hive | hxxps://github[.]com/ytisf/theZoo/tree/master/malware/Binaries/Ransomware[.]Hive

Resubmissions

31-05-2024 03:56

240531-ehcgtsfd36 10

31-05-2024 03:37

240531-d6wpyaeh64 10

Analysis

max time kernel
866s
max time network
685s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
31-05-2024 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/ytisf/theZoo/tree/master/malware/Binaries/Ransomware.Hive

Score

10^/10

hive persistence ransomware spyware stealer upx

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-3107365284-1576850094-161165143-1000\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data is encrypted. To decrypt all the data you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: EQA9oydTxwXS Password: vNtgAgb3kMFmCooANNQr Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.hive files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

URLs

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

Signatures

Detects Go variant of Hive Ransomware 17 IoCs

resource	yara_rule
behavioral1/memory/1412-394-0x0000000000B80000-0x0000000000DE3000-memory.dmp	hive_go
behavioral1/memory/1412-2935-0x0000000000B80000-0x0000000000DE3000-memory.dmp	hive_go
behavioral1/memory/1412-3875-0x0000000000B80000-0x0000000000DE3000-memory.dmp	hive_go
behavioral1/memory/1412-5355-0x0000000000B80000-0x0000000000DE3000-memory.dmp	hive_go
behavioral1/memory/1412-7331-0x0000000000B80000-0x0000000000DE3000-memory.dmp	hive_go
behavioral1/memory/1412-10782-0x0000000000B80000-0x0000000000DE3000-memory.dmp	hive_go
behavioral1/memory/1412-16407-0x0000000000B80000-0x0000000000DE3000-memory.dmp	hive_go
behavioral1/memory/1412-19952-0x0000000000B80000-0x0000000000DE3000-memory.dmp	hive_go
behavioral1/memory/1412-21560-0x0000000000B80000-0x0000000000DE3000-memory.dmp	hive_go
behavioral1/memory/1412-21758-0x0000000000B80000-0x0000000000DE3000-memory.dmp	hive_go
behavioral1/memory/1412-22431-0x0000000000B80000-0x0000000000DE3000-memory.dmp	hive_go
behavioral1/memory/1412-22433-0x0000000000B80000-0x0000000000DE3000-memory.dmp	hive_go
behavioral1/memory/1412-22435-0x0000000000B80000-0x0000000000DE3000-memory.dmp	hive_go
behavioral1/memory/1412-22437-0x0000000000B80000-0x0000000000DE3000-memory.dmp	hive_go
behavioral1/memory/1412-22439-0x0000000000B80000-0x0000000000DE3000-memory.dmp	hive_go
behavioral1/memory/1412-22443-0x0000000000B80000-0x0000000000DE3000-memory.dmp	hive_go
behavioral1/memory/1412-22446-0x0000000000B80000-0x0000000000DE3000-memory.dmp	hive_go

Hive
A ransomware written in Golang first seen in June 2021.
ransomware hive

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt	hive.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	hive.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.vlOfMrOJejzP7iy2VuU5AvbrBwSZ66Qyx9VQ83Nz6Gc.hive	hive.exe

Executes dropped EXE 1 IoCs

pid	Process
1412	hive.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 19 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000100000002aac6-391.dat	upx
behavioral1/memory/1412-393-0x0000000000B80000-0x0000000000DE3000-memory.dmp	upx
behavioral1/memory/1412-394-0x0000000000B80000-0x0000000000DE3000-memory.dmp	upx
behavioral1/memory/1412-2935-0x0000000000B80000-0x0000000000DE3000-memory.dmp	upx
behavioral1/memory/1412-3875-0x0000000000B80000-0x0000000000DE3000-memory.dmp	upx
behavioral1/memory/1412-5355-0x0000000000B80000-0x0000000000DE3000-memory.dmp	upx
behavioral1/memory/1412-7331-0x0000000000B80000-0x0000000000DE3000-memory.dmp	upx
behavioral1/memory/1412-10782-0x0000000000B80000-0x0000000000DE3000-memory.dmp	upx
behavioral1/memory/1412-16407-0x0000000000B80000-0x0000000000DE3000-memory.dmp	upx
behavioral1/memory/1412-19952-0x0000000000B80000-0x0000000000DE3000-memory.dmp	upx
behavioral1/memory/1412-21560-0x0000000000B80000-0x0000000000DE3000-memory.dmp	upx
behavioral1/memory/1412-21758-0x0000000000B80000-0x0000000000DE3000-memory.dmp	upx
behavioral1/memory/1412-22431-0x0000000000B80000-0x0000000000DE3000-memory.dmp	upx
behavioral1/memory/1412-22433-0x0000000000B80000-0x0000000000DE3000-memory.dmp	upx
behavioral1/memory/1412-22435-0x0000000000B80000-0x0000000000DE3000-memory.dmp	upx
behavioral1/memory/1412-22437-0x0000000000B80000-0x0000000000DE3000-memory.dmp	upx
behavioral1/memory/1412-22439-0x0000000000B80000-0x0000000000DE3000-memory.dmp	upx
behavioral1/memory/1412-22443-0x0000000000B80000-0x0000000000DE3000-memory.dmp	upx
behavioral1/memory/1412-22446-0x0000000000B80000-0x0000000000DE3000-memory.dmp	upx

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	hive.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3107365284-1576850094-161165143-1000\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	hive.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3107365284-1576850094-161165143-1000\desktop.ini	hive.exe
File opened for modification	C:\Program Files\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	hive.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	hive.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
13	raw.githubusercontent.com
22	raw.githubusercontent.com

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_585900615f764770\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TrustedPlatformModule\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\Msdtc\Trace\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\oobe\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\sru\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bth.inf_amd64_20a41d5e1a37710f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_1f949c30555f4111\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttd6.inf_amd64_7b0f18e4ec78ba07\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmrock3.inf_amd64_1cbcccffedbbc800\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netip6.inf_amd64_35eb4f6b0a600ef7\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\000e\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\NDF\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cht4sx64.inf_amd64_3a69b9b79f49eb50\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hvservice.inf_amd64_5e2bc63840ed1111\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\WindowsOptionalFeatureSet\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TrustedPlatformModule\en-US\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\MailContactsCalendarSync\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\icsxml\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_smartcardfilter.inf_amd64_c840d100dbcb5fa5\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sdbus.inf_amd64_da23a49bbcab6181\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\hr-HR\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpp.inf_amd64_e41f362f35234b0c\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_2299fee965b7e92c\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\IME\SHARED\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\IME\SHARED\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl009.inf_amd64_de3a443a08f67fbf\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms011.inf_amd64_fb34902231ab4844\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\ras\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\InstallShield\setupdir\001e\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Wdac\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\InputMethod\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\000b\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\VpnClient\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_cdrom.inf_amd64_537193982953aefb\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_d34968d7b3e6da21\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_61883.inf_amd64_8f0e03c62595769e\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_dot4.inf_amd64_387087eb20217c33\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmusrf.inf_amd64_9056257dfb9fbaf1\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wave.inf_amd64_0e4ae1f52bb7b0fd\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_09e02e589e7afd83\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\SessionConfig\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0816\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\slmgr\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\acxhdaudiop.inf_amd64_a72f89b4d7876048\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\displayoverride.inf_amd64_2a9c012705b571c0\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmhzel.inf_amd64_6c08d3673a4d55d5\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetTCPIP\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0019\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\Configuration\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bthlcpen.inf_amd64_157f2ba493bc64fa\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_cashdrawer.inf_amd64_19371e7940235ef1\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\whyperkbd.inf_amd64_2ffda32b4e34c47a\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\LogFiles\SAM\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_barcodescanner.inf_amd64_f91bf80944154dc3\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsun1.inf_amd64_de0a77e7d10806be\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\unknown.inf_amd64_8b25be91611870eb\HOW_TO_DECRYPT.txt	hive.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\StoreWideTile.scale-125.png	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms	hive.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\csi.dll.vlOfMrOJejzP7iy2VuU5ApC7l0pf8nR96-JWoGPBE1k.hive	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms.vlOfMrOJejzP7iy2VuU5AsGBP7vnRcFyjZza9q2fR1E.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.vlOfMrOJejzP7iy2VuU5Ap1USt-CEkV2b1Cv4HET7UU.hive	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\core_icons_retina.png	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNBI.TTF	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEWDAT.DLL	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\BadgeLogo.scale-100.png	hive.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-80.png	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ppd.xrm-ms.vlOfMrOJejzP7iy2VuU5AlQQzML5YjVQoveM8qjNXnw.hive	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\contrast-black\MicrosoftSolitaireAppList.targetsize-20_altform-unplated_contrast-black.png	hive.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-commonjs\colors\FluentColors.js	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\icons_ie8.gif	hive.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nss3.dll	hive.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx	hive.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.vlOfMrOJejzP7iy2VuU5AjTmMurFy1sHrw_Aa5P4gQs.hive	hive.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.vlOfMrOJejzP7iy2VuU5ArjUifU0aVYZf-DN4pjlF3g.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\mi.pak.DATA.vlOfMrOJejzP7iy2VuU5AkRIVEbs__FsGD_5qzRhxSo.hive	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\NotepadMedTile.scale-100.png	hive.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.vlOfMrOJejzP7iy2VuU5AheOaHla-lJP_6t9ylXcQyg.hive	hive.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\eu-es\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-oob.xrm-ms	hive.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-30.png	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_field_grabber.png	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\ui-strings.js.vlOfMrOJejzP7iy2VuU5Au78PG8v1gVAoxFQsxUPywU.hive	hive.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\vlc.mo	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\contrast-black\CameraAppList.targetsize-36.png	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.vlOfMrOJejzP7iy2VuU5AnjgINyWoL1Hl0WoS_Po0k8.hive	hive.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-60_altform-unplated_contrast-white.png	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-30_altform-unplated.png	hive.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ru-ru\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-ae\ui-strings.js	hive.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\mip_upe_sdk.dll	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ko-kr\ui-strings.js.vlOfMrOJejzP7iy2VuU5AgbTYrM3dUxaK_2F3b0zTg8.hive	hive.exe
File opened for modification	C:\Program Files\Internet Explorer\SIGNUP\install.ins.vlOfMrOJejzP7iy2VuU5AoAurr95Gmko_ib4dwOs4h8.hive	hive.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-200_8wekyb3d8bbwe\microsoft.system.package.metadata\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\msipc.dll.mui	hive.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\vlc.mo.vlOfMrOJejzP7iy2VuU5ArhyJPVZAcp5X0UTCpZ5eWI.hive	hive.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Staging.DATA.vlOfMrOJejzP7iy2VuU5Ao8NvY4E-ZAAks599FuLpxM.hive	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\BHOINTL.DLL	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadAppList.targetsize-64.png	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons.png.vlOfMrOJejzP7iy2VuU5AioZ87c0bqkTRqR3ofZKv3Y.hive	hive.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\KeytipData.js	hive.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\DetailsList\DetailsList.js	hive.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\SnipSketchAppList.targetsize-72.png	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-200_contrast-high.png	hive.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\EmptyShare.scale-200.png	hive.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationCore.resources.dll.vlOfMrOJejzP7iy2VuU5AsC_tmT3VqpNYNCdODEq8Fc.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ro.pak.vlOfMrOJejzP7iy2VuU5AsQ3K4iATDAB50gI0sdi5xY.hive	hive.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\HOW_TO_DECRYPT.txt	hive.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..osoftedge.appxsetup_31bf3856ad364e35_10.0.22000.120_none_9eafd2645eb61c89\f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..restartup-baaupdate_31bf3856ad364e35_10.0.22000.1_none_8c926432d7f125a8\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\webapps\guidedsetup\network\static\media\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.22000.184_hu-hu_5d9cbeab76f6f9b0\r\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..ertca-dll.resources_31bf3856ad364e35_10.0.22000.1_en-us_c463646824844254\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-quickassist.resources_31bf3856ad364e35_10.0.22000.1_ru-ru_a1b231461f3dd150\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\msil_system.drawing_b03f5f7f11d50a3a_10.0.22000.1_none_2c5d036daf734abe\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_hyperv-gpupvdev_31bf3856ad364e35_10.0.22000.1_none_8e1e63b77ebab2b3\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.22000.348_de-de_15c9ef6203ebfa4a\f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-l..-oem-core.resources_31bf3856ad364e35_10.0.22000.493_ru-ru_de5cdd9e8320ae24\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondocuments_31bf3856ad364e35_10.0.22000.1_none_a514e307ccfabd4f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-m..nents-mdac-msdadiag_31bf3856ad364e35_10.0.22000.120_none_64563f2eebc82cde\f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.22000.1_none_7aa4e433ee022a53\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-o..t-storage.resources_31bf3856ad364e35_10.0.22000.184_it-it_3af2f88564a458c4\f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\microsoft.system.package.metadata\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_bthleenum.inf.resources_31bf3856ad364e35_10.0.22000.1_en-us_d28ce041e31ba5d3\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-font-truetype-segoeui_31bf3856ad364e35_10.0.22000.348_none_cc139adb97732b18\f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\webapps\guidedsetup\network\area-content\hu-HU\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-l..terprises.resources_31bf3856ad364e35_10.0.22000.493_uk-ua_e61d669495beeed9\f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..owser-configuration_31bf3856ad364e35_10.0.22000.1_none_21144404cb7f86c7\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.22000.318_none_dd70b996410d75fc\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..nt-xpsrasterservice_31bf3856ad364e35_10.0.22000.1_none_70e0faa730ca1259\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lsa.resources_31bf3856ad364e35_10.0.22000.434_fr-ca_1cff594b139ebdde\f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-web-app-host.resources_31bf3856ad364e35_10.0.22000.348_ja-jp_ccca1296de025445\f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-updatepolicy.resources_31bf3856ad364e35_10.0.22000.184_en-gb_eb4b310d0ff4b0c3\f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_10.0.22000.184_pt-br_0d0bba729a111758\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization.Design\v4.0_4.0.0.0__31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..tprovision-joinutil_31bf3856ad364e35_10.0.22000.434_none_7081aaef055d747c\f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host.resources_31bf3856ad364e35_10.0.22000.348_sr-..-rs_2123c66ba8263acf\r\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wow64-console_31bf3856ad364e35_10.0.22000.37_none_2c6fda2e62b12b40\r\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.22000.1_lt-lt_fad860564d2e0824\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.22000.120_none_f759261c81fa2ed8\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..component.resources_31bf3856ad364e35_10.0.22000.120_es-mx_7ee2d2993d8f388c\f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\INF\.NETFramework\0000\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\css\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Assets\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-l..efault-professional_31bf3856ad364e35_10.0.22000.318_none_3a44d356a9ef4894\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-l..erprisesn.resources_31bf3856ad364e35_10.0.22000.493_fr-ca_b65fa791a0ef7a7e\f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-a..l-appexecutionalias_31bf3856ad364e35_10.0.22000.120_none_f3ec2ca4acabc2d6\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_system.security.cryptography.csp_b03f5f7f11d50a3a_4.0.15806.0_none_1bf5f2713f47a39b\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-l..skcleanup.resources_31bf3856ad364e35_10.0.22000.348_lt-lt_62442cbe9e749768\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\f\FileExplorerExtensions\Assets\images\contrast-standard\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.22000.434_none_f949c91148399a9c\f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\wow64_microsoft.packagema..ement.coreproviders_31bf3856ad364e35_10.0.22000.1_none_66f7ce500130ecb2\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-oobe-machine-dui_31bf3856ad364e35_10.0.22000.65_none_c2ef6c9b1f529242\f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..dminflows.resources_31bf3856ad364e35_10.0.22000.184_gl-es_4383ae9619384c1d\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\INF\PNRPSvc\0409\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..oryservices-ntdsapi_31bf3856ad364e35_10.0.22000.1_none_2520e40bf5ff6447\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_10.0.22000.1_en-us_a9affc7820a6df13\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-m..ac-ado-ddl-security_31bf3856ad364e35_10.0.22000.65_none_9e97875090b54d08\f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..ement-adm.resources_31bf3856ad364e35_10.0.22000.1_en-us_570672a06e86fdc0\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\x86_netfx4-aspnet_webadmin_users_res_b03f5f7f11d50a3a_4.0.15806.0_none_2591a32e20552651\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-fax-mapi_31bf3856ad364e35_10.0.22000.376_none_5529d598319900fb\f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\msil_system.workflow.runtime_31bf3856ad364e35_10.0.22000.1_none_d24428800bc8821c\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_dual_wvkrnlintvsc.inf_31bf3856ad364e35_10.0.22000.1_none_4a23ffe30f7c6e67\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_system.io.isolatedstorage_b03f5f7f11d50a3a_4.0.15806.0_none_9d921c314e9b9bf9\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_windows-media-speech-winrt.resources_31bf3856ad364e35_10.0.22000.348_pt-pt_61e7f1d085fd1e45\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.FileSystem.Primitives\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-aclui_31bf3856ad364e35_10.0.22000.1_none_b5a2a615ecd09027\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..mmandline.resources_31bf3856ad364e35_10.0.22000.1_en-us_18490792533d5648\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-es-shellextension_31bf3856ad364e35_10.0.22000.1_none_4f41effdfa7c70d8\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-g..enhancementoverride_31bf3856ad364e35_10.0.22000.469_none_2b976f248f746ee7\r\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..cardsubsystemclient_31bf3856ad364e35_10.0.22000.1_none_6f2817e97e624bef\HOW_TO_DECRYPT.txt	hive.exe

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
1836	timeout.exe
1180	timeout.exe
3172	timeout.exe
3504	timeout.exe
3660	timeout.exe
4688	timeout.exe
2364	timeout.exe
3628	timeout.exe
2384	timeout.exe
4500	timeout.exe
4208	timeout.exe
180	timeout.exe
2248	timeout.exe
3340	timeout.exe
3900	timeout.exe
3996	timeout.exe
1668	timeout.exe
952	timeout.exe
3184	timeout.exe
4160	timeout.exe
644	timeout.exe
1108	timeout.exe
4032	timeout.exe
4440	timeout.exe
1588	timeout.exe
3692	timeout.exe
4580	timeout.exe
4868	timeout.exe
3116	timeout.exe
3040	timeout.exe
1096	timeout.exe
4444	timeout.exe
4180	timeout.exe
2008	timeout.exe
4808	timeout.exe
4960	timeout.exe
1052	timeout.exe
1100	timeout.exe
2520	timeout.exe
1216	timeout.exe
5072	timeout.exe
2304	timeout.exe
888	timeout.exe
2672	timeout.exe
748	timeout.exe
3388	timeout.exe
4012	timeout.exe
4980	timeout.exe
4044	timeout.exe
124	timeout.exe
1772	timeout.exe
2584	timeout.exe
4920	timeout.exe
4924	timeout.exe
1912	timeout.exe
1656	timeout.exe
2280	timeout.exe
3476	timeout.exe
1460	timeout.exe
5008	timeout.exe
4976	timeout.exe
3300	timeout.exe
4892	timeout.exe
4104	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133616004380164970"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3107365284-1576850094-161165143-1000\{4C473410-88D1-4A13-814D-4ED793CE3F5C}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Ransomware.Hive.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4880	chrome.exe
4880	chrome.exe
4524	chrome.exe
4524	chrome.exe
1412	hive.exe
1412	hive.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3680	7zFM.exe
1452	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4880	chrome.exe
4880	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
1656	7zG.exe
4880	chrome.exe
3036	explorer.exe
3036	explorer.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe
3036	explorer.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe
1452	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 1240	4880	chrome.exe	77
PID 4880 wrote to memory of 1240	4880	chrome.exe	77
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 1416	4880	chrome.exe	78
PID 4880 wrote to memory of 2348	4880	chrome.exe	79
PID 4880 wrote to memory of 2348	4880	chrome.exe	79
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80
PID 4880 wrote to memory of 2840	4880	chrome.exe	80

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/ytisf/theZoo/tree/master/malware/Binaries/Ransomware.Hive
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdb43fab58,0x7ffdb43fab68,0x7ffdb43fab78
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1924,i,5192054558039533984,2057696779585655966,131072 /prefetch:2
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1848 --field-trial-handle=1924,i,5192054558039533984,2057696779585655966,131072 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1860 --field-trial-handle=1924,i,5192054558039533984,2057696779585655966,131072 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2988 --field-trial-handle=1924,i,5192054558039533984,2057696779585655966,131072 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1924,i,5192054558039533984,2057696779585655966,131072 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4160 --field-trial-handle=1924,i,5192054558039533984,2057696779585655966,131072 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4276 --field-trial-handle=1924,i,5192054558039533984,2057696779585655966,131072 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 --field-trial-handle=1924,i,5192054558039533984,2057696779585655966,131072 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4396 --field-trial-handle=1924,i,5192054558039533984,2057696779585655966,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1924,i,5192054558039533984,2057696779585655966,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4524

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4524

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2352

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3680
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Ransomware.Hive\" -ad -an -ai#7zMap12472:92:7zEvent22474
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:1656

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1452

C:\Users\Admin\Downloads\Ransomware.Hive\hive.exe
"C:\Users\Admin\Downloads\Ransomware.Hive\hive.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c hive.bat >NUL 2>NUL
  2⤵
  PID:4684
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1480
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3388
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4680
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2280
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4876
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4580
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2008
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:124
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4492
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2992
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4868
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4664
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3476
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1464
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4348
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3184
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4012
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4892
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3116
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4160
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4576
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4808
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4980
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:644
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3476
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3900
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3568
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4104
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:5008
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3752
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3216
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1920
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4800
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4960
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2384
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2556
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1312
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3476
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2248
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2468
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1840
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1100
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2228
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4500
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4688
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2008
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1108
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:888
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2364
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2520
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4800
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1216
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2528
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2448
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1668
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4204
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:5072
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3628
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2392
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1260
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1228
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2024
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3340
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1460
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1100
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3040
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1004
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2632
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:952
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4172
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4976
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4032
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2672
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4208
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3060
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2752
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3900
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4252
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3660
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:756
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1460
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3996
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:748
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1772
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3300
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2876
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:244
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:824
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:180
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2912
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1052
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3600
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3172
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:880
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4152
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:5008
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4840
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2584
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:712
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3688
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2440
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4440
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2040
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1836
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4672
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4924
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2056
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4920
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4444
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3100
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2452
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3420
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:932
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1588
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4936
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1912
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1312
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3692
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2260
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3116
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1604
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3936
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1096
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4180
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1040
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3504
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1656
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4968
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3004
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3144
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1180
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1264
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4720
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:964
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4044
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2304
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4508
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c shadow.bat >NUL 2>NUL
  2⤵
  PID:2792

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3107365284-1576850094-161165143-1000\desktop.ini

Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
28218d0dbd6955863ae306dd3af6123a

SHA1
3625cef58a442c0afa5ce9b6adc3005894680c0f

SHA256
4cfb159bafe6b0facf7e353c10c49de5acb9c4de71d2693ef060a0b5a7a7278c

SHA512
cac3470a175294932fa7f629074313ae11579a148b99090ae88980f0fb2c68a98d515bae8e13450bc8977ae387b797539d41350f1dc6a269bb0f43a64e5eccac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
46c45729926856b84d98642ef7802f4c

SHA1
a70299491314eda9531615a621f7414b61c2df6d

SHA256
aaa212d9a329b6850e063a4d77901f249467c62a323813d09c2955dbf858a0ce

SHA512
ad6c0b7cb731cb62cad66c34aab67fb220f49e84332c5ef0801805b5169cefe88b994042f47cf229c44af0d6a864eacbc99e08f5002494d88b5912c48dd733bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
83c75d947971d3c01f266b967e1f6a2f

SHA1
f49b7cfa114f0ba726dbfc84ae074c28cd54987a

SHA256
f6572873ee23e63d559fabd94518927a67c95fc3b60dc39b06ebfb82f950388c

SHA512
2ddbb2c361e0552e7a6f7d02bc4a407f7f8a1de9d6937d6dc8d4a1a63020023a55d1e7bd086b312622aa330de83ffe235538114ece4c1856fa42810a2caf2de8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
3e1ede9f447a2d13d7929f3281c4df23

SHA1
2875cac25a17227e7229e54f82a5ff8ecd4e43bb

SHA256
3c253558a9855ca1a6a629e38d2c80b78b1ac25200d04fe2e3fa29b6ae89dd78

SHA512
27cba97e25f08ea2081e6e7ff1998836bcb162d865b9a27ee970b1d3140d5c35437e2cac5e937571bda1bc3989408cbcbdd4a3d4628f68e42e172905b658d3f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
9488ed8917ae093e8adf11449e9a5ab7

SHA1
64b5290424f74d3951cbe7598f378e63dce16810

SHA256
f9eb0075c391c9eca283963e5ea8d5628f9593dcf188d3e4e75cba45c9316507

SHA512
20f938e574fc9ca586f8ce30cfb3639eb016d23189b44b550d84c7b47b308f687333d90448fe74672b5eb273cb959b40e8196731317d61d47e1e61f2e8cf66bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
20KB

MD5
357b4145c3264fe69f8c412e823adeed

SHA1
5fcaf1043bb72dbc719ce56a173b3da59db7ebc9

SHA256
4bf695f9d9be4d4e815594d2b7443042ec14e4dcbaa6d35031cc0420b8009410

SHA512
974c8b0220e6490324f5eda5590d4a895d7d67b87414ca1124dd01ac92e3bec033623bec67b4441fd6b69bb9034d4ee8210ee0f92fdf0a8efb6546e62ef8f7fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
48KB

MD5
0f2b395cc63db1bd8a5d093e558cbdd1

SHA1
833d0657cb836d456c251473ed16dfb7d25e6ebe

SHA256
f3797115dd01a366cce0fbd7e6148b79559767164d2aa584b042d10f1ffd926d

SHA512
e8a4ada76efb453c77a38d25d2bbd3a7f03df27b85e26ba231791d65d286fe654c024b64f9d6869824db5d1cf59e4d4eb662f5a55c326e5e249144ae1a66b798

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

Filesize
44KB

MD5
d732347f6815841f0e06ed29eb4feb85

SHA1
fb48ed60e0118c282068d2ac773eff8cfd563f44

SHA256
b808d430644948438edb4d2db5b36d82ba3b095c2cf9829278ac22f3c5c217f6

SHA512
4ec3ede25fe4ba2e1c6bbc0ec620dc06387dcbd28fccd15e91c144e4afe49ee06e28246943c3ac2d4a81c9b9243f6aa7bb60792306fbb8d3905d738b3ee17b22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
25KB

MD5
6fc61a5ec487c61871fdf93b525cb6b7

SHA1
207aa49b68aa64b41aaad80e79bb911815113801

SHA256
b56579a6b89026425b1b4e115d9236981b164c57f0671a7cc185bc081f843101

SHA512
dbf447f27ef7254a0bc4beb5da73c229a7cb7a99042bf1ca833590b51c050e9730064e2b6d64e0ac67b837f9c08cb6638087d438ff9e1769868201c001e83f66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a

Filesize
20KB

MD5
0f3de113dc536643a187f641efae47f4

SHA1
729e48891d13fb7581697f5fee8175f60519615e

SHA256
9bef33945e76bc0012cdbd9941eab34f9472aca8e0ddbbaea52658423dc579f8

SHA512
8332bf7bd97ec1ebfc8e7fcf75132ca3f6dfd820863f2559ab22ac867aa882921f2b208ab76a6deb2e6fa2907bb0244851023af6c9960a77d3ad4101b314797f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

Filesize
21KB

MD5
c355eafacb45a36e6f6d6dbd52b55b95

SHA1
2016f7f6ab53f96e21204b4dee24a9b8156f5283

SHA256
2dbe980b7a73c9d1cc2779423ae78b1e4521732934c87a29ef5141deb8e436f7

SHA512
0cc5cfcad9659b6d2bdf9f28563905acf3cce6d2a9c3ca7b07d15a2700aeabaa162ec0cf9cc04ee86983470924d5502b4d4ea0e74e00eb31e523f463ba025dee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

Filesize
65KB

MD5
98dacda0e5963458ebc5e1eaf24fc8bf

SHA1
7e806b57843268dd74d704db9170dd2b46603afa

SHA256
a114ae14eb4aef4aed440fe33d9451670164f0090c4717db5c49f64c6e99272b

SHA512
5dac472b86d19a61a63444a94b3c081d9282a5e7851e357aa0d627ec7a75ea4999b8610473a2928b73c93643797d46f0a84edf36f4903839768fc6363002af9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

Filesize
59KB

MD5
4bc7fdb1eed64d29f27a427feea007b5

SHA1
62b5f0e1731484517796e3d512c5529d0af2666b

SHA256
05282cd78e71a5d9d14cc9676e20900a1d802016b721a48febec7b64e63775f6

SHA512
9900aecac98f2ca3d642a153dd5a53131b23ceec71dd9d3c59e83db24796a0db854f49629449a5c9fe4b7ca3afcdd294086f6b1ba724955551b622bc50e3ba1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

Filesize
21KB

MD5
b0e31ea842de3ba057c3995e64bc60ec

SHA1
a7f2b2eabda48324df35f69b72a4a2e4fe374bc1

SHA256
b7dd086912ba39cb4e7fab3290ddbade1d4ec77309a96f0f9738c9826406bc84

SHA512
8629ad7c4464586ff3b5141e1e5c58701d11f744b2a36852269fe0195109d6d6d3ee2d47c636939a6a2b20664ac0697a8e422eaaa3b5f512d472890e94a598e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

Filesize
150KB

MD5
0b1dfab8142eadfeffb0a3efd0067e64

SHA1
219f95edd8b49ec2ba7aa5f8984a273cdaf50e6c

SHA256
8e2ee8d51cfcc41a6a3bfa07361573142d949903c29f75de5b4d68f81a1ae954

SHA512
6d1104fd4cfe086a55a0dd3104c44c4dba9b7f01e2d620804cf62c3753a74c56b5eae4c1dc87c74664e44f58a966ba10600de74fb5557b3c6c438e52cc4decdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

Filesize
85KB

MD5
93eff374ce4c9df594680f7ab3cf81d7

SHA1
2f78f384ba77349897dc38c5ad25a2f20e4dcadd

SHA256
f59e8acb0d07095b6d5dbb3b0dacea3857c7e6302578080cda0a94b257c5efaa

SHA512
958f41fe85623821f5b9169aa5bbe25bdebfadbb9f4ad3edd8c04371863ddd98cb1b55392d61cb7fb31a379a897bb31aabcc5bc092f60abc2eb569cb3f1f2ac6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

Filesize
20KB

MD5
8e7b638bfec7451db22d5f6d54662360

SHA1
22c4f81a1216d4b1b48b5f66bbe6aeb7c7bee595

SHA256
9ca11ec635e88ea63b7ba633594f5323cfb61ee4499c42b90f3d9968accffc6e

SHA512
024db23141f04f898cb434c7624d23265c3c1dd702f15e40b793060f38cd4be3416bafdee02a72027e41dd2c5fba47ae8765a0e62c17665e8287eb782eed1373

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\031e6654100ed80c_0

Filesize
318B

MD5
04645c75989812197753c73ca10197d6

SHA1
4f48a8af3d7e905552caa536aadc08a2e01daf0c

SHA256
71e8c281d1bdeddcb838bfccd0d52d504812e00cd6d8ab6fbdfa7d9a39c64617

SHA512
028eeb82641dbf3c203bd2cda04ddefbb69a55c41df176141ee5a3528171fea2cc5bd06ebe6a07be49e75e88d731c1dfc2ae54e6b84ede86388c51b92f3e754e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\03adc57d961bc26b_0

Filesize
278B

MD5
a253d747aeb8810bb12dfe0bed4cd5a8

SHA1
dc5e7f89c11ae234b41cf85420ee227208de414b

SHA256
95460e2d0d40a8e38af7fd77c0817ca7bff2647146481e346f8938e0523d832b

SHA512
f3d04d3e1c145d864a62c5e09c61767f5baf16e93561b3c74e43b8ed4f81552db11f6f769014b1184bcdc152ba858a1bc65d355531ecaedc03c80122970f9304

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\05f98f3e8d436ff0_0

Filesize
221B

MD5
ef5e33bf9a358e2557620b23a9499601

SHA1
1dd339875a119ee2f8e8fadf62dbbbb196259414

SHA256
20e79d08e1d570125300677bd7de7e5f5b3ada22db48bf6bad31e6aab6e9b867

SHA512
198e4a80933a3c771a1a1ef69bc859f48e0887bec45a5d54939f55114fa37585d2631689d176a847b2175b618d90ea9440a265209568f0e63a9e1d10f572432a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\070b60e043709c21_0

Filesize
312B

MD5
ebbc65d9e55aa338a0d50722fe447337

SHA1
0a9e52843adacbc70c491ee73cf96c505e492e43

SHA256
959f584c717f65b9606d6f7c36820fbb9a4b405bdcb66ad6a7fe0e4d42241e23

SHA512
32316aa10e987bc67ef4ee4a5ebc91bfb4b12fc6737eac9392074ba678717df3fb8510b4374a13735ae2c044207d745242dd37f0dab25b09a95cb534434957f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\07a0c4a3e1abceea_0

Filesize
254B

MD5
05330b1c1f476754ea3b3449914306de

SHA1
5864ab8d8fa488a497931a1a8f11e068b9660411

SHA256
f86704ca47aa04b2adf16db075f597f0c2b17e3b0b99eacc75c226016a1b5d33

SHA512
7888f2bf4a259d7a94bc083408793b1cbe230a63352fcf266d434a1f2a053f13481393729fd42c4f7b99d958ad7598fc10ed79ca7e88ea26eecb573e79973c08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0890dc9c8a3fdfa2_0

Filesize
228B

MD5
68fb74a516da06c79c89bac25d8dd6b1

SHA1
000ca555b5cbcd423ac08e1a72d2e9acae039c1a

SHA256
8741707760bf18e23ba7be96dcce641f321ef4524df444cb193c3d5944294834

SHA512
43dcd7f47d66d1af2b6180abdfb0de4a406634442db0cb6b3f80f648fd62e449ab99d6479758e39b01d82ba9efbabc7d5f18a5515f3514055d2d857438986cae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0cac38a50a5fa198_0

Filesize
312B

MD5
f416040fbc4e94b9b441c229ad796962

SHA1
6cfa85a12f679aa79149d829996c0b42baf3accd

SHA256
64e1a3a8c4c92bc5c69080ecfcf8567f5de72b60e93780a97ee62409b225c46d

SHA512
6230e79f69bdccd56d974d5f16a6e479cad268cab416af7ff4eda6ee18d5023253ba1acd92674eb539c2eecdc922f31bfb733920d2fcb886adca3521ce888902

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\105509c2ca9b228e_0

Filesize
312B

MD5
40cf684729ecf030b8d90a88dac6b2b5

SHA1
392c65d896cf546b15e3c15f665433579fd7d215

SHA256
4ed3475fe7c168e9e00d578b9c5dd77bc9e83450efd8671740f1bda10fb7d1d4

SHA512
85b294cbdbc172c67fd71803978a75ca87d267c5127b045e55eb8f0ee5c718aff39ac76e5891d7476074ef4c47bae4c90d022b7791ca7310b5afcb578612480f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\180e414f012d8ae3_0

Filesize
309B

MD5
ccecd93a858587035abab110049a83b4

SHA1
da3c602e03da50bb2180caa46c15ef9597bc6ca5

SHA256
624f122e2348f146910a569b59c6c6c208123c3fcbcc8ec0f1cd41764cf68d05

SHA512
d3ba85ae0492b77bcee21e1abe5744a59c4a0c472ad1e2483407c64fbe18f54e0068bc3ba20bca84564b4e31ef72d8d17a4a0078d305bf9bcb580117e91f6e4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\1ddefb550a28cc70_0

Filesize
253B

MD5
f5d611ff821e0b264f22dbbd52d6ed2a

SHA1
81a24f4c0c617919a8ec8ed24ac77028ceaf74a7

SHA256
98ecbf19be34c9725d86b9daf80614058ca332c9d740ed122b162ee630ce4aa8

SHA512
7b7016777eaf8d683036415410eac0219be55118e55a20d717eea1121002b5eff625270664ff07e4f5b2af11ceb52133032a0e9729f6ce3c8de1197ea669e730

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\1fa28549f73acd32_0

Filesize
270B

MD5
10906da6b55d51e475fa837b9c5e62ac

SHA1
d804f4298b5902f272588f1b1a2a35edff4acfc0

SHA256
631208caa7065e65182c7647841ac76de6d4a69d5d1534fbc372108009f49736

SHA512
caf57d2014b162c9b5651457943b2b82305d081f7e5339e4917dcc768e7aa0aaee95cc21a054151913ef7b80929b1e9209639deaffb632532439760ab6beb3ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\1fda1c58ba430456_0

Filesize
312B

MD5
25ed76b9b0acff6041de0d6c31f509b1

SHA1
493701faeb4f13c2eaee6e1137828b7ca16102cb

SHA256
d53077a0f08c08f37c2274c4c9bbcd5dbf1dc517fa0ffd5f970cd05ef5b1781f

SHA512
5017ffd5a5b58689dcda5e3c9baabbe26d8e3bb0f7e8f1da4f906f9d3835b0c1491f30b338f45510dfdf237a8bcc51a15564ca6e7c8a8e38e786709031f8fbca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\230626c44da2ff73_0

Filesize
264B

MD5
844c807b9f7a47d5189376bca990275f

SHA1
52074913c9acdcd8b031af74f6f1d4eaad254e54

SHA256
a35d88ba49bf6fc5ce0cf5ad512087d9bb3fa5a331306d6e68419c4430d1ed7a

SHA512
3dff710124a948fbf637b3b889f9213568f57104b4f4b6332e7b7f715af051c8db1e586d2f872690bfe028a266c3fbe3d2ea49f57e3f0e6551899f93d94519c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2396bd2b5b04b29f_0

Filesize
312B

MD5
f85058e6deb8167fa0f08852e56ec7cf

SHA1
a5156b6af79c8e0800d30e16b3fb98b9e4f44853

SHA256
064fb9d58d05b5de3d1e5e04134b2692f0cdcdd21881224878326e89831902e6

SHA512
fbff3d2d0ae88d3301b3fb5a9b61acdcb9bb69a5475fd9d0a03e26cd2a647a88549314df74f397e3177570175bec710236fcafe6a7a763445116d82d258578c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\243cf03f2539f4ce_0

Filesize
312B

MD5
8d08d5437edaa81597f3a62f6edc200b

SHA1
fc9825c5894a7d965e74bf4cc8a60fd4247f5900

SHA256
1a2d809e81ba84f805b0504d32401c01c0c57507e574d87ebd5e906ecc3ecf10

SHA512
0b4077f98d06d8c45914212def5a510eea792714425de2ae75393a148e34e5c59d899fb4610592749649e5e0d438ca1b09e6f0e32253dd21398338a50eadaa73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\26834b29de2491d4_0

Filesize
312B

MD5
50d733ede9f2d41eabc7c4866c9bb075

SHA1
072c8c528bafcc3e76bd3f78ec5520871f9166bc

SHA256
82af9a6ea3a7ccf42cd034e4ea8d12b0f85316034e58a88b1b352f5592c09344

SHA512
ce9f23df08b5906f7615c7c47aa49e4691e66acdee85272c7093580e58115894ecdda24ab73a4d54c94b774d4c35ea035bf0ad8ff7f0a9a386c7e4c930339c17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\26dbab8f05a12756_0

Filesize
275B

MD5
2d699fdab57ca71748d1d7ea9ec33e2a

SHA1
721532c082af3c2e211d946badb817ea690ae3ae

SHA256
05fc6d13609be972bc6156b3cabd1bc519be145a82deaa49afcadc6537787eed

SHA512
9b73c9e7b98034edf32a451f0173cca2a06998a1cc099476ab9357100c9cc01375ada342b5e69bf6c94f24011286df39fe430a20edc6982799fe0fefb72990a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2704caec6cde94c3_0

Filesize
270B

MD5
3967667e1d29765df8801bc69697ddac

SHA1
acd9d67bb10f25fa811091eb1b88d1265023d931

SHA256
71716f80c7184b08707ac6ef57fa79f23724b5c59ab0d001bb60fa20f5e05ccc

SHA512
23a42b5e43bba281245af617071220135df4836449424e641b9cdeef3335cf362cb38f46337e5244a245fd9e04f793e19e02a5ce51949633dc3129a25698a943

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2786e5263ebe2acb_0

Filesize
312B

MD5
675d406811a146541db12950ac599d28

SHA1
18464f457308293d3a4ed6ef450ef2deaa257217

SHA256
47f73fceeb30dcf71dcc7a9433bb0768bf502695f2b2b59c1800c07a6b688265

SHA512
ea3220487bb06fd6b54530e9d568c0855c5457496782965b9e842a4ce52561622b7bbda381d6c9d369e75fea4a2c46b17f9962fcfbd23a69b3b601b05ba8856f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2b0a2e866fdeabad_0

Filesize
223B

MD5
94f332b0f2937b94758966c1e0ee7d44

SHA1
c73ed428bf0fd0b0f64c6c023d51fbbde67a22c8

SHA256
fb41c98a16818e86ada5a5f6d3b1b07bff698bb921456f993a783aa2020658e3

SHA512
2e47cfd554c3fb253b2a3a62e87e8da802edf65c4e99006e49ae4d20c204a45a36aceced9d56d2d7e61bc0f46f120fc2613381cd46922ec7df06beda5164f38d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\3407e3dcd0870f4a_0

Filesize
312B

MD5
6e860b8ca5e32cf5b55adb5c7eccfe39

SHA1
c26fe0fe8b879ea44d6079683222c4b52453d118

SHA256
4c83bde55e1f7658cc980c6eab21a29be308404339ef71cd493d2f8f0b85a06c

SHA512
fa1ad8d2bb5da162dd3a5a5fe3157c44f8863733bdbd43f10aacb337716006b4ac31ec158813c9cfdc203f6bf533120cb94a62589560802e0603ed7dfe3d01dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\375618093fb4d9db_0

Filesize
312B

MD5
9d5bbf3fb0b5a90d79e8ebc03a0a8bf6

SHA1
1d63a2476cd5b42675fdeeb6a8a05db575c88fb1

SHA256
4fd10312937fee4a158f2c27c1eef25a050a0a1894bb4db18f7222376b03476b

SHA512
68f8facc87ada4bfaf0fda13185779705baaf0d24e1b8b19a72b00a7eb6de91d937746e16bc5da5ed9eae25045dd097d5ae9377148f8398a02fde53e16199eb6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\3c1b71d6c92f4ff2_0

Filesize
274B

MD5
8ac8f6e055b956fe39a483bc44d8921f

SHA1
0e1d1aa2099e748f3ce7aaa003f2374ddce502ce

SHA256
f426be3077b50fc3277975f41b9606c6a30afc8eff61c120f47bd05e209805b5

SHA512
e942a1147f607e9169138582046b399a67f9edf87b36dff21e685dd679d0288f027c45d45d77df2be3bb006f129ffcc9692280c7e79ba28ae66e9080841ce57b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\40767c6ffa0c49cf_0

Filesize
275B

MD5
0b1fc99009e8f7387c8a72e955bbcdb7

SHA1
09d6826519c23564fc8d2cac3a30d190f52c78f9

SHA256
2558f6f127770f357048081f19039b17468932f9ed6316702109dd993e7a94a3

SHA512
2e25e628d733853b72e32e734e947b96fac2b0987f8d4f9e02ef57bbb77134216ddcef6967be64180869fff42f4205c5e58984599ef50335fa6d29708daa61f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\417cc1612ca06b48_0

Filesize
312B

MD5
6be00c37ad2e07bad97a25c5bd8c9009

SHA1
fe974650b4c6f9db9e4d1411d592dc1f6c54cf21

SHA256
c42b3bf0468dc4e38b4a717c2b7f825a0f709b4fcbaa741f9b250db28349da58

SHA512
2a21d7e2318027fbcbaf20a58586a0b5922602135542019a3ee895476d786f3f18aab4c1bb4606bd3a88b4e2577b75a92d04cdef4959d51c930ac02abd20d22f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
bd2992655180da42f1d23cbb68356ef7

SHA1
542c54f3986e8f6d0650e9d6f5ae6fcce0e820ba

SHA256
50f8fa3a2007e8e3f5c626542b44d17f5528b498d3e2b1e1f5451622c758cf1e

SHA512
ca5577ac4c5404407ce6b0c292a850a52dddd3f18312adfd6104e9aeda1c24397746f2499911b2f7ac9945668ff1cc4997590fef611233a9c340d980057db83e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
bef3aaae7d245a0ad9a8faf9db719203

SHA1
d672349fc1f921de1b26419147b376c37aa5073e

SHA256
71eafae3e4493eb6fbb368ae7ff80105bcb41b41f76676a69255abc8a8db8e34

SHA512
0c9fa358740264004b181068ad7a3c08c56737773e0b9b8f5c8d9750f97e356a954d753c49d81de70d40912ca37f5cf82a52998e5e0c36b08c2fac30d3d0f622

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
1ac86322d9e9ea74c3ebcdd469f46416

SHA1
f374391c80538936f74b2a25c892d6ab23a8c7e5

SHA256
f0369308980cd5c45db00cfa9c2ba6adc47c876b07a0a4a98132384451f393fa

SHA512
9e565069ac01f9a217d2e8dba28201fac70d482fb8acb9611991a3ace21e191cdf1477eca57e152d3b55ccd11412f197ae7ddcd243e0df3d97c14000c47a48e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
3ae2a034e027d1d6df58c4a79ce85d4d

SHA1
de6b1ec237cd136ed78061395f85326157766e52

SHA256
86673bfa2c7b7d81942b8408ea72164e6658f4bcdcd94f36a565b695e90099a2

SHA512
bcbfca48ccfc054113546a1701478a316f9107ce9b88f88dbb52d006917d7332893394bf4469a09c4698fce26f17963ef8a403edd74a94aedea9d46d041950b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f4a78a477c88061aaa1d4eb46473f58b

SHA1
800735c9bc88bdefc702d8d70cec63213b815833

SHA256
fa12b16ca8a9e24439223e3420d3cf44394579ae93ca63baa2c0616c4bfabedb

SHA512
00c2bde51231803ea5a4d90bbaf0183c62fdb3b6928629c983a098406c1a79bbc6403ea853cbadc380f9d2c557631bfcd8b18ccbf28075b34337f07ac7e3c58c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9eeb96dc4ca2bb1b672f54aa89f1a0df

SHA1
2fdd801bf0792cf5ff97110eff94ffbfc405cb57

SHA256
758ebd9f74d3a6ffd5d6a5bb4fc27a02a0465a8c1fcc0178db4685598793d817

SHA512
d20691710039031c52b4d5c1b2c02a1fade1e45937ca4a20f8109a6c1d94c28f224771430452ea6964698c036438972ddccacfa842d719615a7403eb2360833d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ca003c1a8435f725aae3b69ed0430782

SHA1
ef62e31b0cd22c9e8cdd2bcb490948b52f8bad86

SHA256
50b88433ba7725d97927a05bfe38ab7af564636b7611a37788f8a8fb8e1c498f

SHA512
78396b4bfb0e78155986e3c498aef150a7bb4f64b29c6a6914e8d49bc251b43d1967e700ca43fc882a2b4891f24ac3ebbf1de76c269e08f1bf034cf01c5ee719

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
cc359e254f59fe85539ef3bfc1e9cbe3

SHA1
1d29d114bef5b3edd706b1b0b81cf93b2575287b

SHA256
22208a2ae8172883116fdda8748e60ea5f0e93a05f612653775fd6743a032e51

SHA512
8d486e5780cd62c1801cddfdd5b35e40b0344deb1f9ff8e1b8a974fc2aa9ac4b9bc2b88da3545e27a91b9b20ebc7ca88df4101acc2582f8d4210f8c7e88156f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
318fca15b063912b3dcecf8e2358de3f

SHA1
6416698df59d14c8ea38c0944b25ea8b53ce1713

SHA256
4e7f7fc11368389c257ed7076326a021905224fff6f4f577b68f5046b096e9ff

SHA512
892ba12392339cff0d492a60d2505f641ff4a13be3efe2e53bca9f0512720ec74402c92bca1abb7af2f18c4dafd67066b430497196d435d5801463601b9f5d6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
6040050aea27160f7d774c61a66bbc66

SHA1
4b197a1fbc7b94ff19f6ec849cef6cc72c547e51

SHA256
35a8cf66804e500b6efecb8cbdcd96f2b82810f3951572e817da91d28a17fab3

SHA512
4ce906143af0275a21dd6ef7b01fe3915e091a82ed130fc00d3117fc18b398c09e7f202133e3c11194e771248bd44a2cbd9808fdc3919e94aaf786643613f5da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
129KB

MD5
f58c076012a50c94898348dfd14b3a18

SHA1
76fdf541ff1d9bc1f9c3533c672be68ea4e81e20

SHA256
18ac89b63fbac19f3711cf0f4f86cbf901bc6ab1a019d5e17860803e7d555afb

SHA512
3b48bd3f6e8e5bf5840c3db190af47ed34dc801562006c2990ebbc59381bcbc5b30c56ff6e5a2414546220dd1c15e45787f986cbcda36214508c0ee41badb529

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
129KB

MD5
af1d2f9539f69a11003f97c8e364bb15

SHA1
17564432231bb0b7e4ef66f339d04269fc2a298b

SHA256
e8df616e4698ddf5150f04415969e3628979dbddd4055f317d266cad88a5f588

SHA512
6d3b4b58347f548959f0025dca2d6a9246d81ee7c7a96739445460a688e7463a140829f020d94cffeae1052e01adfe4b16d88affa0abd6e1c54334eee89498cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
94KB

MD5
8bfa2e50cc980db000a02a79db942db7

SHA1
f31802940ae26c79b9636c11d17903e9068205f8

SHA256
cd5648f3315b07856f43af4fb3debf053ed11ac0348d74fcc0f19f920c4d1453

SHA512
0ffeadd6b50463e40af4e85a5b4e9987c3d3346081690eac7679f926d4c27287f45d31ed86808ff3053923d28051126f4b01f2cf4f54b3595cc6cfb74353a47e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57c35f.TMP

Filesize
82KB

MD5
52413fb89b12f174724068ede096fb32

SHA1
69234925dce9ddf6be4cc6763de4ef5afe64879d

SHA256
0bc1e99e0a3d5e5c3e5129724ace03b01d8c48a428a979dfcb3d6da29831b2ea

SHA512
dcb2d517e014876050555e37bdced05568e7d9eb0eb5155133bd88558dd3bc026fc19023cbc07ea7e58fb6bb3d3e2d6e70c52ed495b5ba2d53c19cd7a92c709e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
dfac46345189ff3be4cfc18ae1690216

SHA1
8986dfdff51cfc0b491c4feb0f12b81da57e4d58

SHA256
6628a3fe2b5854c3b8e3101b131950879aa2bc08062dd8cc7449bf6081098cbd

SHA512
d4a3cc861a0c840bb05513bda03bcc2b3d121544e445548aadb6147f64831d608ba0643cdf8681cccfb2992c01930b124b19ad2e4a2cadbc2f0e2c2a8e193b88

Download Submit
C:\Users\Admin\Downloads\Ransomware.Hive.zip.crdownload

Filesize
6.6MB

MD5
33dc6cf9108fa7a395d632c29021791c

SHA1
61ccffbfb8f2458be139aa1d3c9dd715f25cd06d

SHA256
af9e8f301a3677b457345921d7ee765a842eceb7df107714eaffc6193bfc6bbe

SHA512
5b7206cd076e313f15a13c4f6278ea80c109577530bc43614efc631aeb8b53f8b0abba1135298ba6b6b7fa2f19321ab673b257d3b4c0cbc95bd4c50c8040466d

Download Submit
C:\Users\Admin\Downloads\Ransomware.Hive.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Ransomware.Hive\hive.bat

Filesize
176B

MD5
af3806b02937353a2dc48566145b4f75

SHA1
58884e1c23eb6087a164e1027cd6fd22d3843e17

SHA256
f53b9dbe7275f408254c3e3d43b51d3e467ae68df4980b289f56a5b1436994e2

SHA512
a2c976c7161452ad69230eb8984874f5c7007866793eef7305f3e465fe78109a4c9c22c0412759719671cd136dd79dfae6e507df0be776feb4748e63316b7b9c

Download Submit
C:\Users\Admin\Downloads\Ransomware.Hive\hive.exe

Filesize
764KB

MD5
2f9fc82898d718f2abe99c4a6fa79e69

SHA1
9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb

SHA256
88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1

SHA512
19f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b

Download Submit
C:\Users\Admin\Downloads\Ransomware.Hive\shadow.bat

Filesize
57B

MD5
df5552357692e0cba5e69f8fbf06abb6

SHA1
4714f1e6bb75a80a8faf69434726d176b70d7bd8

SHA256
d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8

SHA512
a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3107365284-1576850094-161165143-1000\HOW_TO_DECRYPT.txt

Filesize
1KB

MD5
80207d0f8ea42bdfeaf9f5c586230aca

SHA1
747481fe2b0b6d81c3b19ba62d1e49eab6a5461f

SHA256
25edefb3b0678dfe0d927ff48ce67254359ba379df9468f634d02c026f0e7131

SHA512
73f68ce9e98d2346be1762bd54bb06ef83ae939dfbcf9b786d9b773fa454352613387d264b7a87a1c08950226553817bf01f5aa4107bc12de36a1689e2137304

Download Submit
memory/1412-22443-0x0000000000B80000-0x0000000000DE3000-memory.dmp

Filesize
2.4MB

Download
memory/1412-16407-0x0000000000B80000-0x0000000000DE3000-memory.dmp

Filesize
2.4MB

Download
memory/1412-21560-0x0000000000B80000-0x0000000000DE3000-memory.dmp

Filesize
2.4MB

Download
memory/1412-394-0x0000000000B80000-0x0000000000DE3000-memory.dmp

Filesize
2.4MB

Download
memory/1412-21758-0x0000000000B80000-0x0000000000DE3000-memory.dmp

Filesize
2.4MB

Download
memory/1412-22431-0x0000000000B80000-0x0000000000DE3000-memory.dmp

Filesize
2.4MB

Download
memory/1412-2935-0x0000000000B80000-0x0000000000DE3000-memory.dmp

Filesize
2.4MB

Download
memory/1412-3875-0x0000000000B80000-0x0000000000DE3000-memory.dmp

Filesize
2.4MB

Download
memory/1412-5355-0x0000000000B80000-0x0000000000DE3000-memory.dmp

Filesize
2.4MB

Download
memory/1412-7331-0x0000000000B80000-0x0000000000DE3000-memory.dmp

Filesize
2.4MB

Download
memory/1412-10782-0x0000000000B80000-0x0000000000DE3000-memory.dmp

Filesize
2.4MB

Download
memory/1412-22446-0x0000000000B80000-0x0000000000DE3000-memory.dmp

Filesize
2.4MB

Download
memory/1412-19952-0x0000000000B80000-0x0000000000DE3000-memory.dmp

Filesize
2.4MB

Download
memory/1412-393-0x0000000000B80000-0x0000000000DE3000-memory.dmp

Filesize
2.4MB

Download
memory/1412-22439-0x0000000000B80000-0x0000000000DE3000-memory.dmp

Filesize
2.4MB

Download
memory/1412-22437-0x0000000000B80000-0x0000000000DE3000-memory.dmp

Filesize
2.4MB

Download
memory/1412-22435-0x0000000000B80000-0x0000000000DE3000-memory.dmp

Filesize
2.4MB

Download
memory/1412-22433-0x0000000000B80000-0x0000000000DE3000-memory.dmp

Filesize
2.4MB

Download
memory/3680-21561-0x0000000000D10000-0x0000000000DFE000-memory.dmp

Filesize
952KB

Download
memory/3680-17793-0x0000000000D10000-0x0000000000DFE000-memory.dmp

Filesize
952KB

Download
memory/3680-884-0x0000000000D10000-0x0000000000DFE000-memory.dmp

Filesize
952KB

Download