Overview

overview

8

Static

static

1

Hide.me-Se....1.exe

windows10-ltsc 2021-x64

8

Hide.me-Se....1.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    19/11/2024, 16:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Hide.me-Setup-4.2.1.exe

  • Size

    18.5MB

  • MD5

    074a7929ea64805d3406c86ca3e4d9be

  • SHA1

    08ee722d9d3f85c14b6c7d47fdbfb2c3db019097

  • SHA256

    7b70566316b614060caa472243d87321d0bf7bfcf493493f94f842c9837d27ce

  • SHA512

    f6dcdf1ac978d1a1c7bc81f887b7426df5c89d14a644968d10ac85b41672fd7c40d38b075ea1ad312a6ea6754f9c3c2c936651ea032c534e177bd2efda82de05

  • SSDEEP

    393216:cE1kKDaqKzbCiXoQMO0Ya6FD/9coRQY4a3QZl4P7PzALAWSQbBdk0A3E5:FDaVz+iXDMOBl59fQja3QbAPcMWLtdPx

Score
8/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Blocklisted process makes network request 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 51 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 63 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: LoadsDriver 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Hide.me-Setup-4.2.1.exe
    "C:\Users\Admin\AppData\Local\Temp\Hide.me-Setup-4.2.1.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Users\Admin\AppData\Local\Temp\is-BECAC.tmp\Hide.me-Setup-4.2.1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-BECAC.tmp\Hide.me-Setup-4.2.1.tmp" /SL5="$401C6,18456089,857600,C:\Users\Admin\AppData\Local\Temp\Hide.me-Setup-4.2.1.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2648
      • C:\Users\Admin\AppData\Local\Temp\is-61P8L.tmp\NetRuntimeInstaller86.exe
        "C:\Users\Admin\AppData\Local\Temp\is-61P8L.tmp\NetRuntimeInstaller86.exe" /passive /norestart /showrmui /showfinalerror
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • System Time Discovery
        • Suspicious use of WriteProcessMemory
        PID:3032
        • C:\Windows\Temp\{9721FD40-41D4-4D85-A4FC-E8BD146EC557}\.cr\NetRuntimeInstaller86.exe
          "C:\Windows\Temp\{9721FD40-41D4-4D85-A4FC-E8BD146EC557}\.cr\NetRuntimeInstaller86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-61P8L.tmp\NetRuntimeInstaller86.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /passive /norestart /showrmui /showfinalerror
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • System Time Discovery
          • Suspicious use of WriteProcessMemory
          PID:4648
          • C:\Windows\Temp\{DF8BD840-0833-4E1B-ADB5-49602CB0B595}\.be\windowsdesktop-runtime-6.0.26-win-x86.exe
            "C:\Windows\Temp\{DF8BD840-0833-4E1B-ADB5-49602CB0B595}\.be\windowsdesktop-runtime-6.0.26-win-x86.exe" -q -burn.elevated BurnPipe.{BA683C54-1DAF-43D0-844B-E9D963ADC31A} {CAE0D9F8-BFFD-4136-9874-C9F046A7507A} 4648
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:3164
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\system32\msiexec.exe" /i "C:\Program Files (x86)\hide.me VPN\OpenVPN\drivers\ovpn-dco-x64.msi" /passive
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1716
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\system32\msiexec.exe" /i "C:\Program Files (x86)\hide.me VPN\OpenVPN\drivers\tap-windows-x64.msi" /passive
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5012
      • C:\Program Files (x86)\hide.me VPN\hidemesvc.exe
        "C:\Program Files (x86)\hide.me VPN\hidemesvc.exe" -i -start
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4364
        • C:\Windows\SysWOW64\sc.exe
          "sc" create hmevpnsvc start= auto binPath= "C:\Program Files (x86)\hide.me VPN\hidemesvc.exe" depend= RasMan obj= LocalSystem DisplayName= "hide.me VPN Service"
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1848
        • C:\Windows\SysWOW64\sc.exe
          "sc" description hmevpnsvc "Provides network services for hide.me VPN"
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:4588
      • C:\Program Files (x86)\hide.me VPN\Hide.me.exe
        "C:\Program Files (x86)\hide.me VPN\Hide.me.exe" -i QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXEhpZGUubWUtU2V0dXAtNC4yLjEuZXhl -a ""
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Modifies Control Panel
        • Suspicious use of WriteProcessMemory
        PID:4920
        • C:\Program Files (x86)\hide.me VPN\hidemesvc.exe
          "C:\Program Files (x86)\hide.me VPN\hidemesvc.exe" -start
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4612
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:376
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 90C55CF323C1347DE7916F6C587F55D4
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:112
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 6F7FB299447770181546E597BCAE7560
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1140
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A75880B355154AD0B0D56B167FD30A21
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:976
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 06B10EAC86A7753118B7DB80FDE5FE88
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4808
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:4
      2⤵
        PID:3920
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 49300B6A9ADD3AD01FCBE3C167827E77
        2⤵
        • Loads dropped DLL
        PID:440
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding ED90EBEDF8516611F703D777FDD16F4E E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        PID:3892
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 9E39D7CBAE951A011396F0997C56E6B0
        2⤵
        • Loads dropped DLL
        PID:4136
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 2ABCB71C8FB6911A3243C1A6E6D62382 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:3868
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:4024
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of WriteProcessMemory
      PID:1252
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "1" "C:\Program Files\Common Files\ovpn-dco\Win10\ovpn-dco.inf" "9" "4e1f3ffd3" "00000000000001B8" "WinSta0\Default" "00000000000001D8" "208" "C:\Program Files\Common Files\ovpn-dco\Win10"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:3660
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "1" "C:\Windows\Temp\3c44d95b385823c5417ed89f37147c3c1f8d223d6fb66ad59b9424192fa6b728\OemVista.inf" "9" "4d4bf17c3" "00000000000000E8" "WinSta0\Default" "00000000000001E4" "208" "C:\Windows\Temp\3c44d95b385823c5417ed89f37147c3c1f8d223d6fb66ad59b9424192fa6b728"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:3828
    • C:\Windows\system32\mspaint.exe
      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\StartRestart.jpeg"
      1⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3828
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
      1⤵
        PID:5076

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Config.Msi\e588dd7.rbs
        Filesize

        57KB

        MD5

        9db9c3fee4f331fda5e18c4d32587201

        SHA1

        e248ae8016a46ff55b3934ce20d67be3006226e2

        SHA256

        ba6b1243ffe27be9300234e866b65d890f2b7d5db02bc66affed2a96a7c4553f

        SHA512

        ad9ec241320b6df639f4cbf06504462ae59f4af933e2934bdea8fb0e8e3d790e305c0d81798b0199a8717113c5e291c9e4c52db77182cce64db4ba7f5fe76ff1

        Download Submit

      • C:\Config.Msi\e588ddc.rbs
        Filesize

        8KB

        MD5

        21533ad16bba61fff25c01d943763d58

        SHA1

        6a6e8a75b81bd044eb5a3efd28ea4e445717955c

        SHA256

        6d846520af8931287d9affe4106ea994858819e5ae41ab4ebd26f38459e6d1ea

        SHA512

        2510b326b28d75ace4e9677e0fe94bad63f75027d23bd21c07b5a522b337d380a93b11f7f5566bf944e5ba3694e48eb9932453ae435ea2a9d90cb9cf8ee7b79b

        Download Submit

      • C:\Config.Msi\e588de1.rbs
        Filesize

        9KB

        MD5

        e2e85468028b43efb078857f105f0f82

        SHA1

        7880a71ec1488345ef53e3b8f6e7cbb162491d98

        SHA256

        684341fa5cb513f92f0527b79446b3c0ea69b5cf657c60978d584a825666713d

        SHA512

        38e05400ea5c5e16ce68db6d7b0a86fc891d6c9967587ea56308919e9594777d250e4401d4267ccf474a64d4fafa779f40b54cdbfc5471c5fa5e4272ef86da9d

        Download Submit

      • C:\Config.Msi\e588de6.rbs
        Filesize

        90KB

        MD5

        d353e3607e8948252acc5451cec92270

        SHA1

        ae557af62cec5a578aa10931d46bc17d6d68fcaa

        SHA256

        fa8a1bbc8c2bdb3012c53817c4cb0f01fa17d11cba26890bbc765b2d2792a5ed

        SHA512

        69cc243017a1ca09342b5deaff8066365b3a64d954662037e89b27d6e48783a4e77293bd3875fc6527afd7fb4bbaa21d6c383eab78b0526e984b77458c643563

        Download Submit

      • C:\Config.Msi\e588deb.rbs
        Filesize

        8KB

        MD5

        dc0f540df32a8123f1ffb38ee7579433

        SHA1

        648482d4b7a04648be88ee8ed0bcdb2bb2893d1f

        SHA256

        dfea1e243cae5e121dde10ab6547fa588605e125ade9e3ca3e1ce089c51b1797

        SHA512

        30a31cf234020fbaca611fba9cdb4bdf747f4e805ad74f776f6da3f05148329515190cfdffc63c71dfe850bbcc3b1c4659c9769c67d6e996c50c85f204f30e85

        Download Submit

      • C:\Config.Msi\e588df0.rbs
        Filesize

        834B

        MD5

        bd2f486aba9b099871a3794cac9f8b6a

        SHA1

        4286f83225a5ddb21a194cbf6cbec6a99b08a342

        SHA256

        cdb3ec848732c36b433d5bb91cc0145f57f46f09e9c1d4c3856a9131b7b16186

        SHA512

        ee1adaa9a56b6acfbaf1e9863cf833ef1dc3f832f68c1bfb06f6c7ec10d2811a7e0f24d41f2f4ba4756162df35b91550a5dabe23d2c3aecc3e0f8341c5e2b49a

        Download Submit

      • C:\PROGRA~1\COMMON~1\ovpn-dco\Win10\ovpn-dco.cat
        Filesize

        11KB

        MD5

        5551203f3f1095335ff00421b16fd7e2

        SHA1

        0d14402407d60952f631dffe35240de3a1f910cb

        SHA256

        26c54ce26cb43407855ba24d10fbb30a87e5a1a0a35536025a02cb003fe474f4

        SHA512

        3c31b8f60bb59e4ac3c0cda8335af1918927c51b203c8b68f2601b390ad0bc0228cb9d5566dedef05ff38cabfce46eb3d54c52cd59c828bc17dcf0b1c24a8b08

        Download Submit

      • C:\PROGRA~1\COMMON~1\ovpn-dco\Win10\ovpn-dco.sys
        Filesize

        89KB

        MD5

        5e69b6c42467b2673101e592a2b28638

        SHA1

        16d076f57b3cbdbe945c6666676823871f5c90d1

        SHA256

        2357e4d2007f346a3d2b3bf05115caeaf3eb069a70be654ce472be71e6f7fc75

        SHA512

        232e9441db8da52cd5e6f29baf5340b0540125074a7ccc9d4754762c56460b72327f89d6583a8afde71ed400433eb850e1eb2b9d5fc536d8f9c18992b83fa587

        Download Submit

      • C:\Program Files (x86)\dotnet\LICENSE.txt
        Filesize

        9KB

        MD5

        31c5a77b3c57c8c2e82b9541b00bcd5a

        SHA1

        153d4bc14e3a2c1485006f1752e797ca8684d06d

        SHA256

        7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

        SHA512

        ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

        Download Submit

      • C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt
        Filesize

        78KB

        MD5

        f77a4aecfaf4640d801eb6dcdfddc478

        SHA1

        7424710f255f6205ef559e4d7e281a3b701183bb

        SHA256

        d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7

        SHA512

        1b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b

        Download Submit

      • C:\Program Files (x86)\dotnet\host\fxr\6.0.26\hostfxr.dll
        Filesize

        304KB

        MD5

        5dcf1303f716e945e5f64c34a8e6d485

        SHA1

        90bcde7aedba529092ebdb07136f89c1fd7bd290

        SHA256

        f6afec83f4df25da797e833f7d5221233113bec26bf6a4f7100bf5d9ca53df7b

        SHA512

        b63b767fff14dfa6489e99a62a2522cf57c257ae1957120c42adabc6a080e4f1ec8c54a47d9280246262ef71eb721b80741e701e93c00153696a9a573412f983

        Download Submit

      • C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.26\Microsoft.NETCore.App.deps.json
        Filesize

        32KB

        MD5

        b119ba5bdbf25afbe314e6ddd9bf9d8d

        SHA1

        ee82eb19b3480f3f5847ae28ee77431e68018682

        SHA256

        117c757f743fb72c4418a90b5eb6a5b0784f89576db6446c8989a18c7520e5be

        SHA512

        f708b887aa9c0195222fbf122f5175d20e313b7703fd801f24b0c70d27619239726e39d9f234ade7a0b7d684acdccbbe860ce4a9da80b5eac95adac8d16dcb0f

        Download Submit

      • C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.26\Microsoft.NETCore.App.runtimeconfig.json
        Filesize

        159B

        MD5

        3fbd84a952d4bab02e11fec7b2bbc90e

        SHA1

        e92de794f3c8d5a5a1a0b75318be9d5fb528d07d

        SHA256

        1b7aa545d9d3216979a9efe8d72967f6e559a9c6a22288d14444d6c5c4c15738

        SHA512

        c97c1da7ae94847d4edf11625dc5b5085838c3842a550310cca5c70ba54be907ff454ca1e0080ba451eacfc5954c3f778f8b4e26c0933e55c121c86c9a24400b

        Download Submit

      • C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.26\System.Private.CoreLib.dll
        Filesize

        9.5MB

        MD5

        0ff8e445f6054cfa02bc1b63286f6c70

        SHA1

        7ae6d67c7715f254e6d19a08254be4d8832edee1

        SHA256

        b1a66759ff9855ae48cb7bfb7b4fdf5edd69261b760df4e921f4ee032ec3248a

        SHA512

        8a6da0e21547598329cf047db3268c7a7787431f9625effc459a26ec8a46cbb64d1411a9b17ecf208a1ada8e003d39b2ef03063c3128eee36d2d10c59c7a753f

        Download Submit

      • C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.26\clrjit.dll
        Filesize

        1.2MB

        MD5

        6f96ca0da08ff182f1c7325ff9ca2686

        SHA1

        f9b3f43217afd030032569f7e11e283666b50ac9

        SHA256

        8a6c3d5146842a9accef2286570af991ae7320d58faab2374ad2b834dee87afc

        SHA512

        f3ad85ea11c703be80f8bf6e2294c72f2515ca34a5c6f3ed89381fa4d78a553f204f24e868cbdeb8b501b2598f6d914a661e5602169a888c4c9d838713da9e63

        Download Submit

      • C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.26\coreclr.dll
        Filesize

        4.1MB

        MD5

        ff12fad9ec5e76865e8d57f70f812489

        SHA1

        6c2162755b2a4581e1bc0c13e09ce12cd447195a

        SHA256

        55d9251ae95ca09a18a1555dfe491dc61aafc3d0f2c24adb22f481b04441105b

        SHA512

        4078bcf7268167d5b4e6a173a08f7c5dc58fede79adfa011883f682305d5be5f77b206800e09473dc817148a22f7c36fc7b38efaecc44cd79832ba08bfd1e8b1

        Download Submit

      • C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.26\hostpolicy.dll
        Filesize

        319KB

        MD5

        c52ae53cb18e0b75d8f9da7c66be1767

        SHA1

        b8417150ae1b61bda9a5f7ba70264e39af7b6ffa

        SHA256

        de225df74d582da644a79fc558d8831a1992ef8007db150101bd5a83677d4c80

        SHA512

        56b3609693ea3e23737d84721349c9a731a0a6b39f1b78a3f95eac7a0d231b89ca1a944afbe0c34c668c55a9bcd31f9118331d7b0e1991bc3d4f0ec1f2a7ab64

        Download Submit

      • C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.26\mscorrc.dll
        Filesize

        143KB

        MD5

        4462fa3d31aeb739b61a64e242218cf4

        SHA1

        af25283a38ba2a1a70f6450edbfc840cf9efbf68

        SHA256

        76e8f7c7565cb7a71f101efcefa7137a8ae2702a459f26b6b8206d106d679430

        SHA512

        f7a832c6c397fbecc907baf03c9a2e4b9dd042008172b3a36d7805b3361fc4eda678f1d960699e4c1237928d585a85d05e543984c7f432ab8209e652ec992084

        Download Submit

      • C:\Program Files (x86)\hide.me VPN\Hide.me.exe
        Filesize

        445KB

        MD5

        a848cb531c31cd1810698506b004777c

        SHA1

        524446cbc0d6a03bed6bd2ec8de2f39ad1b85492

        SHA256

        9b3e582fd182fde0f8f97d84509cdd07870a92e55d3464ae0e39798faba3425e

        SHA512

        d83f81adbeaca953cbaeba952b503688b8dfab33cdb5c267e387bcf5f697ade1b0562b882600e5318660478982cdde3ab6b50189e64c2018abcb391c76c0a579

        Download Submit

      • C:\Program Files (x86)\hide.me VPN\OpenVPN\drivers\ovpn-dco-x64.msi
        Filesize

        256KB

        MD5

        b35e4e3cec593a0c9573f94bd1216f79

        SHA1

        9d83e761a502e205728606a458d9791abf084f12

        SHA256

        f0bceaee27f6c945437a6d37bd34be4ed1f7245682f6a59b1a6587cc61386c31

        SHA512

        a30506d1fd1d02e809a4cb9fb19f4637e02a6665e9390a8a75cb3ef21d2131b7410c30a3739b065b9896835b7152a887accc3970d3bc22caf7110dfc35d8572a

        Download Submit

      • C:\Program Files (x86)\hide.me VPN\OpenVPN\drivers\tap-windows-x64.msi
        Filesize

        332KB

        MD5

        eca0ac91827335c42615639d5968eae9

        SHA1

        11093076102b5d6aefa6add8717b23dae2a074cd

        SHA256

        26abd331f860db83481de91cfd185d2e71197ce5c4c521d944601c8924aac2a5

        SHA512

        bb2043b352508da8169bb12653feb9aa0289c8907ca48aa4be1a5ed6204bf136229f5678243496697ae45becd09e49cfd17c954596cd8cb191ad0480d17006bf

        Download Submit

      • C:\Program Files (x86)\hide.me VPN\hidemesvc.deps.json
        Filesize

        42KB

        MD5

        30e742ac3b6786dee4451ef6068838a0

        SHA1

        5a0d300fc744575768757debd135d3e1a47f57ea

        SHA256

        683e1a98ec7eea4843f9592ff64c8386fe14c69a060aab0236b3e320d7ecb5fd

        SHA512

        c028ae8ae32e59e8b4e81459be37c9160c54181f83d1f5a98e571154e0125e838a03a686bd4c73ddecb4320f70f27815c58fe183fa3c11d301ae3ccbf9771c31

        Download Submit

      • C:\Program Files (x86)\hide.me VPN\hidemesvc.dll
        Filesize

        160KB

        MD5

        a5ca51ed101fa808a32db95def8cbf7b

        SHA1

        5b1eee5bc27c57bc167b5ad6c016023fce2d86f7

        SHA256

        a8416e7ae1cadd61fad95f1f91da9023e61aa741715ddfe32c7d7d895b3ad77c

        SHA512

        2b465713ac0e9fb9dd4e7c9733ae4c53450c50743954c18a85c7b0c9150fa67d0c0601f46fec00605b4845019e9c5caef774fd5791c139a319e80457655f9290

        Download Submit

      • C:\Program Files (x86)\hide.me VPN\hidemesvc.exe
        Filesize

        125KB

        MD5

        860c9eab25bb5a274462ce415f4cfbc9

        SHA1

        8a4d0b5269c2bcf3a299679ab8bbbebe181c3566

        SHA256

        a9f46bdca066b538724bae310c2aa5de1f4196d865d90c09907b894158f0b094

        SHA512

        d9ea21058c57b6ff68dd7e2409db58e991f3d1752866bda6f6874d375d538c2ceac3d6cb3472bc6e5a3360cf34bf80a68fcd1e4546ce3a3103c28b6ac1015c4f

        Download Submit

      • C:\Program Files (x86)\hide.me VPN\is-HS933.tmp
        Filesize

        253B

        MD5

        24e4653829de1022d01cd7ddd26e2f22

        SHA1

        9160a009cb381e044ba4c63e4435da6bfeb9dc6d

        SHA256

        ded3aeb5856a11db0b654a785574490cab55839ebfb17efe9e39b89618fc5b91

        SHA512

        efd4bbba1baec0b47003831510e3aa539db9ef468e0f06ba9d7ba6d0b3800035f7c818d7d90171bfd377ec97d08c4617555bcff635dd83efceb412b1a9cca820

        Download Submit

      • C:\Program Files\Common Files\ovpn-dco\Win10\ovpn-dco.inf
        Filesize

        2KB

        MD5

        77da079a3665afc84d05c3d07bcaa0d0

        SHA1

        3fbfafe2c08100f5b46b792398c2ecb9157760e9

        SHA256

        1f6c35bc11d910f91c32ea54894d0fddb0094876bdd526d04a9287d04d636242

        SHA512

        10fcd8464c6aab386bf2f675175598764e0b784a898b7b450fef3d055ecf902c7a57ac0aef2725b9e6899146e4e9230c8677bfd2a8f18489b642fa6beca25507

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.26_(x86)_20241119165301_000_dotnet_runtime_6.0.26_win_x86.msi.log
        Filesize

        3KB

        MD5

        de14036d9ed31fba4c80956d481c3004

        SHA1

        84fc0c45bc16933c8ab362c652feffac724cfea0

        SHA256

        2eb615cab54bbb101dbf517cc36bbf8b0cc5617fbfc34025cce26395a8c794b6

        SHA512

        c2b28e72d11286bbef703f068e56eb5d5df3b6f7054694f5b101b4931d580287eeeaa3077d77d161e82c6bfcb5442fd514a0d9f0af22aca0c5943421dddf700e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.26_(x86)_20241119165301_001_dotnet_hostfxr_6.0.26_win_x86.msi.log
        Filesize

        2KB

        MD5

        bbc64a4d5c1fcffe7e0cf2fdc2f88dd0

        SHA1

        ec9db554ceb138db2328f2d6d050404fd0ee41e8

        SHA256

        72010cb8f89b9514c8f7bde7e39008150ad4d066348cfd8ce7e57dbb5e3c10e0

        SHA512

        0b445928973d6e691041c6bac36e6f1844981255697cdc0510ed6f06ca88c7006ec94584731233987c40edec7d6a24b10c16d22d2703c92df323fe4adef1c325

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.26_(x86)_20241119165301_002_dotnet_host_6.0.26_win_x86.msi.log
        Filesize

        2KB

        MD5

        68aed11f1f209f4bef7676f1f7142b2e

        SHA1

        1f8aff91f04e2a62a177c55d1ede4f2356a7e02c

        SHA256

        2f383a0ebf5d1c8e4638b61d9fd6bc0c304569050804319baed51dfa9b3ee866

        SHA512

        fa5a11bb32d616348f8eb01f18bb86b8979b145460ebc1580cba2fe018ca8c44afced26670d1b1b25d6d78d2755f9389697df5a57aa81ca0c0aad9ef693d7326

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.26_(x86)_20241119165301_003_windowsdesktop_runtime_6.0.26_win_x86.msi.log
        Filesize

        2KB

        MD5

        d8150699806fa3b0e6e43bec58b9838a

        SHA1

        6598e658c9ed7e4710fe527dabaca0ddce605c6e

        SHA256

        76c9397b2859ff7f0e38a823ad7e0ff3ad9e59af7006d85fb22d270ceac3ce27

        SHA512

        4baad4208966a1cb9f4d49c3306b57ea527577fdce457aea43756e924ef8a16c253bcb48e1d823fbc25c2c0f6713c8e183fcacdd4a2306051658d6c9fd92ec36

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\is-61P8L.tmp\NetRuntimeInstaller86.exe
        Filesize

        49.8MB

        MD5

        3fde4dd4227d7d2ee1522ccfd8990e98

        SHA1

        d929f1757c89d3c5002151c913e7905b31b3871c

        SHA256

        b6cc1012923f87eed87860dc0abd975e1366d41bc8598f4ec12234667471c2e1

        SHA512

        bd0878b65750173e2d99479ae051daa9e71a0ee1949c600ed4a33856e4bdd2b658ebbd1439977d17c0d2fd8f3bb37c1592c4f46a4def9c534addac3a9f4a72a2

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\is-61P8L.tmp\idp.dll
        Filesize

        232KB

        MD5

        55c310c0319260d798757557ab3bf636

        SHA1

        0892eb7ed31d8bb20a56c6835990749011a2d8de

        SHA256

        54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

        SHA512

        e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\is-BECAC.tmp\Hide.me-Setup-4.2.1.tmp
        Filesize

        3.2MB

        MD5

        307ad78ad76fbbf81fb02b6778cc797e

        SHA1

        b6e4cad64490502a89bc9bb3f5c1cbb2631d704a

        SHA256

        4f59dca19ba2399323d8ab13b7b3493b3f651b94ed732edacf5260340dad267f

        SHA512

        2281d3ce0c7450c926cbaf2baf2f88e4fe4122099f6c4b033e58e28c36213fa260f2d05bd720f5d36f9e3be71b020093e4af0b5d335b7989d23096645e147e6b

        Download Submit

      • C:\Windows\Installer\MSI36AF.tmp
        Filesize

        143KB

        MD5

        84a1cc9540d5cdad74bc54f8090dd27a

        SHA1

        c6f82d1491015457785ae0d365e7196d693d9a6b

        SHA256

        2738720da0b6ce474ca6eb51a92372d047eca2d713c256f0cd6c147ac3a0db21

        SHA512

        9c25d6e7331844d01d732ac923e99c68f305749d92407c873cd09b451e59a8864001e308864fda319fa4a2bcae9dbe50682201c67901dce14272291dedecd2c8

        Download Submit

      • C:\Windows\Installer\MSI3F4D.tmp
        Filesize

        281KB

        MD5

        718222e232d11298dfbabbc2b70d8b14

        SHA1

        89fc560692111c2245694867b8772fd8969f46d2

        SHA256

        45e855461f5d1be28a2f88416603070bd1778055abdd06834ae58e97b7ddf53c

        SHA512

        9191961c28a7a4647ae8f9f9e1956d60b97f5f5c3e4e838d888bf78c1ea665e98e8e3c75cc1247a68a89b2413493ea6d39dbc60827eec919ddba0536d793c801

        Download Submit

      • C:\Windows\Installer\MSIA890.tmp
        Filesize

        225KB

        MD5

        d711da8a6487aea301e05003f327879f

        SHA1

        548d3779ed3ab7309328f174bfb18d7768d27747

        SHA256

        3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

        SHA512

        c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

        Download Submit

      • C:\Windows\System32\CatRoot2\dberr.txt
        Filesize

        135KB

        MD5

        97ef99e0754d97efdd87792712256726

        SHA1

        0b3c37bcb181d1748c3a9a827c6539f94c48611c

        SHA256

        0dd5d4eb138ec1107c30f120fca570cff95b819ac84a4a837327ec3008cfc7ba

        SHA512

        0abb28f796158f1cc84fa44e47a684c6c1f78644d41b6051fb4dee4be3e6ef421fe7ae9cd73b7403d2939da0681b285a653b28dfb8a6bb72449b1fd3936fc527

        Download Submit

      • C:\Windows\Temp\3C44D9~1\tap0901.cat
        Filesize

        11KB

        MD5

        71ecece58bb00bdc1e728ee28d7a5332

        SHA1

        4305889415cf95662a30d024f1138f1af224cf42

        SHA256

        ee062e5ef2743ceab10c64830e4cefe52e35cc1ece85947ac4e61ddd1c0b05f7

        SHA512

        9b23404d867fc4fd7c7beeba3768e8fed3113cc7430ec1bc9ca7faf6e6105388de7057b1402f9b4ba8fbc11e5fcd3afe14233721e8d15b6c0bed40f65aa5b58b

        Download Submit

      • C:\Windows\Temp\3C44D9~1\tap0901.sys
        Filesize

        40KB

        MD5

        1bb9772a05517e227d1dafd3936e8f66

        SHA1

        d695ca5791a4b6a3509939aebdfaf5e229c6fbcf

        SHA256

        581dcaace05d5c1ac9512457ff50565aca5d904d2c209bd3fc369ca4d4a0d2b1

        SHA512

        3f1966038f91b887fe1a71474929bd87f3c75091846c6e9563f7424d3a7c19c908f1d874895341c61a868a616aba637e3d4188d4ebb7383087886a13a4dc0aa2

        Download Submit

      • C:\Windows\Temp\3c44d95b385823c5417ed89f37147c3c1f8d223d6fb66ad59b9424192fa6b728\OemVista.inf
        Filesize

        7KB

        MD5

        6f5ffb58a9e406ab1643c890e2a198c6

        SHA1

        3ff1faba00ac18a93e88a6f2bbfa747c9fdc7e0c

        SHA256

        1327ab3a8c50691f04bea8e2ca356c5b604092a719e219464f8cc4b42e192de9

        SHA512

        af29bc13cc02238208c51e4e95dd0a4445a952755635a9eab38aa77a5c087cc8e2025af55d8f3a0e9f2430baa91534e7f892bb71aa0ef72bab4483211a845b4b

        Download Submit

      • C:\Windows\Temp\{9721FD40-41D4-4D85-A4FC-E8BD146EC557}\.cr\NetRuntimeInstaller86.exe
        Filesize

        610KB

        MD5

        c11e43cbff11161bd30606b34ec53b5a

        SHA1

        4777d18990281636207fac89d6d1023a5195d21d

        SHA256

        4b159537e29c9ea644c91a4ebf0724b43a8b1b1e70d23445f28cdf6a3154650d

        SHA512

        43451b66da1fb53b6f8441ca7789564c86665f57682b5bd85f68ce8232b654aa66dcd397ec8412e38ef75ada11e49a139815ee4e787c90e7ad0212676a439894

        Download Submit

      • C:\Windows\Temp\{DF8BD840-0833-4E1B-ADB5-49602CB0B595}\.ba\bg.png
        Filesize

        4KB

        MD5

        9eb0320dfbf2bd541e6a55c01ddc9f20

        SHA1

        eb282a66d29594346531b1ff886d455e1dcd6d99

        SHA256

        9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

        SHA512

        9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

        Download Submit

      • C:\Windows\Temp\{DF8BD840-0833-4E1B-ADB5-49602CB0B595}\.ba\wixstdba.dll
        Filesize

        197KB

        MD5

        4356ee50f0b1a878e270614780ddf095

        SHA1

        b5c0915f023b2e4ed3e122322abc40c4437909af

        SHA256

        41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104

        SHA512

        b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

        Download Submit

      • C:\Windows\Temp\{DF8BD840-0833-4E1B-ADB5-49602CB0B595}\dotnet_host_6.0.26_win_x86.msi
        Filesize

        728KB

        MD5

        7f625c16c646e9c4fc03610f092b1cc9

        SHA1

        51669a0bbed00dc661b7584b63a56934ca15fcdd

        SHA256

        d148f17d0c1625155fc05ac4a273e261edaa78df75ca122776f263bb71aad540

        SHA512

        77915ea1873478673fc15817926d3c8b87141905b55aa13354bfe1164704977814f10162b177b0b18015ccda0f62dd468f402dc88db15cba50028e6465913a09

        Download Submit

      • C:\Windows\Temp\{DF8BD840-0833-4E1B-ADB5-49602CB0B595}\dotnet_hostfxr_6.0.26_win_x86.msi
        Filesize

        784KB

        MD5

        bd192fa5306676cc76b6614f8dae788f

        SHA1

        20541b76e5ca99eb7919558d6683bf09a2019d64

        SHA256

        e8b0f834fb360438e0c5cad96ff2f54b95a2be98eaf99f2a2c31f3da27b2e608

        SHA512

        9a3b0bbc50cc4278409347d133cfdfe8f251e6627e533b669d740511c4527c3ecffc5cb2e76f46792fcb64b124c4b0115d9551968f7796431e4ef275705adabe

        Download Submit

      • C:\Windows\Temp\{DF8BD840-0833-4E1B-ADB5-49602CB0B595}\dotnet_runtime_6.0.26_win_x86.msi
        Filesize

        23.4MB

        MD5

        42d20efa4e8ef7d2bf875acdaac2ce8b

        SHA1

        00e8877ec7d2c357aa5cd3e4118d27d758cb1f4e

        SHA256

        15044c5df80c26cb12a5e39a3939067c1f00378d6c89cd67c93e0a6f36d436ee

        SHA512

        59587686826c3d33859fb34c568ec65d0264ebd9c4bb685c5db9639073161169ebf7b8e6818f42ee569d469588ab10efea265697cd7db6b28922088d15b27741

        Download Submit

      • C:\Windows\Temp\{DF8BD840-0833-4E1B-ADB5-49602CB0B595}\windowsdesktop_runtime_6.0.26_win_x86.msi
        Filesize

        26.0MB

        MD5

        0d8558b91333c2aa2489939e597c06f2

        SHA1

        8e0044c675537c48b8c25d38e9a777ce9b82ad37

        SHA256

        3b6dc59df5d57f9ca457488a96118d310f380dd222ca462f63b3e8593e929973

        SHA512

        9af991dafbf0d593b3278867e11fcb5290102e33c0a565cc783018d75cf85135e05527b22c17e73f97f278879457e44f5ea632b80836446b92c945016b0dd70d

        Download Submit

      • memory/2004-0-0x0000000000B90000-0x0000000000C6F000-memory.dmp

        Filesize

        892KB

        Download

      • memory/2004-15-0x0000000000B90000-0x0000000000C6F000-memory.dmp

        Filesize

        892KB

        Download

      • memory/2004-2-0x0000000000B91000-0x0000000000C39000-memory.dmp

        Filesize

        672KB

        Download

      • memory/2004-1210-0x0000000000B90000-0x0000000000C6F000-memory.dmp

        Filesize

        892KB

        Download

      • memory/2648-16-0x00000000008E0000-0x0000000000C1F000-memory.dmp

        Filesize

        3.2MB

        Download

      • memory/2648-90-0x00000000008E0000-0x0000000000C1F000-memory.dmp

        Filesize

        3.2MB

        Download

      • memory/2648-6-0x00000000008E0000-0x0000000000C1F000-memory.dmp

        Filesize

        3.2MB

        Download

      • memory/2648-997-0x00000000008E0000-0x0000000000C1F000-memory.dmp

        Filesize

        3.2MB

        Download

      • memory/2648-1208-0x00000000008E0000-0x0000000000C1F000-memory.dmp

        Filesize

        3.2MB

        Download