Deletes Windows Defender Definitions

Uses mpcmdrun utility to delete all AV definitions.

Hive

A ransomware written in Golang first seen in June 2021.

Modifies Windows Defender Real-time Protection settings

Modifies security service

Clears Windows event logs

Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Modifies boot configuration data using bcdedit

Modifies extensions of user files

Ransomware generally changes the extension on encrypted files.

Stops running service(s)