d950e1ef5830897a4f390f5af83980fab6956d1d3f05f6c67194e352a71b1527

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UserSecurityManager/Install-IIS-Features.ps1
Size 3KB
Sample261027-ec6tgs1vcs
SHA256 d950e1ef5830897a4f390f5af83980fab6956d1d3f05f6c67194e352a71b1527
MD5 8cef458926d10720c04c60307eeaf4ea
SHA1 6476b51c6a2ea1c19e2c32d2222716ae32f23d4c
SHA512 6c85a5b355252e2120844256b76ed5644388b73c5500eee0c5274d8efc1e16ee0b4b76a5b2a590ff2cc18595b5e97f23e13f4c7ac44e48e4f53cbceb63b61fd2
TLSH
T15771046FC3565828FBB79C76A78782E36C1C59E305D41CEAD0904294F6C28BBB476C83
MD5 SHA1 SHA512 TLSH

Score

4^/10

execution

Malware Config

Signatures

Drops file in Windows directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	PowerShell.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4672	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4672	PowerShell.exe
4672	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4672	PowerShell.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4024	4672	PowerShell.exe	90
PID 4672 wrote to memory of 3016	4672	PowerShell.exe	91
PID 4672 wrote to memory of 2736	4672	PowerShell.exe	92
PID 4672 wrote to memory of 1588	4672	PowerShell.exe	93
PID 4672 wrote to memory of 2268	4672	PowerShell.exe	94
PID 4672 wrote to memory of 5744	4672	PowerShell.exe	95
PID 4672 wrote to memory of 3432	4672	PowerShell.exe	96
PID 4672 wrote to memory of 2740	4672	PowerShell.exe	97
PID 4672 wrote to memory of 4028	4672	PowerShell.exe	98
PID 4672 wrote to memory of 2188	4672	PowerShell.exe	99
PID 4672 wrote to memory of 3908	4672	PowerShell.exe	100
PID 4672 wrote to memory of 2888	4672	PowerShell.exe	101
PID 4672 wrote to memory of 6024	4672	PowerShell.exe	102
PID 4672 wrote to memory of 5384	4672	PowerShell.exe	103
PID 4672 wrote to memory of 4636	4672	PowerShell.exe	104
PID 4672 wrote to memory of 2688	4672	PowerShell.exe	105
PID 4672 wrote to memory of 1888	4672	PowerShell.exe	106
PID 4672 wrote to memory of 4776	4672	PowerShell.exe	107
PID 4672 wrote to memory of 3992	4672	PowerShell.exe	108
PID 4672 wrote to memory of 2620	4672	PowerShell.exe	109
PID 4672 wrote to memory of 4604	4672	PowerShell.exe	110
PID 4672 wrote to memory of 4228	4672	PowerShell.exe	111
PID 4672 wrote to memory of 1456	4672	PowerShell.exe	112
PID 4672 wrote to memory of 4744	4672	PowerShell.exe	113
PID 4672 wrote to memory of 4888	4672	PowerShell.exe	114
PID 4672 wrote to memory of 3724	4672	PowerShell.exe	115
PID 4672 wrote to memory of 1072	4672	PowerShell.exe	116
PID 4672 wrote to memory of 3780	4672	PowerShell.exe	117
PID 4672 wrote to memory of 472	4672	PowerShell.exe	118
PID 4672 wrote to memory of 3300	4672	PowerShell.exe	119

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\UserSecurityManager\Install-IIS-Features.ps1
1⤵
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {2579D5AB-A2AA-470A-92B9-A72B056EF38F}
  2⤵
  - Drops file in Windows directory
  PID:4024
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {74022F11-26F4-43DE-A8D9-4CDBC6553DE5}
  2⤵
  - Drops file in Windows directory
  PID:3016
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {99250517-4336-4160-852A-4643AEC39789}
  2⤵
  - Drops file in Windows directory
  PID:2736
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {AC4A7F0D-2257-4688-A9AE-17505EB5D275}
  2⤵
  - Drops file in Windows directory
  PID:1588
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {EBC5F6A2-5394-4383-9F1B-3E7B49D221CA}
  2⤵
  - Drops file in Windows directory
  PID:2268
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {F89421D9-92FA-4C3A-AA47-C64730F36123}
  2⤵
  - Drops file in Windows directory
  PID:5744
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {748C4FC5-F3F9-4F95-990E-41FB113B9E7A}
  2⤵
  - Drops file in Windows directory
  PID:3432
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {F02F0BAD-279A-49E4-9AD1-731C7AE825F0}
  2⤵
  - Drops file in Windows directory
  PID:2740
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {844C468C-2F6A-46A6-8B51-B1CC7807A6FC}
  2⤵
  - Drops file in Windows directory
  PID:4028
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {6293A6D6-AD0D-417E-8E38-01990C8E969E}
  2⤵
  - Drops file in Windows directory
  PID:2188
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {70227F77-6796-4055-9CDD-8A55A4F7A502}
  2⤵
  - Drops file in Windows directory
  PID:3908
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {3B028183-92E6-4A36-9587-49067C1404F3}
  2⤵
  - Drops file in Windows directory
  PID:2888
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {8543B677-67FF-4567-81FC-486F98EDC357}
  2⤵
  - Drops file in Windows directory
  PID:6024
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {FB2454DB-3A74-425C-8F97-8E5A6FEABBE4}
  2⤵
  - Drops file in Windows directory
  PID:5384
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {9947ED40-8203-4FC5-A5F5-1603550A72C1}
  2⤵
  - Drops file in Windows directory
  PID:4636
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {D1527438-AE3C-46AF-9B92-F51AE8F40A6D}
  2⤵
  - Drops file in Windows directory
  PID:2688
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {FF88DB52-3476-4DCE-A15D-67938A405414}
  2⤵
  - Drops file in Windows directory
  PID:1888
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {2C006D8D-9F40-42F1-A545-61DF4741B3F4}
  2⤵
  - Drops file in Windows directory
  PID:4776
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {8351F5A3-65B2-4833-9EF5-7D412D455C42}
  2⤵
  - Drops file in Windows directory
  PID:3992
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {9EE4F526-3705-4DA6-B98A-B9F80CF06D0C}
  2⤵
  - Drops file in Windows directory
  PID:2620
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {4A242313-51B1-4C2D-B238-44E711384EF4}
  2⤵
  - Drops file in Windows directory
  PID:4604
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {5096F6AA-C013-4832-911B-35C8AAFFA7CA}
  2⤵
  - Drops file in Windows directory
  PID:4228
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {16EA1C89-5859-4BEB-A1E8-6FCF18E13F61}
  2⤵
  - Drops file in Windows directory
  PID:1456
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {4016312F-8FAA-4F01-B447-860909CA8B4C}
  2⤵
  - Drops file in Windows directory
  PID:4744
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {A7723DF3-2D05-4C51-ACE1-C8C2ABC03CD4}
  2⤵
  - Drops file in Windows directory
  PID:4888
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {9562C05C-D3B5-4B9A-9140-0E3531561B6B}
  2⤵
  - Drops file in Windows directory
  PID:3724
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {5CAA161A-EF86-4CF3-BCAB-8E7DB48304F5}
  2⤵
  - Drops file in Windows directory
  PID:1072
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {E658756C-98DC-4C45-8A22-1773EF51071D}
  2⤵
  - Drops file in Windows directory
  PID:3780
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {439CD248-D2C8-4FDC-918B-B6E117E03EA6}
  2⤵
  - Drops file in Windows directory
  PID:472
- C:\Windows\System32\Dism\dismhost.exe
  C:\Windows\System32\Dism\dismhost.exe {0CF411AE-6013-43B7-83B0-BE09D9704126}
  2⤵
  - Drops file in Windows directory
  PID:3300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_ybwnm1s0.zkx.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ybwnm1s0.zkx.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 782KB
SHA256 c7a711ff3f681532e93362acb3f818397d7c32551df1b4f89ab604be8b0e6a5b
MD5 93388d7296cc4dba46b168450e856f0d
SHA1 2d80eb48bc1b1d6aad79e81b698429a4bbcfe0a1
SHA512 89be1954b04dd10c11985a97435bdc2d22b5f159c37b435e1a48cea7f34df706661ceb7386eb06ebf7cc070d103a1e8aa242a3d1402f2c4da7305da0e8107763
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9b:9vmgspsPAK5+lMAEMBaeEZv
TLSH
T1BB050F2E17FF4971A149C44331788BFD16A771926ACCF324B63FD369A3CB5894A1B284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 596KB
SHA256 5a3b813db16914ca7b6dd593b58bfd8716eb4c9f466062efbebc3b20ef27e08b
MD5 af54b30864a01485adb2b43d9cae844e
SHA1 4e0b28f170b9d9aa9bd965006e476c26e5cbdce9
SHA512 1964537dfcde5956e8c2a6251da2e7c9fa759202550e0c6e67331a42cdbcdc6b93c46c8e3ff59c6330f3dbd1b027c3efa67c2da480f4d05fdfe9c88eafe42992
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9B:9vmgspsPAK5+lMAEMBaeET
TLSH
T122D4002E27FF4971A149C44331788FFD229771926ACCF324763FD36AA7C65894A1B284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 631KB
SHA256 dcd1ae6f1316f3ad0dde0b0d452a712ee6724f4ff38d261e99edb3e2a5dc0a31
MD5 abfdbb44ec4a6cbd639577db84163107
SHA1 ab55928ba1a95df2acb45941846ace2eb85aefc9
SHA512 976aef9e373eec9fdecf3f4670b0cfdb39c8b7a8e2dd09d50deb50d10b3737497e38dbab18e924dc96a34bba5be95bb9e7d0e7b31594765b995c193d87eb14be
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9h:9vmgspsPAK5+lMAEMBaeEP
TLSH
T12BD4102E17FF4971A149C44331788FFD229771926ACCF324B63FD36AA7C65894A1B284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 666KB
SHA256 c4e8e600b6a03dd7ae3ad6b7b2a0308cd3e2cabe5c035a913f16c4a387734d02
MD5 6ef96afd0f24eb0d50f12aa8ee1e7826
SHA1 b01466dd071cda06a883ea76198d1838ff26d11d
SHA512 5af217936ba86c6706c0da77db654be044457bb80fb06d59b3ababbebe70349c3607345d651db4b7daafb4d3d3e48d26eda37b8e139e1132165f6dcf927f403b
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9r:9vmgspsPAK5+lMAEMBaeEp
TLSH
T1B5E40F2E17FF4970A149C44331788FFD269771926ACCF324B63FD36AA7C65894A1B284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 664KB
SHA256 1c4c8c48dff18590fd875e3db5923ae75da97ef417c86ed7be14095d871960dc
MD5 2eb3def1e7557337c643dd7d7db98d72
SHA1 08e29d577760b00a010c07661bb590f920557ffc
SHA512 6fbb29790b112545fd6ee5c38e75769eb24442529ace744e801cef02ac879a856b5fd4b232f4201e9637372cbf4e52165a15d2d8d4f216c7c21c65cdc8a37ba7
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9x:9vmgspsPAK5+lMAEMBaeEb
TLSH
T188E41F2E17FF4970A149C44331788FFD269771926ACCF324B63FD36AA7C65894A1B284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 350KB
SHA256 70c541dd205269812acb034c47168d52c013d32577cb6569be417d2e2b6ac621
MD5 26b8f580594985f88d81719ac4e1a82c
SHA1 9e327d1afc0733daaef4314fe33e3b26517755cd
SHA512 cc8711802f91424d005d956734a4ea6dd90b9bcabcc9a2148d50188f28e34fbb07a2c3aff67ef2c00770b7e92e563f2058a7895658575a05152e352dced99257
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9O:9vmgspsPAK5+lMAEMBN
TLSH
T19374DF2E27EF0D31A189C44371759BFD21977193A6C8F3147A3FD22AE7C69C94A1B284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 343KB
SHA256 9f219bacef4e1660c0f02a9b6f835af9e618a6c97d7aaa844be4e2c340687e48
MD5 29b7921018b2d6ca5be67d575d802c8c
SHA1 8327186eed289964011e45afbebf2aadff6aad8d
SHA512 5c24f723c9992d93a0d76837816bc958f6d24076f3ef0af500fb4de244aec5feeccf65e318a40a194011b1dee7f3d8eecfe3353d6d2f5c5a754d0f051931afbb
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9K:9vmgspsPAK5+lMAEMBj
TLSH
T19574DF2E27EF0D31A189C44371759BFD21977193A6C8F3147A3FD22AE7C69894B1B284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 701KB
SHA256 cdbcf684e34c8f38c4f84aa1131ee0c2c8fb7003a533f416e98e891e5d1f05fa
MD5 fca3046a585145448261c0b5cf5fb02d
SHA1 ca9defd9869d63e6ace01d1266a66b06f2bd4e72
SHA512 cef3605e0da53b780dbcacfbcaa6383167b86b3b9438972ee7a3252d52681f19443adf5248aff219fdd8dacbccff668dfd488bf5a9f850ff7eb9cfad0c4a901c
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9R:9vmgspsPAK5+lMAEMBaeEZ9
TLSH
T14DE40E2E17FF4970A149C44331788BFD269771926ACCF324B63FD36AA7C75894A1B284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 484KB
SHA256 0f7b964b844fae05df6474dfaeaa047be1a29982d9545a1e38325edec6617bdc
MD5 2d8e98067bd798766c12b0b57c40d393
SHA1 f194530d9e191cd10f2e1e5eb9257e7dc84b8283
SHA512 8398fcf0ab41d856c24057c3f5ed6461cf7c88716c7ac163d054e8b50bcbc6d54094b0200cebc920949a22240bf5ba4b269d44408cdd738481ae3ed43ec37f33
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9g:9vmgspsPAK5+lMAEMBai
TLSH
T1F1B4FF2E27FF0931A14DC44331759FFD229771926AC8F324B63FD36AA7C65894A1B284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 466KB
SHA256 694b52a20c0f292b671e6aa323d55f18d131d7285b1303bf37dd25a3b2077da0
MD5 5bc532c0d6558a3faf84bb95f3034b3e
SHA1 c2f96652b0914277e836b4b216bb74b41f591386
SHA512 ac072435fa777595f53cf464e559b86711c18ab90735a2328a889ae34ecba0398e85944d1a8116b82931c452dd5feb72a58503489285c7e46f1f6b9bd2d27e87
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9K:9vmgspsPAK5+lMAEMBa0
TLSH
T1FCA4E02E27FF0971A14DC44331759FFD229771926AC8F324763FD32AA7C65894A1B284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 807KB
SHA256 9cee9a60af4ec685b7f5f6cabb451a0933f18892f2f85276f1c69fbe2722edf2
MD5 b54b5e4b73cf61a63c9088ace87666f0
SHA1 6234ae67db03a58871b633130e685c69f473317f
SHA512 0a4467c3b1c2aad49ebd750601cbc6895e06fad6b20031314bd4f5f9d83535de3b93c5e0ace8f520e033fcbff1e7bbd3e1f144fc350c2afe5e004b1510826889
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9V:9vmgspsPAK5+lMAEMBaeEZeC
TLSH
T11C050E2E17FF4971A149C44331788BFD16A771926ACCF324B63FD369A3CB5894A1B284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 580KB
SHA256 b012c2eeed8253e591361406a62a1e4c91817c367eb900675ec17100de38875a
MD5 2ff6cae8321eb1f78a2373230fa64e3c
SHA1 29e9cc2cffbbf2e385799480abd5a6ad63d19f5e
SHA512 58e08afbae490a58391aa45183f69518b2e810b05a1236cb88355313788bf08d3a62a29cf6e2f5ebb6d5c507bd5bf9992cf31e8aaa1a0c21631a3afadbc8a872
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9n:9vmgspsPAK5+lMAEMBah
TLSH
T13FC40F2E27FF4971A149C44331788FFD229771926ACCF324763FD36AA7C65894A1B284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 649KB
SHA256 b3f3ffef8f351f70b3646ae0d8a34ff92c5b6bb3826849a04d4e7d3c1314b11d
MD5 7e2799c92781b04aeb6c32f9215f8f76
SHA1 bd87e5eb433affa77c0f3647c05fa78d50a070e9
SHA512 d9efd1adfc7a0cbeb9210c001c00f16799f4f89b3be7158227484c97fb3e31ec4cae74049fd6040ff65fe19c2522b875c30c77f12972d8c7afc038733672c33e
SSDEEP 1536:a6ZdrbkeRIK5Y1LkZVoM+w7ugspsPAK5+lteAkxGJkbM+CthSUBZx9eUTls6Mn9a:9vmgspsPAK5+lMAEMBaeE0
TLSH
T193E41F2E17FF4971A149C44331788FFD229771926ACCF324B63FD36AA7C65894A1B284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4672-13-0x0000016E77DB0000-0x0000016E77DCE000-memory.dmp

Download

memory/4672-10-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-19-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-20-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-21-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-22-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-23-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-24-0x0000016E77E00000-0x0000016E77E1E000-memory.dmp

Download

memory/4672-25-0x0000016E77DD0000-0x0000016E77DF8000-memory.dmp

Download

memory/4672-18-0x0000016E77DD0000-0x0000016E77DDA000-memory.dmp

Download

memory/4672-15-0x0000016E78050000-0x0000016E78102000-memory.dmp

Download

memory/4672-16-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-42-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-0-0x00007FFED58CF000-0x00007FFED58D0000-memory.dmp

Download

memory/4672-14-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-17-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-9-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-8-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-7-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-6-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-5-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-4-0x0000016E77D00000-0x0000016E77D22000-memory.dmp

Download

memory/4672-3-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-426-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-494-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-518-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-522-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-570-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4672-571-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download