FE02\dismhost.exe {A6287A88-D905-4478-AAFA-D68FAC305E6F}
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:4932
    • C:\Windows\SysWOW64\OneDriveSetup.exe
      "C:\Windows\SysWOW64\OneDriveSetup.exe" /uninstall
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1608
      • C:\Windows\SysWOW64\OneDriveSetup.exe
        "C:\Windows\SysWOW64\OneDriveSetup.exe" C:\Windows\SysWOW64\OneDriveSetup.exe /uninstall /permachine /childprocess /silent /enableOMCTelemetry /enableExtractCabV2 /cusid:S-1-5-21-240542094-4193773837-3211495583-1000
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4996
      • C:\Windows\SysWOW64\OneDriveSetup.exe
        C:\Windows\SysWOW64\OneDriveSetup.exe /uninstall /peruser /childprocess /enableOMCTelemetry /enableExtractCabV2
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4796
    • C:\Windows\system32\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM explorer.exe
      2⤵
      • Kills process with taskkill
      PID:1164
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      PID:3564
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2960
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2940
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1832
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4632
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1508
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1772
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2964
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:2528
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:552

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            PowerShell

            1
            T1059.001

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Active Setup

            1
            T1547.014

            Event Triggered Execution

            2
            T1546

            Change Default File Association

            1
            T1546.001

            Component Object Model Hijacking

            1
            T1546.015

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Active Setup

            1
            T1547.014

            Event Triggered Execution

            2
            T1546

            Change Default File Association

            1
            T1546.001

            Component Object Model Hijacking

            1
            T1546.015

            Defense Evasion

            Modify Registry

            2
            T1112

            Credential Access

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            3
            T1012

            System Information Discovery

            2
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Command and Control

            Web Service

            1
            T1102

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            refcount.ini
            • Path C:\ProgramData\Microsoft OneDrive\setup\refcount.ini
            • Size 25B
            • SHA256 1ab56b140cac14bdaa4c3c86ee43eee5c051bfd97e58f14603f917715ee9dd6a
            • MD5 SHA1 SHA512
            Submit Download

            E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
            • Size 471B
            • SHA256 da9f856bb9692128c10055d69dc0087c6976d93a1529d8727c2fe9e30855319b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
            • Size 412B
            • SHA256 ea5527150820e23d34c6fee917d03271d57050505e862383135a487abf4d1a21
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Uninstall-2026-10-27.2356.4736.1.aodl
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2026-10-27.2356.4736.1.aodl
            • Size 5KB
            • SHA256 44d471169e26af0085db59c82d130fc4310ba8d8c6a735a3db77b4d1eefb227e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall-2026-10-27.2356.4736.1.odl
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2026-10-27.2356.4736.1.odl
            • Size 10KB
            • SHA256 bd2560cb4d68081dcaea45e3b7487ff8c12756cf5525671588c558ed4b404f82
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall-PerMachine-2026-10-27.2356.3748.1.aodl
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2026-10-27.2356.3748.1.aodl
            • Size 4KB
            • SHA256 39063148e87b46733336f33f8642c9777ba3a4b604a6bbd2e538f78c0ee60345
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall-PerMachine-2026-10-27.2356.3748.1.odl
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2026-10-27.2356.3748.1.odl
            • Size 546B
            • SHA256 75668ab14259854f599e7452e15c2e3bb25185a803c393cacd3fe4de9ec11b65
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Uninstall-PerMachine-2026-10-27.2357.3428.1.odl
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2026-10-27.2357.3428.1.odl
            • Size 546B
            • SHA256 eaaaf6dd9c4a478786c787c8899750f2c6fce183c4683a13d51aac4177c459be
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Uninstall-PerMachine-2026-10-27.2358.4996.1.odl
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2026-10-27.2358.4996.1.odl
            • Size 546B
            • SHA256 ce689cbfc49b2aecdafac9cc9b19bdcda673c9ba06409079dd711217070446e6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Uninstall-PerMachine_2026-10-27_235654_ea4-624.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine_2026-10-27_235654_ea4-624.log
            • Size 24KB
            • SHA256 ceaffd2aa0ecb5bf21bcaca9e4d196df33ba2236c03c941c29d784d5b59c7437
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall-PerUser-2026-10-27.2356.4524.1.aodl
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2026-10-27.2356.4524.1.aodl
            • Size 256B
            • SHA256 1fdb724f60681b65e338457e662892f8de8f8e2f2e885fbba59154fc2e228b3d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Uninstall-PerUser-2026-10-27.2356.4524.1.aodl
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2026-10-27.2356.4524.1.aodl
            • Size 4KB
            • SHA256 b6518872766d7d34cc67dbd02d1919ab9bb461a442b71cc0c201d5bf38036a47
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall-PerUser-2026-10-27.2356.4524.1.odl
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2026-10-27.2356.4524.1.odl
            • Size 546B
            • SHA256 0adf59589bd8730fff77ea1c517e73b69e32d624de35e101cc5e99c155725fc7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Uninstall-PerUser-2026-10-27.2357.4252.1.odl
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2026-10-27.2357.4252.1.odl
            • Size 546B
            • SHA256 a8b0fbd9e971b0f89334e0adf9714fd2a93e4f80fdc73d449a2260315a4e4357
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Uninstall-PerUser-2026-10-27.2358.4796.1.odl
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2026-10-27.2358.4796.1.odl
            • Size 546B
            • SHA256 93241d0c69d155b374cca2315d6aa5ad8b316a23604ce2b6dddddb8d177b3afc
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Uninstall-PerUser_2026-10-27_235655_11ac-f28.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser_2026-10-27_235655_11ac-f28.log
            • Size 35KB
            • SHA256 46a52784eff89b210ecac7161e883ce132e4173d8c2b483af2a39574b425614b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall_2026-10-27_235648_1280-198.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall_2026-10-27_235648_1280-198.log
            • Size 32KB
            • SHA256 cb3514a71f7a292232cd64f95a974d8aabb322bb816620502a92e323035d1f21
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            machineTelemetryCache.otc.session
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\machineTelemetryCache.otc.session
            • Size 20KB
            • SHA256 6db33c6ba434fa36bf4cf958586ffe08fba1e8e451f34d7631755637b11b2f6e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            parentTelemetryCache.otc.session
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\parentTelemetryCache.otc.session
            • Size 4KB
            • SHA256 b97f7f7cab88d2ffe7a7003c632cbea354782de6c21bb75f80cbe6043e087ae8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            parentTelemetryCache.otc.session
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\parentTelemetryCache.otc.session
            • Size 20KB
            • SHA256 64c774348c077c234b2464770bb07928ec4ca0da1ecee6b3fad7c87e9f72a7ab
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            parentTelemetryCache.otc.session
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\parentTelemetryCache.otc.session
            • Size 20KB
            • SHA256 53b01d2f170ffbb7afec3518f2ef2ebd6c39b5b520a6d2548b219d518eeb390d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            userTelemetryCache.otc.session
            • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc.session
            • Size 20KB
            • SHA256 ac1fec83dca390b3ccc3e03828adcc711e1afd1f2880f2d9dad3772ddeff5927
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            19.043.0304[1].json
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9GMOGYPF\19.043.0304[1].json
            • Size 4KB
            • SHA256 46dc4824f9b0b66f1dbe78f738172921df38ec01af57002ce6be1a59b26f1dd7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            microsoft.windows[1].xml
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5IOFEKC1\microsoft.windows[1].xml
            • Size 97B
            • SHA256 ddfe9eaeeb2223aeb285e912b717118bf75e92b35bfb5b8a38a28b7d80d79ed7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            0.0.filtertrie.intermediate.txt
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{22b699a6-4323-44ff-8597-4711ab913fd6}\0.0.filtertrie.intermediate.txt
            • Size 29KB
            • SHA256 b9c676a3db1af36d86006e94ff6c9d829c479bf21139f0d82e0c7979469771b8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            0.1.filtertrie.intermediate.txt
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{22b699a6-4323-44ff-8597-4711ab913fd6}\0.1.filtertrie.intermediate.txt
            • Size 5B
            • SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
            • MD5 SHA1 SHA512
            Submit Download

            0.2.filtertrie.intermediate.txt
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{22b699a6-4323-44ff-8597-4711ab913fd6}\0.2.filtertrie.intermediate.txt
            • Size 5B
            • SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
            • MD5 SHA1 SHA512
            Submit Download

            Apps.ft
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{22b699a6-4323-44ff-8597-4711ab913fd6}\Apps.ft
            • Size 39KB
            • SHA256 5b8f0f4a46d9033cfc68b06d4ed3c1d5421a6d05a8fc13ff9f01af5cad570de5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Apps.index
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{22b699a6-4323-44ff-8597-4711ab913fd6}\Apps.index
            • Size 1.0MB
            • SHA256 38667569eb6c902d84a8476d89dd1478494bc6984a9e6ece6a429218e6591819
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppCache134376190475499532.txt.~tmp
            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134376190475499532.txt.~tmp
            • Size 77KB
            • SHA256 1ecf4750ea2961c9322a2fc32336be3573c1bd4d23588e7b5492cc3747a5cac5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AssocProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\AssocProvider.dll
            • Size 112KB
            • SHA256 dc6a5930c2b9a11204d2e22a3e8d14c28e5bdac548548e256ba7ffa79bd8c907
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CbsProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\CbsProvider.dll
            • Size 875KB
            • SHA256 4c9a4ab6596626482dd2190034fcb3fafebe88a961423962ad577e873ef5008f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DismCore.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\DismCore.dll
            • Size 402KB
            • SHA256 af7f342adf5b533ea6978b68064f39bfb1e4ad3b572ae1b7f2287f5533334d4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DmiProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\DmiProvider.dll
            • Size 415KB
            • SHA256 04f851b9d5e58ed002ad768bdcc475f22905fb1dab8341e9b3128df6eaa25b98
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FfuProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\FfuProvider.dll
            • Size 619KB
            • SHA256 56cc8d139be12e969fff3bbf47b1f5c62c3db887e3fb97c79cf7d285076f9271
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FolderProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\FolderProvider.dll
            • Size 59KB
            • SHA256 a235317ab7ed89e6530844a78b933d50f6f48ea5df481de158eb99dd8c4ba461
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GenericProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\GenericProvider.dll
            • Size 149KB
            • SHA256 d39f38402a9309ddd1cba67be470ede348f2bc1bab2f8d565e8f15510761087a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IBSProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\IBSProvider.dll
            • Size 59KB
            • SHA256 5425382aaa32ffc133adb6458ff516db0e2ad60fac52dd595d53c370f4ba6fa0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ImagingProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\ImagingProvider.dll
            • Size 218KB
            • SHA256 874137ee906f91285b9a018735683a0dd21bdeaf2e340cbc54296551ccf8be2d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppxProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\en-US\AppxProvider.dll.mui
            • Size 22KB
            • SHA256 8af0073f8a023f55866e48bf3b902dfa7f41c51b0e8b0fe06f8c496d41f9a7b3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AssocProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\en-US\AssocProvider.dll.mui
            • Size 8KB
            • SHA256 b18c6ce1558c9ef6942a3bce246a46557c2a7d12aec6c4a07e4fa84dd5c422f5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CbsProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\en-US\CbsProvider.dll.mui
            • Size 53KB
            • SHA256 d7a0253d6586e7bbfb0acb6facd9a326b32ba1642b458f5b5ed27feccb4fc199
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DismCore.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\en-US\DismCore.dll.mui
            • Size 7KB
            • SHA256 f91e3c35b472f95d7b1ae3dc83f9d6bfde33515aa29e8b310f55d9fe66466419
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DmiProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\en-US\DmiProvider.dll.mui
            • Size 17KB
            • SHA256 73709c25dc5300a435e53df97fc01a7dc184b56796cae48ee728d54d26076d6c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FfuProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\en-US\FfuProvider.dll.mui
            • Size 9KB
            • SHA256 ba6695148f96a5d45224324006ae29becfd2a6aa1de947e27371a4eb84e7451a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FolderProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\en-US\FolderProvider.dll.mui
            • Size 2KB
            • SHA256 c81a992ecebd9260ff34e41383aaca1c64a9fa4706a4744ac814f0f5daa1e105
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            GenericProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\en-US\GenericProvider.dll.mui
            • Size 5KB
            • SHA256 9102fa05ed98d902bf6e95b74fdbb745399d4ce4536a29607b2156a0edfeddf0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IBSProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\en-US\IBSProvider.dll.mui
            • Size 2KB
            • SHA256 4ccfe7883bce7785b1387ad3872230159899a5337d30a2f81a937b74bcbc4ce5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ImagingProvider.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\en-US\ImagingProvider.dll.mui
            • Size 18KB
            • SHA256 32d8c8fb9a746be209db5c3bdad14f361cf2bef8144c32e5af419c28efd35da3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dismprov.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\AB9EDBA3-ABFE-4CD1-A6CE-9EB2D531934C\en-US\dismprov.dll.mui
            • Size 2KB
            • SHA256 cf8cc85cdd12cf4a02df5274f8d0cdc625c6409fe80866b3052b7d5a862ac311
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            AppxProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\F2D5EB49-C591-4489-8348-5792889E74FE\AppxProvider.dll
            • Size 554KB
            • SHA256 913f97dd219eeb7d5f7534361037fe1ecc3a637eb48d67b1c8afa8b5f951ba2f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DismCorePS.dll
            • Path C:\Users\Admin\AppData\Local\Temp\F2D5EB49-C591-4489-8348-5792889E74FE\DismCorePS.dll
            • Size 183KB
            • SHA256 e3b3a4c9c6403cb8b0aa12d34915b67e4eaa5bb911e102cf77033aa315d66a1e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DismHost.exe
            • Path C:\Users\Admin\AppData\Local\Temp\F2D5EB49-C591-4489-8348-5792889E74FE\DismHost.exe
            • Size 142KB
            • SHA256 e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LogProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\F2D5EB49-C591-4489-8348-5792889E74FE\LogProvider.dll
            • Size 77KB
            • SHA256 a9c8787c79a952779eca82e7389cf5bbde7556e4491b8bfcfd6617740ac7d8a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSProvider.dll
            • Path C:\Users\Admin\AppData\Local\Temp\F2D5EB49-C591-4489-8348-5792889E74FE\OSProvider.dll
            • Size 149KB
            • SHA256 2165d567aa47264abe2a866bb1bcb01a1455a75a6ea530b1b9a4dda54d08f758
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dismprov.dll
            • Path C:\Users\Admin\AppData\Local\Temp\F2D5EB49-C591-4489-8348-5792889E74FE\dismprov.dll
            • Size 255KB
            • SHA256 ef1e263e1bcc05d9538cb9469dd7dba5093956aa325479c3d2607168cc1c000a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __PSScriptPolicyTest_wmuafo12.frg.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wmuafo12.frg.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            aria-debug-3748.log
            • Path C:\Users\Admin\AppData\Local\Temp\aria-debug-3748.log
            • Size 470B
            • SHA256 f6e31869f1699d83c097ebfebf8445acbe2b6ce113db13eea807210f66fbbb25
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            aria-debug-4524.log
            • Path C:\Users\Admin\AppData\Local\Temp\aria-debug-4524.log
            • Size 470B
            • SHA256 c6e518763fc281f83ef379682e98d8a12f9e58affb2ca991c1b887d6238a6560
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tmp749A.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\tmp749A.tmp
            • Size 25.9MB
            • SHA256 6676ba3d4bf3e5418865922b8ea8bddb31660f299dd3da8955f3f37961334ecb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dism.log
            • Path C:\Windows\Logs\DISM\dism.log
            • Size 2.1MB
            • SHA256 39d73115af453deb3c1be3eef2d1cacfe53d8ba65ad3b0a4ffcc7a6a8153739a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dism.log
            • Path C:\Windows\Logs\DISM\dism.log
            • Size 2.1MB
            • SHA256 f986bd0addde10e3a6e201e3e00ff7096de21dce704a69730a7c4e6cf57deb46
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dism.log
            • Path C:\Windows\Logs\DISM\dism.log
            • Size 2.1MB
            • SHA256 52069c56e8aac27da3c20aeb5b88f15e0af59f731c708333ca24bf8ee27b2459
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dism.log
            • Path C:\Windows\Logs\DISM\dism.log
            • Size 2.2MB
            • SHA256 a1dfd63ae0073cd1cab82712479c70961f76eccd2f9aa5a73e57cdf6de2f32af
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/176-318-0x00000000045E0000-0x00000000045E1000-memory.dmp
            Download

            memory/552-1217-0x0000014B2B760000-0x0000014B2B780000-memory.dmp
            Download

            memory/552-1216-0x0000014B2B350000-0x0000014B2B370000-memory.dmp
            Download

            memory/552-1183-0x0000014B2A240000-0x0000014B2A340000-memory.dmp
            Download

            memory/552-1187-0x0000014B2B390000-0x0000014B2B3B0000-memory.dmp
            Download

            memory/552-1184-0x0000014B2A240000-0x0000014B2A340000-memory.dmp
            Download

            memory/628-1-0x000002C6E9390000-0x000002C6E93A0000-memory.dmp
            Download

            memory/628-0-0x000002C6E9390000-0x000002C6E93A0000-memory.dmp
            Download

            memory/628-211-0x000002C6E9390000-0x000002C6E93A0000-memory.dmp
            Download

            memory/628-21-0x000002C6E9E70000-0x000002C6E9E94000-memory.dmp
            Download

            memory/628-20-0x000002C6E9E10000-0x000002C6E9E36000-memory.dmp
            Download

            memory/628-19-0x000002C6E9DA0000-0x000002C6E9DAA000-memory.dmp
            Download

            memory/628-18-0x000002C6E9D80000-0x000002C6E9D96000-memory.dmp
            Download

            memory/628-12-0x000002C6E9390000-0x000002C6E93A0000-memory.dmp
            Download

            memory/628-9-0x000002C6E9640000-0x000002C6E9662000-memory.dmp
            Download

            memory/628-212-0x000002C6E9390000-0x000002C6E93A0000-memory.dmp
            Download

            memory/1048-774-0x0000000002850000-0x0000000002851000-memory.dmp
            Download

            memory/1508-352-0x0000018D71430000-0x0000018D71450000-memory.dmp
            Download

            memory/1508-315-0x0000018D70040000-0x0000018D70140000-memory.dmp
            Download

            memory/1508-321-0x0000018D71060000-0x0000018D71080000-memory.dmp
            Download

            memory/1508-317-0x0000018D70040000-0x0000018D70140000-memory.dmp
            Download

            memory/1508-316-0x0000018D70040000-0x0000018D70140000-memory.dmp
            Download

            memory/1508-341-0x0000018D71020000-0x0000018D71040000-memory.dmp
            Download

            memory/2964-805-0x000001CCC2380000-0x000001CCC23A0000-memory.dmp
            Download

            memory/2964-792-0x000001CCC1F70000-0x000001CCC1F90000-memory.dmp
            Download

            memory/2964-780-0x000001CCC1FB0000-0x000001CCC1FD0000-memory.dmp
            Download

            memory/2964-776-0x000001CCC0E50000-0x000001CCC0F50000-memory.dmp
            Download

            memory/2964-777-0x000001CCC0E50000-0x000001CCC0F50000-memory.dmp
            Download

            memory/2964-775-0x000001CCC0E50000-0x000001CCC0F50000-memory.dmp
            Download

            memory/3564-1181-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
            Download