hive | af9e8f301a3677b457345921d7ee765a842eceb7df107714eaffc6193bfc6bbe

Resubmissions

12/02/2024, 06:38

240212-hd166sgg25 10

12/02/2024, 06:21

240212-g4tdksgd86 7

Analysis

max time kernel
346s
max time network
333s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hive.exe
Size

764KB
MD5

2f9fc82898d718f2abe99c4a6fa79e69
SHA1

9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb
SHA256

88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1
SHA512

19f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b
SSDEEP

12288:CinNFNkY/yU97ppM4NSBG81Np2C9H4S3iDjlLtc4wCIITIQaOI6NrwacVYV+4MsT:CinN3n/y67jM4v4kCSPDjlLtbwt8IQLH

Score

10^/10

hive persistence ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2444714103-3190537498-3629098939-1000\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data is encrypted. To decrypt all the data you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: EQA9oydTxwXS Password: vNtgAgb3kMFmCooANNQr Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.hive files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

URLs

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

Signatures

Detects Go variant of Hive Ransomware 35 IoCs

resource	yara_rule
behavioral7/memory/1948-1-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-2-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-3-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-1017-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-2310-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-3872-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-5493-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-6989-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-8292-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-9241-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-10839-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-12862-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-14495-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-15570-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-16095-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-16477-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-16916-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-17208-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-17306-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-17323-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-17324-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-17325-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-17326-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-17327-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-17328-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-17329-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-17330-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-17331-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-17332-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-17333-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-17334-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-17335-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-17336-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-17337-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go
behavioral7/memory/1948-17338-0x0000000000320000-0x0000000000583000-memory.dmp	hive_go

Hive
A ransomware written in Golang first seen in June 2021.
ransomware hive
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Drops file in Drivers directory 28 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\UMDF\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\it-IT\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\it-IT\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt	hive.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Active Setup\Installed Components	Explorer.EXE

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	hive.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.62LzfBFwy5_st0N1czn1I8bwKjKnQeUXFaZsO89Fg3k.hive	hive.exe

Loads dropped DLL 1 IoCs

pid	Process
1272	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 36 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral7/memory/1948-0-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-1-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-2-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-3-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-1017-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-2310-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-3872-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-5493-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-6989-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-8292-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-9241-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-10839-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-12862-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-14495-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-15570-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-16095-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-16477-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-16916-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-17208-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-17306-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-17323-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-17324-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-17325-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-17326-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-17327-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-17328-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-17329-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-17330-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-17331-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-17332-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-17333-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-17334-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-17335-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-17336-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-17337-0x0000000000320000-0x0000000000583000-memory.dmp	upx
behavioral7/memory/1948-17338-0x0000000000320000-0x0000000000583000-memory.dmp	upx

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NIZQ7UCC\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	hive.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\592Q329J\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\C8HX303O\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\desktop.ini	hive.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	hive.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	hive.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2444714103-3190537498-3629098939-1000\desktop.ini	hive.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	hive.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2444714103-3190537498-3629098939-1000\desktop.ini	hive.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	hive.exe
File opened for modification	C:\Program Files\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\HSCYP491\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	hive.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	hive.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AGBX5AXM\desktop.ini	hive.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\EnterpriseN\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx002.inf_amd64_neutral_12563574abbc36eb\Amd64\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnts003.inf_amd64_neutral_33a68664c7e7ae4b\Amd64\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-RasConnectionManager\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\slmgr\0410\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\MUI\0410\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsonyu.inf_amd64_neutral_45152a8a9362fb82\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\en-US\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\it-IT\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomeBasicN\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\ProfessionalN\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\slmgr\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\Professional\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdsi.inf_amd64_neutral_e77f438012239042\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cxfalpal_ibv64.inf_amd64_neutral_4c42ac5f00413365\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\wbem\Repository\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-COM-ComPlus-Setup-DL\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wiabr005.inf_amd64_neutral_e14a0514f37611d8\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\Setup\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\InstallShield\setupdir\0404\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-NetworkLoadBalancing-Core\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\HomeBasicN\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\pt-PT\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ph3xibc12.inf_amd64_neutral_ff7295ba5a46d63f\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\com\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\es\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx00x.inf_amd64_neutral_808baf4e08594a59\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\InstallShield\setupdir\0008\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\Dism\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnsv002.inf_amd64_neutral_6ca80563d6148ee5\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\smartcrd.inf_amd64_neutral_6fb75ea318f84fe5\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-DHCPServerMigPlugin-DL\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\migwiz\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomePremiumN\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_neutral_4b99fffee061ff26\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\InstallShield\setupdir\0019\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\ProfessionalN\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\migration\it-IT\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttp2.inf_amd64_neutral_d218c42ac8635704\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-Sxs\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\Speech\Engines\SR\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\Microsoft-Windows-TerminalServices-AppServer-Licensing\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky002.inf_amd64_neutral_525d9740c77e325f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\0407\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\UltimateE\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\winrm\0409\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\acpipmi.inf_amd64_neutral_256ad642985694b3\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\replacementmanifests\microsoft-windows-ndis\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomeBasicN\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\fi-FI\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00c.inf_amd64_neutral_510c36849918ce92\Amd64\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\IME\shared\HOW_TO_DECRYPT.txt	hive.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\header.gif	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_OliveGreen.gif.62LzfBFwy5_st0N1czn1I0xmUjaLatxQbBIib6PcUhQ.hive	hive.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198494.WMF	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0304853.WMF	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableUpArrow.jpg	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00444_.WMF.62LzfBFwy5_st0N1czn1I05QZynikF4DC4Weeq2DdFs.hive	hive.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsepia_plugin.dll	hive.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\4.png	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14594_.GIF.62LzfBFwy5_st0N1czn1I9Lo5nggFk9uVCHBtHSSsQ4.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.LTS	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml.62LzfBFwy5_st0N1czn1I6qdMpgTxM4jJNpTalacCh8.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099147.JPG	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART11.BDR	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21375_.GIF.62LzfBFwy5_st0N1czn1I_s78Z_zAScaHVjK95t0tG8.hive	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-io.jar	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml	hive.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Hong_Kong	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLMAIL.FAE	hive.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\MpClient.dll	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21519_.GIF.62LzfBFwy5_st0N1czn1I2U9PhG5umAIQzcl5HiavTQ.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Contacts.accdt.62LzfBFwy5_st0N1czn1I38FL5iIPX1daaT25L1w5wM.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\BOLDSTRI.ELM	hive.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_ar.dll	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\BUTTON.GIF	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15072_.GIF	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH02312_.WMF.62LzfBFwy5_st0N1czn1I26ZPY9FGdknm7Tdkf73Yh0.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0278882.WMF.62LzfBFwy5_st0N1czn1I4nQnEXg7SIzS4_JcvDwLGo.hive	hive.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	hive.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libsdl_image_plugin.dll	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00110_.WMF	hive.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\gadget.xml	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Beulah.62LzfBFwy5_st0N1czn1I1HRLjuaYbFU0BRCu77h73E.hive	hive.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssLogo.gif	hive.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\wab32.dll	hive.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll	hive.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png	hive.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue.css.62LzfBFwy5_st0N1czn1IzN_S9I53sdynpmrccVAe3g.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\CHICAGO.XSL.62LzfBFwy5_st0N1czn1I-EvcrLItiYv_4quRsp3KCA.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\VIEW.JS.62LzfBFwy5_st0N1czn1I5XswFDzgOAWiZNQr4THhGs.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00443_.WMF.62LzfBFwy5_st0N1czn1I6Pm1x8v4DIAkkpiKOlQ1E0.hive	hive.exe
File opened for modification	C:\Program Files\Microsoft Games\More Games\fr-FR\MoreGames.dll.mui	hive.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\IEShims.dll	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03459_.WMF.62LzfBFwy5_st0N1czn1IzrvpC_s9ZJaXdSylTPaxgM.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HM00172_.WMF	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152622.WMF.62LzfBFwy5_st0N1czn1I956mY-aW1Qrx6SIIaEX7jA.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198020.WMF.62LzfBFwy5_st0N1czn1IyuwZ56iFdIwYcBkmW7-x04.hive	hive.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\chkrzm.exe.mui	hive.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\librecord_plugin.dll.62LzfBFwy5_st0N1czn1I9bCd8zEdwYMKz7HApk_JzU.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00305_.WMF.62LzfBFwy5_st0N1czn1I0ui_60skDYjoWXX_rZ1gg4.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00560_.WMF.62LzfBFwy5_st0N1czn1I_NH-TNK7OUfD2C1KzYGwAI.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14882_.GIF.62LzfBFwy5_st0N1czn1IwFrgtlQloQpE_Sn6tEngiI.hive	hive.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png	hive.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png	hive.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson_Creek.62LzfBFwy5_st0N1czn1I-s6gj5oGuluY3uzXqQ0BGs.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21336_.GIF	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IMPMAIL.DLL	hive.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icucnv36.dll.62LzfBFwy5_st0N1czn1I9ULYmZwL4Uwmaumd74tmSE.hive	hive.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_it_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..nsors-cpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b9a38ba8d2388e95\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..oundation.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e58e99752e5fedc8\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4148_none_5090ab56bcba71c2\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..cemanager.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2c493d3ffdc1b57f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..vault-cpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_239dca64e407b2b3\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..readwrite.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_84c4668f999ca958\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-mmsys.resources_31bf3856ad364e35_6.1.7600.16385_es-es_05e0f79083c8be64\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-wmi-core-wbemcomn-dll_31bf3856ad364e35_6.1.7601.17514_none_6bf5ddbe6e32b8d7\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..core-fonts-kor-boot_31bf3856ad364e35_6.1.7600.16385_none_b6bc71f2aed192c1\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_6.1.7601.17514_it-it_a70891c1bdb79410\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\msil_microsoft.web.administration_31bf3856ad364e35_6.1.7601.17514_none_b8e568fcf0ecd25b\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-0001041e_31bf3856ad364e35_6.1.7600.16385_none_07b962dd9607a472\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-garden_31bf3856ad364e35_6.1.7600.16385_none_f7a4bf1e15863e21\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0dced78afd81a001\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ingfolder.resources_31bf3856ad364e35_6.1.7600.16385_de-de_01bcd843bc8bcdf1\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_blbdrive.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_aaec62abe07cf649\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..gram-data.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3816f30b59c505bd\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_6.1.7601.17514_de-de_a7b16680ef4ac882\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_en-us_649f28cc62d12253\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-r..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2e1883fe7f71255e\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-rmcast.resources_31bf3856ad364e35_6.1.7600.16385_es-es_e73ad640330455a7\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\x86_wcf-m_svc_mod_op_perf_c_reg_31bf3856ad364e35_6.1.7600.16385_none_c795df968dd4991f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-cpu.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d85986ba7e56fda6\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ncsi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_cbff5d2d0ea5cf6e\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..lsservice.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d5f263ceaa730239\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-ipsplugin_31bf3856ad364e35_6.1.7600.16385_none_183763f35905b40c\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-tapicore_31bf3856ad364e35_6.1.7600.16385_none_402eca316047a0fe\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c48c8af135e074d7\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\mcupdate\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7601.17514_en-us_c80cf1d4b4cdf5c2\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-shimgvw.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b44e18ca15a13e96\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sysdm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_1ed9c3fcc95f0507\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Json\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..etcapture.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_bc602b142e418026\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-tvencdec.resources_31bf3856ad364e35_6.1.7600.16385_de-de_fe3653edd43f3533\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_filter_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_622a42c0ffb29a66\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-optionaltsps_31bf3856ad364e35_6.1.7600.16385_none_e1d294682a365d27\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\ehCIR\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_MSIL\system.management.resources\2.0.0.0_it_b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\inf\ASP.NET\0005\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..ywmdmcesp.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ccdf88142b1c0801\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\msil_loadmxf_31bf3856ad364e35_6.1.7600.16385_none_388de5065074b62c\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-netbt.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ddc207bd26e3d91a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..extension.resources_31bf3856ad364e35_6.1.7600.16385_es-es_e023b9032130c1b7\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-class_ss.resources_31bf3856ad364e35_6.1.7600.16385_en-us_9c43114bf49ad2c9\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..ator-base.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f3ccdd13d6997f58\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..ction-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ec0ec9ea68d8a9ae\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_prnbr005.inf_31bf3856ad364e35_6.1.7600.16385_none_4b6471420f8b03d9\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..mentation.resources_31bf3856ad364e35_8.0.7600.16385_de-de_89f072674320b47e\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Tas#\ca72594c581d8024d629f931f0e312d7\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-es-shellextension_31bf3856ad364e35_6.1.7600.16385_none_54f343ff0f64640f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-kernelbase.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d3dd093ad06026e1\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-processmodel.resources_31bf3856ad364e35_6.1.7600.16385_it-it_384de97ba3db38ba\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..yer-setup.resources_31bf3856ad364e35_6.1.7600.16385_de-de_9200888cfd93d5aa\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..enger-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_eca185f03b488843\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_wsdscdrv.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_22e9c9c56eb3c089\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..t-starter.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_54b8783c97704202\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-themecpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8e9c2452af094cbc\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_blbdrive.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f6600b87c2540a15\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_hidserv.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_24b0c9ac523403ae\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..ilerepair.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9e9ed0a57388c0c0\HOW_TO_DECRYPT.txt	hive.exe

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
968	timeout.exe
1964	timeout.exe
2904	timeout.exe
2696	timeout.exe
1964	timeout.exe
2740	timeout.exe
932	timeout.exe
620	timeout.exe
1544	timeout.exe
2164	timeout.exe
1264	timeout.exe
3024	timeout.exe
2268	timeout.exe
2100	timeout.exe
1916	timeout.exe
2164	timeout.exe
2716	timeout.exe
796	timeout.exe
2336	timeout.exe
2264	timeout.exe
2372	timeout.exe
1480	timeout.exe
984	timeout.exe
2964	timeout.exe
2264	timeout.exe
2188	timeout.exe
1544	timeout.exe
2912	timeout.exe
564	timeout.exe
2068	timeout.exe
1152	timeout.exe
796	timeout.exe
396	timeout.exe
940	timeout.exe
1048	timeout.exe
872	timeout.exe
1068	timeout.exe
2856	timeout.exe
1960	timeout.exe
2448	timeout.exe
2196	timeout.exe
2480	timeout.exe
1720	timeout.exe
2688	timeout.exe
1556	timeout.exe
2508	timeout.exe
1524	timeout.exe
824	timeout.exe
1648	timeout.exe
872	timeout.exe
1612	timeout.exe
1048	timeout.exe
2560	timeout.exe
1048	timeout.exe
2452	timeout.exe
1576	timeout.exe
340	timeout.exe
2984	timeout.exe
1968	timeout.exe
2688	timeout.exe
1640	timeout.exe
1220	timeout.exe
1172	timeout.exe
1484	timeout.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1360	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1948	hive.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeBackupPrivilege	1348	vssvc.exe
Token: SeRestorePrivilege	1348	vssvc.exe
Token: SeAuditPrivilege	1348	vssvc.exe
Token: SeShutdownPrivilege	2432	Explorer.EXE
Token: SeShutdownPrivilege	2432	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2736	1948	hive.exe	28
PID 1948 wrote to memory of 2736	1948	hive.exe	28
PID 1948 wrote to memory of 2736	1948	hive.exe	28
PID 1948 wrote to memory of 2736	1948	hive.exe	28
PID 1948 wrote to memory of 2692	1948	hive.exe	29
PID 1948 wrote to memory of 2692	1948	hive.exe	29
PID 1948 wrote to memory of 2692	1948	hive.exe	29
PID 1948 wrote to memory of 2692	1948	hive.exe	29
PID 2736 wrote to memory of 2556	2736	cmd.exe	32
PID 2736 wrote to memory of 2556	2736	cmd.exe	32
PID 2736 wrote to memory of 2556	2736	cmd.exe	32
PID 2736 wrote to memory of 2556	2736	cmd.exe	32
PID 2692 wrote to memory of 1360	2692	cmd.exe	33
PID 2692 wrote to memory of 1360	2692	cmd.exe	33
PID 2692 wrote to memory of 1360	2692	cmd.exe	33
PID 2692 wrote to memory of 1360	2692	cmd.exe	33
PID 2736 wrote to memory of 2188	2736	cmd.exe	35
PID 2736 wrote to memory of 2188	2736	cmd.exe	35
PID 2736 wrote to memory of 2188	2736	cmd.exe	35
PID 2736 wrote to memory of 2188	2736	cmd.exe	35
PID 2736 wrote to memory of 2268	2736	cmd.exe	36
PID 2736 wrote to memory of 2268	2736	cmd.exe	36
PID 2736 wrote to memory of 2268	2736	cmd.exe	36
PID 2736 wrote to memory of 2268	2736	cmd.exe	36
PID 2736 wrote to memory of 2880	2736	cmd.exe	37
PID 2736 wrote to memory of 2880	2736	cmd.exe	37
PID 2736 wrote to memory of 2880	2736	cmd.exe	37
PID 2736 wrote to memory of 2880	2736	cmd.exe	37
PID 2736 wrote to memory of 1964	2736	cmd.exe	38
PID 2736 wrote to memory of 1964	2736	cmd.exe	38
PID 2736 wrote to memory of 1964	2736	cmd.exe	38
PID 2736 wrote to memory of 1964	2736	cmd.exe	38
PID 2736 wrote to memory of 1472	2736	cmd.exe	39
PID 2736 wrote to memory of 1472	2736	cmd.exe	39
PID 2736 wrote to memory of 1472	2736	cmd.exe	39
PID 2736 wrote to memory of 1472	2736	cmd.exe	39
PID 2736 wrote to memory of 2396	2736	cmd.exe	40
PID 2736 wrote to memory of 2396	2736	cmd.exe	40
PID 2736 wrote to memory of 2396	2736	cmd.exe	40
PID 2736 wrote to memory of 2396	2736	cmd.exe	40
PID 2736 wrote to memory of 1604	2736	cmd.exe	41
PID 2736 wrote to memory of 1604	2736	cmd.exe	41
PID 2736 wrote to memory of 1604	2736	cmd.exe	41
PID 2736 wrote to memory of 1604	2736	cmd.exe	41
PID 2736 wrote to memory of 2844	2736	cmd.exe	42
PID 2736 wrote to memory of 2844	2736	cmd.exe	42
PID 2736 wrote to memory of 2844	2736	cmd.exe	42
PID 2736 wrote to memory of 2844	2736	cmd.exe	42
PID 2736 wrote to memory of 2348	2736	cmd.exe	43
PID 2736 wrote to memory of 2348	2736	cmd.exe	43
PID 2736 wrote to memory of 2348	2736	cmd.exe	43
PID 2736 wrote to memory of 2348	2736	cmd.exe	43
PID 2736 wrote to memory of 2772	2736	cmd.exe	44
PID 2736 wrote to memory of 2772	2736	cmd.exe	44
PID 2736 wrote to memory of 2772	2736	cmd.exe	44
PID 2736 wrote to memory of 2772	2736	cmd.exe	44
PID 2736 wrote to memory of 2572	2736	cmd.exe	45
PID 2736 wrote to memory of 2572	2736	cmd.exe	45
PID 2736 wrote to memory of 2572	2736	cmd.exe	45
PID 2736 wrote to memory of 2572	2736	cmd.exe	45
PID 2736 wrote to memory of 2452	2736	cmd.exe	46
PID 2736 wrote to memory of 2452	2736	cmd.exe	46
PID 2736 wrote to memory of 2452	2736	cmd.exe	46
PID 2736 wrote to memory of 2452	2736	cmd.exe	46

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\hive.exe
"C:\Users\Admin\AppData\Local\Temp\hive.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c hive.bat >NUL 2>NUL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2556
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2188
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2268
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2880
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1964
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1472
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2396
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1604
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2844
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2348
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2772
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2572
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2452
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2476
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2896
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:796
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1956
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2572
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1356
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:984
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1620
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:968
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2896
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2848
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2740
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:396
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:916
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2160
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1620
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2560
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1136
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2188
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1576
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1908
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:824
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1056
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2468
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:772
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1796
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1768
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3000
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1780
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1060
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1704
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2336
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2760
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:340
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1600
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:396
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2180
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1288
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2032
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1740
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1612
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2984
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2688
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:744
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2240
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2664
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1340
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:300
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2196
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1556
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2900
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2024
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:472
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1780
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2904
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2284
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1744
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2508
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2756
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:664
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2264
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2812
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:760
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2752
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2584
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2296
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2148
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2716
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:912
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1264
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1448
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:748
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2764
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2508
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2760
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:344
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3024
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2200
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2864
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1360
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1484
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2636
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2148
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2448
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1248
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1048
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1544
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2888
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3004
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1864
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1720
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1048
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2524
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1076
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:284
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1192
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1296
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:332
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:872
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:300
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2236
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2912
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2200
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2040
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2196
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:600
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2536
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2100
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1916
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2944
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2164
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2180
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2112
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1664
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3056
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2716
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2372
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:908
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1100
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1368
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2572
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1492
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1648
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1356
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:320
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1800
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1264
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1044
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2404
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:928
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:876
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3040
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:852
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2576
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1504
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1920
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1744
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2132
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1480
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:772
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1420
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2480
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2160
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1968
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2336
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1312
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2268
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1796
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1456
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1768
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1316
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1248
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1596
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1068
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2168
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2228
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1548
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1288
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:976
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1564
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:872
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2664
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2068
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2484
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2396
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:864
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2560
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2364
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:888
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2696
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2928
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1524
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2720
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2724
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2236
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2800
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2348
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:932
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2596
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1944
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1060
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2808
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2220
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2616
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1072
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1544
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2772
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:308
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1612
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2376
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2948
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1048
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2832
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1644
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:984
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2964
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2200
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:620
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2104
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1152
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2264
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1652
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2020
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2052
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2144
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1640
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:796
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2040
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2208
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2296
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:564
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2440
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2088
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:396
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:968
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2024
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2344
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1912
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:576
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1964
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1076
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1536
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1220
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1172
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2092
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:980
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2316
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2688
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2856
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2556
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1748
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1960
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1512
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1740
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2920
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2940
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2584
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2276
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:600
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1136
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1788
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3004
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:940
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1704
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1040
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1412
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2284
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2164
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2180
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:436
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:992
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3056
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2716
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2512
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1368
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1492
- C:\Windows\SysWOW64\cmd.exe
  cmd /c shadow.bat >NUL 2>NUL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1360

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1348

C:\Windows\Explorer.EXE
"C:\Windows\Explorer.EXE"
1⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2444714103-3190537498-3629098939-1000\HOW_TO_DECRYPT.txt

Filesize
1KB

MD5
80207d0f8ea42bdfeaf9f5c586230aca

SHA1
747481fe2b0b6d81c3b19ba62d1e49eab6a5461f

SHA256
25edefb3b0678dfe0d927ff48ce67254359ba379df9468f634d02c026f0e7131

SHA512
73f68ce9e98d2346be1762bd54bb06ef83ae939dfbcf9b786d9b773fa454352613387d264b7a87a1c08950226553817bf01f5aa4107bc12de36a1689e2137304

Download Submit
C:\$Recycle.Bin\S-1-5-21-2444714103-3190537498-3629098939-1000\desktop.ini

Filesize
129B

MD5
e9b78ea2c26b89128a3627060d8475bd

SHA1
4a3e785516a20596656c27baa2eb5eedd75ef95f

SHA256
7127e48046da761238b17d6fa86106c45de2eb968671c2605b0783a53094658d

SHA512
c94c6df7a76cb7d5d03fbfc0cac6955461e09b6761b0e6f11056fcdb50b9292f0baff17e44f980380d6e4ae9111c07ce3d7ef0bc8be291846b2016d6e2c3c971

Download Submit
C:\Users\Admin\AppData\Local\Temp\hive.bat

Filesize
162B

MD5
fca5799115172398c63263fad7e854b1

SHA1
2874a1c796f511f94bed6ae020f4b20c38c59cf1

SHA256
27323f85f788e124f6024486f7d2a3dee9a1e88f2fc1617625b8612e47657663

SHA512
a03fecd20d94def5ea75015613d40656d85094eb5584993cd2d082b17badeef6833ae214dc1e8058bda0afe29d8a4cd9a805a2519b1ea76f2bc1cdb274a1841b

Download Submit
C:\Users\Admin\AppData\Local\Temp\shadow.bat

Filesize
57B

MD5
df5552357692e0cba5e69f8fbf06abb6

SHA1
4714f1e6bb75a80a8faf69434726d176b70d7bd8

SHA256
d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8

SHA512
a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d

Download Submit
\Program Files\Microsoft Office\Office14\VISSHE.DLL

Filesize
953KB

MD5
2f4759c23abcd639ac3ca7f8fa9480ac

SHA1
9a3fece585fa01b7b941e124ead0c39c8ce9bc7c

SHA256
6d66fa59407862e0fddfcb36472fe810eb308653321ca0e374ac870f9aa8cec6

SHA512
6ab14d6a8d3e9a751d68133e734cc804de2b50a7ef223d484d0f727cdfbd00d48f6e0666c3b86a0daf9ca42c0b726f6c2a088e5bb32c993748abfea7b5904ec6

Download Submit
memory/1948-16095-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-16916-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-2-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-1017-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-2310-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-3872-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-1-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-5493-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-6989-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-8292-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-9241-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-10839-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-12862-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-14495-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-15570-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-0-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-16477-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-3-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-17208-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-17306-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-17323-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-17324-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-17325-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-17326-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-17327-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-17328-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-17329-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-17330-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-17331-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-17332-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-17333-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-17334-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-17335-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-17336-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-17337-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download
memory/1948-17338-0x0000000000320000-0x0000000000583000-memory.dmp

Filesize
2.4MB

Download