hive | hxxps://github[.]com/ytisf/theZoo/tree/master/malware/Binaries/Ransomware[.]Hive

Resubmissions

31-05-2024 03:56

240531-ehcgtsfd36 10

31-05-2024 03:37

240531-d6wpyaeh64 10

Analysis

max time kernel
266s
max time network
263s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
31-05-2024 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/ytisf/theZoo/tree/master/malware/Binaries/Ransomware.Hive

Score

10^/10

hive defense_evasion execution impact persistence ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\$Recycle.Bin\HOW_TO_DECRYPT.txt

Family

hive

Ransom Note

Your network has been breached and all data is encrypted. To decrypt all the data you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: EQA9oydTxwXS Password: vNtgAgb3kMFmCooANNQr Follow the guidelines below to avoid losing your data: - Do not shutdown or reboot your computers, unmount external storages. - Do not try to decrypt data using third party software. It may cause irreversible damage. - Do not fool yourself. Encryption has perfect secrecy and it's impossible to decrypt without knowing the key. - Do not modify, rename or delete *.key.hive files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to authorities. The negotiation process will be terminated immediately and the key will be erased. - Do not reject to purchase. Your sensitive data will be publicly disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

URLs

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

Signatures

Detects Go variant of Hive Ransomware 14 IoCs

resource	yara_rule
behavioral1/memory/3660-308-0x0000000001000000-0x0000000001263000-memory.dmp	hive_go
behavioral1/memory/3660-309-0x0000000001000000-0x0000000001263000-memory.dmp	hive_go
behavioral1/memory/3660-3610-0x0000000001000000-0x0000000001263000-memory.dmp	hive_go
behavioral1/memory/3660-5288-0x0000000001000000-0x0000000001263000-memory.dmp	hive_go
behavioral1/memory/3660-7397-0x0000000001000000-0x0000000001263000-memory.dmp	hive_go
behavioral1/memory/3660-13076-0x0000000001000000-0x0000000001263000-memory.dmp	hive_go
behavioral1/memory/3660-19087-0x0000000001000000-0x0000000001263000-memory.dmp	hive_go
behavioral1/memory/3660-20513-0x0000000001000000-0x0000000001263000-memory.dmp	hive_go
behavioral1/memory/3660-21942-0x0000000001000000-0x0000000001263000-memory.dmp	hive_go
behavioral1/memory/3660-21944-0x0000000001000000-0x0000000001263000-memory.dmp	hive_go
behavioral1/memory/3660-21946-0x0000000001000000-0x0000000001263000-memory.dmp	hive_go
behavioral1/memory/3660-21948-0x0000000001000000-0x0000000001263000-memory.dmp	hive_go
behavioral1/memory/3660-21950-0x0000000001000000-0x0000000001263000-memory.dmp	hive_go
behavioral1/memory/3660-21956-0x0000000001000000-0x0000000001263000-memory.dmp	hive_go

Hive
A ransomware written in Golang first seen in June 2021.
ransomware hive
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops file in Drivers directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\uk-UA\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\en-US\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\drivers\en-US\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\HOW_TO_DECRYPT.txt	hive.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.FPVaSW4I334fyTFQkB5RtMcnBi3prkkyuyqRFQAp6TE.hive	hive.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\HOW_TO_DECRYPT.txt	hive.exe

Executes dropped EXE 1 IoCs

pid	Process
3660	hive.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000300000001aa2d-296.dat	upx
behavioral1/memory/3660-298-0x0000000001000000-0x0000000001263000-memory.dmp	upx
behavioral1/memory/3660-308-0x0000000001000000-0x0000000001263000-memory.dmp	upx
behavioral1/memory/3660-309-0x0000000001000000-0x0000000001263000-memory.dmp	upx
behavioral1/memory/3660-3610-0x0000000001000000-0x0000000001263000-memory.dmp	upx
behavioral1/memory/3660-5288-0x0000000001000000-0x0000000001263000-memory.dmp	upx
behavioral1/memory/3660-7397-0x0000000001000000-0x0000000001263000-memory.dmp	upx
behavioral1/memory/3660-13076-0x0000000001000000-0x0000000001263000-memory.dmp	upx
behavioral1/memory/3660-19087-0x0000000001000000-0x0000000001263000-memory.dmp	upx
behavioral1/memory/3660-20513-0x0000000001000000-0x0000000001263000-memory.dmp	upx
behavioral1/memory/3660-21942-0x0000000001000000-0x0000000001263000-memory.dmp	upx
behavioral1/memory/3660-21944-0x0000000001000000-0x0000000001263000-memory.dmp	upx
behavioral1/memory/3660-21946-0x0000000001000000-0x0000000001263000-memory.dmp	upx
behavioral1/memory/3660-21948-0x0000000001000000-0x0000000001263000-memory.dmp	upx
behavioral1/memory/3660-21950-0x0000000001000000-0x0000000001263000-memory.dmp	upx
behavioral1/memory/3660-21956-0x0000000001000000-0x0000000001263000-memory.dmp	upx

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	hive.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3968772205-1713802336-1776639840-1000\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	hive.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	hive.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	hive.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3968772205-1713802336-1776639840-1000\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	hive.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	hive.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	hive.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	hive.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	hive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	hive.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
38	raw.githubusercontent.com
39	raw.githubusercontent.com

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\nulhprs8.inf_amd64_2f2cd2a9beeb1cca\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prncacl2.inf_amd64_d0fd8eb0443cec17\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sisraid2.inf_amd64_845e008c32615283\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\Licenses\OEM\Professional\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\Volume\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\en-US\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\setup\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\fusionv2.inf_amd64_ab2a49107092c746\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnokcl1.inf_amd64_d54b831cc2bc714b\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wiaca00j.inf_amd64_2b730d5c3b5d1ba1\amd64\MX350\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\InstallShield\setupdir\0006\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\InstallShield\setupdir\0404\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\en\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_proximity.inf_amd64_3db4451a971e52c3\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fdc.inf_amd64_f74caef313011915\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\it-IT\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\genericusbfn.inf_amd64_06a23cf13e565aff\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\winrm\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\Configuration\BaseRegistration\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\megasas.inf_amd64_a6884b17a7bddfd4\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PrintManagement\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetQos\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\catroot\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\ja-JP\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\ja\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbnet.inf_amd64_c5a42cdc1adb9ade\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnb.inf_amd64_e610f6f65afdc230\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\en\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\fr-FR\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdcm5.inf_amd64_7d2845197b84ec4f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhpcl4.inf_amd64_9412589272562044\amd64\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vhdmp.inf_amd64_91108ad24fd52958\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\InstallShield\setupdir\001e\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\wbem\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\Speech_OneCore\Common\en-IN\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttd2.inf_amd64_efbc1abc3929d115\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\oobe\uk-UA\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\slmgr\0C0A\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\oobe\de-DE\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppLocker\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bda.inf_amd64_3c0159f47c2457b1\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wmiacpi.inf_amd64_e38f2e2bb2bf2ed3\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\Speech\Engines\TTS\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\Tasks\Microsoft\Windows\RemoteApp and Desktop Connections Update\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\F12\en-US\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\Licenses\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wsynth3dvsc.inf_amd64_a1515b59a923a777\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\Licenses\_Default\Professional\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mgtdyn.inf_amd64_1bc4a2c43e617377\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Examples\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDiagnostics\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\System32\DriverStore\FileRepository\percsas3i.inf_amd64_8635c202e10bcf51\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\en-US\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\ar-SA\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\Volume\Professional\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\SysWOW64\Speech\Engines\SR\fr-FR\HOW_TO_DECRYPT.txt	hive.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.FPVaSW4I334fyTFQkB5RtBTb541Bviohf5v1NqmDTjU.hive	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-30.png	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-60.png	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-up.png.FPVaSW4I334fyTFQkB5RtG9__QnNMighL6AntQpuzFs.hive	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\MedTile.scale-100.png	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\ui-strings.js	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\SystemX86\mfc140u.dll	hive.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Pyramid\ResPacks\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-16_altform-unplated.png	hive.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.FPVaSW4I334fyTFQkB5RtOlfBIZxs5Mso0h_loBVwWk.hive	hive.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.FPVaSW4I334fyTFQkB5RtKbtmCRH5Q9DWCHd0G0sw1s.hive	hive.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hu-hu\ui-strings.js.FPVaSW4I334fyTFQkB5RtM0ANDfHvTtfKvDAy64gvVg.hive	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.FPVaSW4I334fyTFQkB5RtBGRbXG2Lz8ra1itPHey2wI.hive	hive.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailSmallTile.scale-200.png	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hr-hr\ui-strings.js	hive.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-phn.xrm-ms	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.FPVaSW4I334fyTFQkB5RtJTD68aUsAFYcnwFqRcwVXM.hive	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Theme\theme_classic.respack	hive.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll	hive.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\models\Url.ot	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.FPVaSW4I334fyTFQkB5RtA_a2on5GqZUB8Uti-xmv0Q.hive	hive.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmagnify_plugin.dll.FPVaSW4I334fyTFQkB5RtNtSTIVoQEob_P5h-CdC_Bk.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png.FPVaSW4I334fyTFQkB5RtK2KzM9oj-9jaZ_4TV1ttlM.hive	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\check-mark-1x.png.FPVaSW4I334fyTFQkB5RtMhmmvUl9PJ51zDJqrBGWCo.hive	hive.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\manifest.json	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe\resources.pri	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-black_scale-125.png	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-gb\ui-strings.js	hive.exe
File opened for modification	C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui	hive.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.cpl	hive.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\common\Classic_Speed_Run_Unearned_small.png	hive.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-80_altform-unplated.png	hive.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-tw\HOW_TO_DECRYPT.txt	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms.FPVaSW4I334fyTFQkB5RtNMFSiZqTgsdEBgotyxWESg.hive	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSplashLogo.scale-125.png	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xecd0.png	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png.FPVaSW4I334fyTFQkB5RtEkoWsdd2QNMUHeDJTQaPWQ.hive	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Catalog\bulldozer.3mf	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\freecell\Guard_Duty_.png	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\SkypeMedTile.scale-200.png	hive.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui	hive.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.dll	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\LEELAWDB.TTF	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\ui-strings.js.FPVaSW4I334fyTFQkB5RtHd3sbrPgc191tI_tnDD4Dk.hive	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-64_altform-fullcolor.png	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\ui-strings.js.FPVaSW4I334fyTFQkB5RtNSbiq0kVtlrYNWi0_NLq38.hive	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\QUAD.INF.FPVaSW4I334fyTFQkB5RtGyuFdvM_6FlX_0fF35mklY.hive	hive.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini.FPVaSW4I334fyTFQkB5RtJlhS-blQSM32jz1BQQowVI.hive	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-phn.xrm-ms	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms.FPVaSW4I334fyTFQkB5RtEZq49AYoi8doIWuiwZ7IDU.hive	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\gr_16x11.png	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-96_altform-colorize.png	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-200.png	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\en-gb\ui-strings.js.FPVaSW4I334fyTFQkB5RtIPo4p-alHtIkZ_VOJcakiM.hive	hive.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.FPVaSW4I334fyTFQkB5RtGPLll373sZponyTuz6sinE.hive	hive.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.FPVaSW4I334fyTFQkB5RtNSBEhngT0MNJPDHU5sA034.hive	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\8196_32x32x32.png	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\AppxManifest.xml	hive.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\AppxManifest.xml	hive.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Stamp.aapp	hive.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..p-service.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_a87f90052830ccfc\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..mcore-dll.resources_31bf3856ad364e35_10.0.15063.0_de-de_3fe2e15073ccbbd7\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..on-wizard.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_f366b27ff25da279\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.15063.0_es-es_fe121660d5708907\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..oundation.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_ce8d3abab1ff1ce4\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-networking_31bf3856ad364e35_10.0.15063.0_none_3313ebbcb350716a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-o..iveportal.appxsetup_31bf3856ad364e35_10.0.15063.0_none_4a557340de2d264f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-rasmontr.resources_31bf3856ad364e35_10.0.15063.0_it-it_bda082d44f0ebd2e\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..nttoolapi.resources_31bf3856ad364e35_10.0.15063.0_en-us_9a3e1fe0740d22e3\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_netfx4-globalserifcf_b03f5f7f11d50a3a_4.0.15552.17081_none_4d236070e3f4de28\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_netfx4-system.collections.concurrent_b03f5f7f11d50a3a_4.0.15552.17062_none_1fc69ee7f3dcdfd9\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_wave.inf.resources_31bf3856ad364e35_10.0.15063.0_es-es_14bd1a755bd13399\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\msil_system.data.sqlxml.resources_b77a5c561934e089_4.0.14917.0_ja-jp_d1066015f01e1f66\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_rawsilo.inf.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_a0b967f85bfff515\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_windows-defender-ma..t-onecore.resources_31bf3856ad364e35_10.0.15063.0_it-it_139836651c6d037c\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_mdmsettingsprov.resources_31bf3856ad364e35_10.0.15063.0_es-es_d88271575d54bc4f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..speech.0411.cortana_31bf3856ad364e35_10.0.15063.0_none_5bb643906ccc875c\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..ents-mdac.resources_31bf3856ad364e35_10.0.15063.0_de-de_39e858476c7526ae\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-msf-core.resources_31bf3856ad364e35_10.0.15063.0_en-us_e151fde7816a1cb7\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..c-keyenum.resources_31bf3856ad364e35_10.0.15063.0_de-de_d56e9837a5312980\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_netfx4-system.speech.resources_b03f5f7f11d50a3a_4.0.14917.0_fr-fr_e8fa04ee6756dfbb\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\fr\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_mchgr.inf.resources_31bf3856ad364e35_10.0.15063.0_it-it_3edb82cf0be7cd23\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-at.resources_31bf3856ad364e35_10.0.15063.0_en-us_15072281823c793e\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\PolicyDefinitions\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-credwiz_31bf3856ad364e35_10.0.15063.0_none_54cfee60ec4666ba\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..ne-dsdiag.resources_31bf3856ad364e35_10.0.15063.0_es-es_5640347a3659dc11\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-radar-adm.resources_31bf3856ad364e35_10.0.15063.0_de-de_60958492b7a835b1\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_netfx4-_networkingperfcounters_v2_h_b03f5f7f11d50a3a_4.0.14917.0_none_b6352c81ee081f75\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\msil_system.xml.resources_b77a5c561934e089_10.0.15063.0_es-es_309c2885bc76f397\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-hbaapi.resources_31bf3856ad364e35_10.0.15063.0_es-es_455ee641e4c3f3c1\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\fe944c32d73c1fa7be4f748cf7e187ef\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-iconcodecservice_31bf3856ad364e35_10.0.15063.0_none_dc2de1830a8588d4\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Utility.Activities.Resources\v4.0_3.0.0.0_en_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Discovery.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..k-qos-wmi.resources_31bf3856ad364e35_10.0.15063.0_es-es_ff268f5831cec166\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-r..erycenter.resources_31bf3856ad364e35_10.0.15063.0_es-es_9890d3a6bb52c722\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sysdm.resources_31bf3856ad364e35_10.0.15063.0_en-us_474de2651e51ca43\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..p-utility.resources_31bf3856ad364e35_10.0.15063.0_es-es_05496659d7ed44dd\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_dual_c_mtd.inf_31bf3856ad364e35_10.0.15063.0_none_bf6d2eaa9ac0c4eb\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_netr28ux.inf.resources_31bf3856ad364e35_10.0.15063.0_de-de_0a6f4bb963e08f88\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_termkbd.inf.resources_31bf3856ad364e35_10.0.15063.0_es-es_8b2a85ac95c28871\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_tsprint.inf.resources_31bf3856ad364e35_10.0.15063.0_es-es_49e4d9f970e064be\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_a43e6fb58451e190\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..napi-stub.resources_31bf3856ad364e35_10.0.15063.0_it-it_c377bb1223022cf0\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-core.resources_31bf3856ad364e35_10.0.15063.0_es-es_38b696233a6b6332\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_netfx4-servicemodelinstallrc_dll_b03f5f7f11d50a3a_4.0.15552.17062_none_0ebd4a5b877e8781\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-wmpnss-api_31bf3856ad364e35_10.0.15063.0_none_fd5207f3578c1f4a\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\x86_netfx4-installcommon_sql_b03f5f7f11d50a3a_4.0.15552.17062_none_a4550d224185546b\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\x86_netfx4-msbuild_rsp_b03f5f7f11d50a3a_4.0.14917.0_none_66687d607ddc3bb4\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..ure-other.resources_31bf3856ad364e35_10.0.15063.0_es-es_bebca1d3d1ba9ba3\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_wvmbusvideo.inf_31bf3856ad364e35_10.0.15063.0_none_644c44061803b40e\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Collections.Specialized\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-c..er-office.resources_31bf3856ad364e35_7.0.15063.0_en-us_833d6126193d5592\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\diagnostics\system\PCW\es-ES\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_c_avc.inf.resources_31bf3856ad364e35_10.0.15063.0_en-us_44ba96eac8c4b697\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..ppvclient.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_e74777c66ba4a57e\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-l...appxmain.resources_31bf3856ad364e35_10.0.15063.0_es-es_e5b8e509d1fdaa68\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_multipoint-wms.eventlogmsg.resources_31bf3856ad364e35_10.0.15063.0_it-it_b13e5ffc7769bd2f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_netfx4-system.web.extensions.design_b03f5f7f11d50a3a_4.0.15552.17062_none_4b245a8a3c44f53b\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-r..comserver.resources_31bf3856ad364e35_10.0.15063.0_es-es_ead2bd2f593f6a4f\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..lperclass.resources_31bf3856ad364e35_10.0.15063.0_uk-ua_2e5daf73fbb2f824\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ity-vault.resources_31bf3856ad364e35_10.0.15063.0_es-es_036f00f4433b2fbb\HOW_TO_DECRYPT.txt	hive.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-e..tion-util.resources_31bf3856ad364e35_10.0.15063.0_en-us_39acef79912e5c35\HOW_TO_DECRYPT.txt	hive.exe

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
2176	timeout.exe
3924	timeout.exe
2316	timeout.exe
1116	timeout.exe
380	timeout.exe
5060	timeout.exe
4448	timeout.exe
2824	timeout.exe
2176	timeout.exe
2704	timeout.exe
2272	timeout.exe
4188	timeout.exe
5040	timeout.exe
644	timeout.exe
3504	timeout.exe
2140	timeout.exe
4948	timeout.exe
2040	timeout.exe
3588	timeout.exe
2284	timeout.exe
3520	timeout.exe
2704	timeout.exe
696	timeout.exe
856	timeout.exe
3348	timeout.exe
2908	timeout.exe
4544	timeout.exe
1636	timeout.exe
3400	timeout.exe
1868	timeout.exe
3004	timeout.exe
1020	timeout.exe
1036	timeout.exe
2492	timeout.exe
1076	timeout.exe
1356	timeout.exe
4544	timeout.exe
4728	timeout.exe
5096	timeout.exe
3104	timeout.exe
4544	timeout.exe
2940	timeout.exe
1960	timeout.exe
3176	timeout.exe
2100	timeout.exe
2568	timeout.exe
2784	timeout.exe
3408	timeout.exe
3328	timeout.exe
692	timeout.exe
3488	timeout.exe
4164	timeout.exe
1764	timeout.exe
4732	timeout.exe
3240	timeout.exe
992	timeout.exe
3356	timeout.exe
4436	timeout.exe
1716	timeout.exe
596	timeout.exe
4212	timeout.exe
744	timeout.exe
1732	timeout.exe
4284	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
788	vssadmin.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133616013828639152"	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
3660	hive.exe
3660	hive.exe
4800	chrome.exe
4800	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
360	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1768	chrome.exe
1768	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeShutdownPrivilege	1768	chrome.exe
Token: SeCreatePagefilePrivilege	1768	chrome.exe
Token: SeRestorePrivilege	360	7zFM.exe
Token: 35	360	7zFM.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1968	7zG.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
1768	chrome.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe
216	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 4172	1768	chrome.exe	72
PID 1768 wrote to memory of 4172	1768	chrome.exe	72
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4652	1768	chrome.exe	74
PID 1768 wrote to memory of 4268	1768	chrome.exe	75
PID 1768 wrote to memory of 4268	1768	chrome.exe	75
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76
PID 1768 wrote to memory of 4724	1768	chrome.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/ytisf/theZoo/tree/master/malware/Binaries/Ransomware.Hive
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff60639758,0x7fff60639768,0x7fff60639778
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1532 --field-trial-handle=1860,i,17542265723960583445,9498696573591069848,131072 /prefetch:2
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1788 --field-trial-handle=1860,i,17542265723960583445,9498696573591069848,131072 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2060 --field-trial-handle=1860,i,17542265723960583445,9498696573591069848,131072 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2820 --field-trial-handle=1860,i,17542265723960583445,9498696573591069848,131072 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2828 --field-trial-handle=1860,i,17542265723960583445,9498696573591069848,131072 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 --field-trial-handle=1860,i,17542265723960583445,9498696573591069848,131072 /prefetch:8
  2⤵
  PID:588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 --field-trial-handle=1860,i,17542265723960583445,9498696573591069848,131072 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 --field-trial-handle=1860,i,17542265723960583445,9498696573591069848,131072 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3704 --field-trial-handle=1860,i,17542265723960583445,9498696573591069848,131072 /prefetch:8
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=1860,i,17542265723960583445,9498696573591069848,131072 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 --field-trial-handle=1860,i,17542265723960583445,9498696573591069848,131072 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=816 --field-trial-handle=1860,i,17542265723960583445,9498696573591069848,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4800

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2484

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:360
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Ransomware.Hive\" -ad -an -ai#7zMap22439:92:7zEvent20359
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:1968

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5012

C:\Users\Admin\Downloads\Ransomware.Hive\hive.exe
"C:\Users\Admin\Downloads\Ransomware.Hive\hive.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c hive.bat >NUL 2>NUL
  2⤵
  PID:2088
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:5040
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:5060
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4544
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1020
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4376
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3168
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1640
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2176
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:644
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3488
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4544
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1716
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4728
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1036
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:5060
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:588
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1116
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4164
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:5096
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4224
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4732
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2908
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2568
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:596
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:380
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:204
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3240
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2040
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4252
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:5080
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1052
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3720
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:440
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2704
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2784
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3104
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4436
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4212
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2176
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3408
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2704
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4980
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2676
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3924
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3608
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3308
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3504
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:696
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3588
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2492
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2284
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2544
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1636
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1892
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3080
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1076
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4544
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3764
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3500
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2940
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4260
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:5060
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:64
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:992
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2272
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:588
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1412
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4164
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1544
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4284
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3912
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3448
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4760
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2544
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4448
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3356
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1960
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4544
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3764
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3828
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1764
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3176
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2140
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:596
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1356
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4424
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3132
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4188
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:408
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3268
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3740
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3520
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1872
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2824
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:744
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4948
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3004
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:196
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4212
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:204
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3920
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3348
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3400
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1868
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2100
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:4332
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3328
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1904
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1732
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:692
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2316
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:2180
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3608
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:3392
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c shadow.bat >NUL 2>NUL
  2⤵
  PID:4696
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:788

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4644

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\HOW_TO_DECRYPT.txt

Filesize
1KB

MD5
80207d0f8ea42bdfeaf9f5c586230aca

SHA1
747481fe2b0b6d81c3b19ba62d1e49eab6a5461f

SHA256
25edefb3b0678dfe0d927ff48ce67254359ba379df9468f634d02c026f0e7131

SHA512
73f68ce9e98d2346be1762bd54bb06ef83ae939dfbcf9b786d9b773fa454352613387d264b7a87a1c08950226553817bf01f5aa4107bc12de36a1689e2137304

Download Submit
C:\$Recycle.Bin\S-1-5-21-3968772205-1713802336-1776639840-1000\desktop.ini

Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma

Filesize
1024KB

MD5
c806c4473f82ec409d0d01281513adc3

SHA1
a2a0d2dea8fb5429c8eb339d7504936db8b7ed95

SHA256
92cd61a571d3eb9dbff4319c293faf68a9a0960bd7efac19cd413df10d0b325a

SHA512
febbaad04eaa215c13f624905fa79c93f04057432895a67e93a41343fcbd02da3424713c62b068429d75a6833981c54f1dfa2df81d9d5ec891ab40fdd5bb2895

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
acdad9483d3f27ed7e86c7f0116d8ad9

SHA1
dd2cfd176ad33d12ba7e6d260e1069b1dd4490c4

SHA256
bff5b4fff4b34ed3ea2754985b5ba1a8d6921517b0fa370f71f37ee0845552ba

SHA512
6e3ab4b6cfa73a7ad3c36fa621b1d2817b26e8e3613b78a40df6691d65e1486e6c2281efa0f8d3f30d2c6647b7ba3430a8be77df770f1cc575e8db76be6836a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
0b251f83f38e734552f648ecf1eef6ec

SHA1
31296401bd554287fbd2a5140285d301df103c5b

SHA256
fb7ed6a17fa803604b8d2a3a69c7fcfb4eaf522d82ff76cc6efbd89804c4e29e

SHA512
550c8e9b023757ba2ed69a4d27d66e1f9a560fb6199b0b7f88afe994c8988bbbf4ed39c14a9b83fc746ecb6baeb833761cdab07c7d9f4d5593bcb778c1fe630d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
44175b65d275f0399d9580c16517fa45

SHA1
28ea94eeaca0495dd0b35da29828163522b89d7e

SHA256
5229fa3657f025c112bb79b86b692db9c43788cc54f79b732b4e91dbc0989aa3

SHA512
e82220f20bb1497e08ad6a8c9db7dbf5969785526320e514a26dabd8dc82e7e034a102042639f785cb86e78fda533bbe0279f283ac8a87fcc7f6ad85915aa7c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
84ef0ab13966053347b28cccc67d94f5

SHA1
06a2caec6934322f6a0b04459bf636c2ff17b23d

SHA256
1036501582a99795770b0f3526678171e70e1071dee75dcc0672e41c7fa532bd

SHA512
2210191054c0c9a09b5e47f330e77719d015943ee79b15122ad74af9ae2d5e0daad0d3b9e59335c659f05698841a063bff3d4a8ce23a8f808ee22b3bbaa87653

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
29b445c8c6460de270bc055d8f70b354

SHA1
bc0b2e3bd0f0fcd701afd5d6069a7fe7e5104d14

SHA256
193fb5d678323818d02fd1b146b20fecb548bddc5235757e6d2a2d742536a679

SHA512
e845b2eba832a3966196904cbfbff5a462453f4da2740a1de09715c9aefb87b653e694725bac132b0da06713e550b10c6589c406921dc0e582d85cdc88e88643

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
36KB

MD5
d251a8c8ebd0be406381fed678bd45ec

SHA1
db41e5424e7a31207511e72989953a4ea0d58b98

SHA256
9f4d81122feb9dfaf167603d5eec7ddec6864a939b8aa36400543cbc8a2c8c8c

SHA512
b4c65aa567b68220689a2697a893fb9290dc9617f31a7e4f0c5ca21f68fc7c78b6e4255a06d3ca7606fb1fcc7df9ca333c15ff132121ba7b1d06ea22b8a5cc2f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

Filesize
48KB

MD5
0f2b395cc63db1bd8a5d093e558cbdd1

SHA1
833d0657cb836d456c251473ed16dfb7d25e6ebe

SHA256
f3797115dd01a366cce0fbd7e6148b79559767164d2aa584b042d10f1ffd926d

SHA512
e8a4ada76efb453c77a38d25d2bbd3a7f03df27b85e26ba231791d65d286fe654c024b64f9d6869824db5d1cf59e4d4eb662f5a55c326e5e249144ae1a66b798

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003

Filesize
44KB

MD5
d732347f6815841f0e06ed29eb4feb85

SHA1
fb48ed60e0118c282068d2ac773eff8cfd563f44

SHA256
b808d430644948438edb4d2db5b36d82ba3b095c2cf9829278ac22f3c5c217f6

SHA512
4ec3ede25fe4ba2e1c6bbc0ec620dc06387dcbd28fccd15e91c144e4afe49ee06e28246943c3ac2d4a81c9b9243f6aa7bb60792306fbb8d3905d738b3ee17b22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004

Filesize
20KB

MD5
357b4145c3264fe69f8c412e823adeed

SHA1
5fcaf1043bb72dbc719ce56a173b3da59db7ebc9

SHA256
4bf695f9d9be4d4e815594d2b7443042ec14e4dcbaa6d35031cc0420b8009410

SHA512
974c8b0220e6490324f5eda5590d4a895d7d67b87414ca1124dd01ac92e3bec033623bec67b4441fd6b69bb9034d4ee8210ee0f92fdf0a8efb6546e62ef8f7fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
25KB

MD5
6fc61a5ec487c61871fdf93b525cb6b7

SHA1
207aa49b68aa64b41aaad80e79bb911815113801

SHA256
b56579a6b89026425b1b4e115d9236981b164c57f0671a7cc185bc081f843101

SHA512
dbf447f27ef7254a0bc4beb5da73c229a7cb7a99042bf1ca833590b51c050e9730064e2b6d64e0ac67b837f9c08cb6638087d438ff9e1769868201c001e83f66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
20KB

MD5
0f3de113dc536643a187f641efae47f4

SHA1
729e48891d13fb7581697f5fee8175f60519615e

SHA256
9bef33945e76bc0012cdbd9941eab34f9472aca8e0ddbbaea52658423dc579f8

SHA512
8332bf7bd97ec1ebfc8e7fcf75132ca3f6dfd820863f2559ab22ac867aa882921f2b208ab76a6deb2e6fa2907bb0244851023af6c9960a77d3ad4101b314797f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
21KB

MD5
c355eafacb45a36e6f6d6dbd52b55b95

SHA1
2016f7f6ab53f96e21204b4dee24a9b8156f5283

SHA256
2dbe980b7a73c9d1cc2779423ae78b1e4521732934c87a29ef5141deb8e436f7

SHA512
0cc5cfcad9659b6d2bdf9f28563905acf3cce6d2a9c3ca7b07d15a2700aeabaa162ec0cf9cc04ee86983470924d5502b4d4ea0e74e00eb31e523f463ba025dee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

Filesize
59KB

MD5
4bc7fdb1eed64d29f27a427feea007b5

SHA1
62b5f0e1731484517796e3d512c5529d0af2666b

SHA256
05282cd78e71a5d9d14cc9676e20900a1d802016b721a48febec7b64e63775f6

SHA512
9900aecac98f2ca3d642a153dd5a53131b23ceec71dd9d3c59e83db24796a0db854f49629449a5c9fe4b7ca3afcdd294086f6b1ba724955551b622bc50e3ba1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
21KB

MD5
b0e31ea842de3ba057c3995e64bc60ec

SHA1
a7f2b2eabda48324df35f69b72a4a2e4fe374bc1

SHA256
b7dd086912ba39cb4e7fab3290ddbade1d4ec77309a96f0f9738c9826406bc84

SHA512
8629ad7c4464586ff3b5141e1e5c58701d11f744b2a36852269fe0195109d6d6d3ee2d47c636939a6a2b20664ac0697a8e422eaaa3b5f512d472890e94a598e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a

Filesize
65KB

MD5
98dacda0e5963458ebc5e1eaf24fc8bf

SHA1
7e806b57843268dd74d704db9170dd2b46603afa

SHA256
a114ae14eb4aef4aed440fe33d9451670164f0090c4717db5c49f64c6e99272b

SHA512
5dac472b86d19a61a63444a94b3c081d9282a5e7851e357aa0d627ec7a75ea4999b8610473a2928b73c93643797d46f0a84edf36f4903839768fc6363002af9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

Filesize
85KB

MD5
93eff374ce4c9df594680f7ab3cf81d7

SHA1
2f78f384ba77349897dc38c5ad25a2f20e4dcadd

SHA256
f59e8acb0d07095b6d5dbb3b0dacea3857c7e6302578080cda0a94b257c5efaa

SHA512
958f41fe85623821f5b9169aa5bbe25bdebfadbb9f4ad3edd8c04371863ddd98cb1b55392d61cb7fb31a379a897bb31aabcc5bc092f60abc2eb569cb3f1f2ac6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

Filesize
150KB

MD5
0b1dfab8142eadfeffb0a3efd0067e64

SHA1
219f95edd8b49ec2ba7aa5f8984a273cdaf50e6c

SHA256
8e2ee8d51cfcc41a6a3bfa07361573142d949903c29f75de5b4d68f81a1ae954

SHA512
6d1104fd4cfe086a55a0dd3104c44c4dba9b7f01e2d620804cf62c3753a74c56b5eae4c1dc87c74664e44f58a966ba10600de74fb5557b3c6c438e52cc4decdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

Filesize
20KB

MD5
8e7b638bfec7451db22d5f6d54662360

SHA1
22c4f81a1216d4b1b48b5f66bbe6aeb7c7bee595

SHA256
9ca11ec635e88ea63b7ba633594f5323cfb61ee4499c42b90f3d9968accffc6e

SHA512
024db23141f04f898cb434c7624d23265c3c1dd702f15e40b793060f38cd4be3416bafdee02a72027e41dd2c5fba47ae8765a0e62c17665e8287eb782eed1373

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\031e6654100ed80c_0

Filesize
318B

MD5
4a99c44bf5c1168886fd13628bbd05e4

SHA1
e103c7a98f54a3ebefd6bf948a4e50b323d1b65d

SHA256
51dcfe283ee9c6ae3c7a974cb99658bd366ed0aeadaebd303cac3cd91571ad40

SHA512
4b36dc9a26344c76c63b4adcc56ed7b06d92817c2a4d9d7e2f60fe762d2f904a59ae0bdf38c73eca31c545d14c70203c2ed9b9aee14e41bcfc746988272d5019

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\03adc57d961bc26b_0

Filesize
278B

MD5
d3631c6a3c5f887ab018518eeb8238f1

SHA1
166f30431368e93a5d905b77de8947ef37f7475c

SHA256
9c4a21894ea16355a677098d7e182af25a2b73e1c876675045469776664f22d1

SHA512
e9defc43992ac269254ebab35f87d609d2c18ace7830e8b14eb9c397627bc3e9fe34f30b920c4cfe18c1cabbc55c99c689ee6eb4999fc9ffa34dfc5e340f6d46

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\05f98f3e8d436ff0_0

Filesize
221B

MD5
1001b34eb07c479a1f7debc40d527c20

SHA1
c2117e9a22d9ca18927629ac539ff5e1386f7fb4

SHA256
06ea04dd4bfdb6dfc028a8a5d7095d80ded044d6f07f16a3fa375797b045b49b

SHA512
78a720be531b13b31bd09f051b9289dc8a7cbc0cf57a4bbe175db4187ff691e26db9825a5abec148de049e8a567388c6912fa4cb306bb174cc86ace9f0d4788a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\070b60e043709c21_0

Filesize
312B

MD5
f4594b7eb7f3bb8321ef4d1d22ede53f

SHA1
ecac24ebe330d96c4a074548faf01faaa9b1a76b

SHA256
548d9dd12cc98ee215402b853452fdf7a00a2b54ddf4f3bf65b12c392118ffed

SHA512
3e26ea1fca0b58f802362d28fe76d15c2c42b69996173c3db5514442fb28878d31416d7ac5739474f28713e01a66c57bf00286288929db710889f69c1a61d77e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\07a0c4a3e1abceea_0

Filesize
254B

MD5
75d0c3a19bcd581c8295ac4418c4ed85

SHA1
2eaf957a69a6743180eeaa80e150aeddc34e2806

SHA256
64e7adfd8b6ca09f150efaecf4b93b31437dc61acd4bcba3441a2d12de98ab2a

SHA512
458251a874530ae0076775b61ff1a016f185b177118cdd9c61cf9d1db0c0ae65b4d7d650904bead6d90d63346c8875422b5b8e06f48ec0c22c83f58b814385af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0890dc9c8a3fdfa2_0

Filesize
228B

MD5
397a381bb25420af1227f29555ce584f

SHA1
c6d00d68c1cf4457a54a9b431238b8d29bd47be7

SHA256
dd6f93b9f56bce82f584b66a40592a2fec994360e8c5cf213f897274154ab2f6

SHA512
f8dae3f6b91acbbbf70a7850e66ebcd3bebc3342bd233a04ee2f6c5a24983099c440237ce706e87296c608e70831fd3e221c08733d50049746112df7b6518453

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0cac38a50a5fa198_0

Filesize
312B

MD5
1c1ff206303e059c2609abe9a3137b15

SHA1
73cbb07e92fdcfb6368e1eb7e763f20167b9754c

SHA256
d358d057bd8527ea1ecdf9f597d051e465e37026d6564b4aa029a09ca180d352

SHA512
c7446cc492d17474a0b53c36ff95a6685b82b33fd6abe24c8ce5bd400e2a972d4da3e69a792d95b36b8828223e8303c1660c30fab8e98a7a1d2bba61a107e5be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\105509c2ca9b228e_0

Filesize
312B

MD5
258047fb5b5e422223d7db32023bb9c6

SHA1
c45260676d8e85dce179ce54e2e2cb73d5126b92

SHA256
f8e0752036dac0db01e5e3efe320a858413e44e774ae7a9fca51897cfebf393e

SHA512
73b0576417a69fb1ff1b85ee1455d8dc01f3de38ec48cc3cf8714878e1b881ae763fd1af52dd8c7cf0c33908b103368ead2c518f0571511b7bc29c5bb1b75b24

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\180e414f012d8ae3_0

Filesize
309B

MD5
ff8de1a0477ef8b0fb672551ff32cb27

SHA1
cd39b343c35d3c1f44fe966f0660213d937d2976

SHA256
897508f67eecba520ae2ea89796dc92022c1de9a5084dc89f3fce3f96315a7f1

SHA512
0cb686f12bef3822579dbacc7f409733bd4ed8ac2870203fcd5461494127d357866e18975886e6548c80675deed861b625ce24ab905b16b0fac69a8f5475715b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\1ddefb550a28cc70_0

Filesize
253B

MD5
409ca74af6c2656300615a50140ef802

SHA1
fdeb959d62fa88538e34c3a7a75a41b52a207a54

SHA256
7cf3bff38fbc54c4640d839e89fd0f26e793c6416653f9a380c88c11af93229e

SHA512
3c8839698b4249f50087d0fe6b3ae0c150d086b0ba10fe60f9db0a193dafc3eada300c37c891464f0477256d3043f9daa3af0563f3ebd060f00a41947a0d2468

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\1fa28549f73acd32_0

Filesize
270B

MD5
7de16710029cafb2ad736ea9191c9861

SHA1
a90c2e8bc88aee8a6ce35b2c3fad6af675ab9cf7

SHA256
77e6abd95eeefc6e0d9f142160aa51c959e87badadefaa4f398a629abe26e63c

SHA512
914c38406993bcc4f20a800346550c6b045172ec4678eac110f046a700eea7128aedb08dc6f892057ebe4ec7d436545bdd386aef306ccf31fab3ec14bb0689b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\1fda1c58ba430456_0

Filesize
312B

MD5
dcf82bafe1d8ff3a547d0347c519f90a

SHA1
0773e1630aa985f60a8b5ee2ac3afe447b2c4887

SHA256
44b6230d9c9670bd90ce817631bdc9eba8c17ce23a556e79ee1ae4b12b3b7115

SHA512
3e7c34c91e37f0be1ee28f11823559eacd00f9a0ff22b827dc91404a54af99eb9b6b62fdd72cec6cb1057151c807e97adb787bb23a2aa44a6053e1e30103dda3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\230626c44da2ff73_0

Filesize
264B

MD5
c135594563f3ec470e4704b5901b7ec0

SHA1
f6d23d5e059f19954eef6658cdb24beae5787365

SHA256
e0be1c451c88b1bc4d3e5534ab6d1e2d8ddf6464b1a19691ad4c4ae508c44d75

SHA512
6e1d3443fc7208adf132a01acfc50aadb5ab9093f3279e6debd7775555f23e2d88ff7329acba3fe2439dbee05b249a5320cc9f7856009619554fa108bebf186f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2396bd2b5b04b29f_0

Filesize
312B

MD5
e5dab3d5eeca8d1df5542e3a29de975c

SHA1
89c77e8418c471ecda2892f837da4fb36e1c0853

SHA256
a06bf6620207adca33e7dde9bbae8b539ee218c707fa54aa7ddecfae94ef7e57

SHA512
3bbfd791a81c8d2c8421c75ac52bccb4e454a3190f0137839904bd940c1d458667f11211e8b19d595ca1255307139e84af687c9c8d580f3efaaae265ba9e55a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\243cf03f2539f4ce_0

Filesize
312B

MD5
039323a9bd0cdf76af8274afdeabfcf6

SHA1
ca8e433ea56eb0d9a4ad3a5cd14f0171249d8f3e

SHA256
bdbfdcb1c51e03a999f52dac3b9d04d2f7de92f7a5bb7c692785d9998d752b2d

SHA512
092c49d147734ceb0875343f5b6527a8b0c76448cd25d0ab7adbe7ce53d95cdb5d166a7bb72509d71c899152e73402bc8bf2d1978bb146efa49f90dd4c3bf6ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\26834b29de2491d4_0

Filesize
312B

MD5
280c2482b1b36575998329154d9806ea

SHA1
49b89bd64d528b46f0e784863379956d873481ee

SHA256
570c1be2ab06f4458deb5418c18e13c481db8acb36568ba5c075057896954dc5

SHA512
ec8ea1d5e7e55a1120707d806e150a8ff748099d3a20b7279e730589a0630a9afe7651052d948ea8aff0fa2c1379510e390612d2764750a67ba922c88c65cf5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\26dbab8f05a12756_0

Filesize
275B

MD5
459997eaf4012b652a83a09c0a0b80c6

SHA1
d5d53ee6bb6a5a31170ae314656813fad5b4acc2

SHA256
faec4843adb07e6d528823511ddbea4a87ea2c921093cfc6fb4ca57fad99908d

SHA512
68a42dd28b2346102ee322102c43a8fa18a6e8d5862638574acf38b5818f6d3026b90f10d42a6cd3c2b915c1bddb2359b3092a75c718abf6f1fc13fa194cb7fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2704caec6cde94c3_0

Filesize
270B

MD5
d668b0bb3a6d103acd72c5015c25aa1d

SHA1
189dffd49f867092b21992411b7460466489dbe0

SHA256
57f4e63461db03304f06962ba4f48e01a0608c858120d75ec967713850dd417a

SHA512
06d714eea434c2c7356227bd35a79a72cbc2a4f53c611c5b8e381061fdba10227267004f023063f236c1598e7f697ea267a4c8d252e7d12135a7a5af9cfcb409

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2786e5263ebe2acb_0

Filesize
312B

MD5
6c4c46ab8c50e603f2e9ef1d923c33e0

SHA1
60d4639fea50b4fb240205a51eda07ac4b3318c8

SHA256
982b6793e33a052dbadf5adde79ffd56d18c0c6e4674eb32c24329e0202f095c

SHA512
2f05d6c5f8484c49712af525c57f7d678a4dc0c96c6c8ba4b7fe84a4c522df720c662937d57f74e1dc94ee2f45087c28232eca4f239a0773e1d4c9733ae48110

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2b0a2e866fdeabad_0

Filesize
223B

MD5
fc825b5c55af2a05381b08947911321c

SHA1
a34ffc2a805caae7489ac5586a3628cbe8318c5e

SHA256
755dee2e708763d8b9f8812e63794b818b2b8d4cdec96c6479a02947c87e3e45

SHA512
d841523d776f9e27867d5d049241c10c1158f1de72835a8785928e4de79ff0a4a6636ae365862872d747dc9cd0c5a415539a8cdc1bed8b0d07c0000c53e28861

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\3407e3dcd0870f4a_0

Filesize
312B

MD5
880263af131e3a56065f75d8e4620fd1

SHA1
21d03902682405e01e8af2681cea1b4157a19823

SHA256
81a9f6ea6bcdbefb001ebfad605048d4eef9b018dcbb762b76950e8d35168fc8

SHA512
b96e6ef77ae0ec394b472afb33146bbee590ced587afc9cdfee704d61e4230c091cf1d52b4e17f7058589f3d7488b9a271485c06b943d0d6f8fe457abc9dbeb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\375618093fb4d9db_0

Filesize
312B

MD5
6f62545e0e8532e194593a9b2d3b8ce5

SHA1
69bc177a7407273edd27727701dc1e0988726aea

SHA256
93e3145b27fad1a27e4e3bcb8d830fa0fa0a67f285835e75721844826e947aca

SHA512
c5bd518503bb93b3174ba3eb37d730d8c62730a7433abe0dddb0f8b7e169db129845e89a9a09055ded7af16996295d37ff21d805ffefde225214cf55e1471f40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\3c1b71d6c92f4ff2_0

Filesize
274B

MD5
b73262631dc2940dd672945d08b85615

SHA1
80dde06332fe4e8be3e9e050d0feb09bf2a69399

SHA256
175da9f2e3e718f721cc72373445677c97317258d91719d976308b733c62c700

SHA512
d4de8172ff8e09d853caaf815358e1930f9e22885be35a353acd10b21ba979d13554c381dce133304a4e49e9f2196fe4e52f8c963a48c36f0e7b6e1bab97176e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\40767c6ffa0c49cf_0

Filesize
275B

MD5
9bb32822d578fd07a4ab94c41a23a020

SHA1
de4ea8cb279a9fb017e21428cbe8583ed5e29759

SHA256
55d22680c64ad3fef7ba53aaa2e832299ea4beed29e6f8adaf5f63b25f32f915

SHA512
10a5ce6c087bddb0c595b791de3533a8d8fe9ca3054506a98ae5c187904becc4387b62a0aeee53bbb55dc9a873a9d32d8316567b772c3f9e47300a1c3afb0bee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\417cc1612ca06b48_0

Filesize
312B

MD5
d8a2f60985ae8526167e0620e8543ab1

SHA1
ea068fe50a4b2c550e9c33e64cc9afdf74793955

SHA256
15670ff3bc07895515ee4434ac88279bec794fbd8fdcfb2ee31a31cdeaaac001

SHA512
94b5c6298d316bd7fc1e851f7c1c8f162e5ac071d5a47ae9ee779609555551a670ad8a46b95d64979500ad1a2fd135f5c6c4bbed6a547554d173ae96c7e3ef2f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\45d946099acc6255_0

Filesize
255B

MD5
8936aa2fcb2b5700cd774ae84c1b72a2

SHA1
a6b720c3cc9fd034c9cd916196d2a1f82796ec13

SHA256
cc106991db14a081b7220a4ba8685602874b9c7ba360b579342b0728f76a8430

SHA512
97fd25cfdc93b54333e55437d9c92568bb123ff8ea4457e63a3d47c2b984f83cba50838ee0fee21821c28a24f7cfe92be471e8dd576bb429cc725f767709a1ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
1e5a1ae815418c7173169c24ebdf382a

SHA1
1c73735c6bab3e238c153fcce6be9a0f80a5404d

SHA256
06475f6f1f020583e46c110dc1db6a70c52c2c055fd0ad2cf77504d250e7fae8

SHA512
2d7b7fa80f3db055e655ed72471ed61b8f93d96b76611a1a024621481eef66f5ff21393375175c3f2f66f4b414cb9ab5577faf823f9b79cada5671aafcaed12c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
a75341c1e359f2567cf448b33386d669

SHA1
3ba0b34ad7ce3fc993e8264e810208fa9adb504b

SHA256
78bfbbc4ad614d6fee4e046f2741fd3024d74908b2fd15b7604348f1c1fb9b6a

SHA512
8c910dad5ee6d8a9f25cbda60a3d41a9a02dc2539849ec706994c3614f3a603c5c6a867bdced169a0ff37d6c0153890c06f08a2526880301ec76a059ef712ad9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
0292dc992808fea0f4465f05e60c4bdf

SHA1
10a2b5449620b5a02227179c32d5d771b64ebe8b

SHA256
edb88bda7b256008ab577070a26f90b00f8ed1d606d205955136d76d6e995b77

SHA512
e52822e3a5834283ea36c4471fb5990dcc1fc30d156f0c868429bd269c06757b2f96eb06feda11b6aaf1ed2462e02a7467820d3e44b14b2fca1d83ee85f09089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ca162b14c7946e4fe12c3bd5e8502278

SHA1
16da282a1ccf8b78f3ad0919404db3ff0b36d286

SHA256
fbcba454e6cfd3309467922d17880c6d196d0b2a51ec63a47b16c2d4b08ba806

SHA512
cccb8ddf2ddf893096235c7ae61b66ccdc16fbe5591361181502341ea667105444e44873febdb03f09fff20757d94f2b0a3503c5fdc0331b0ed90fdc840cdb67

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
11eda99c0e57b13a250689caa49b3111

SHA1
e2244e9b980c3b405b0eab2128b2833f92014555

SHA256
73ea925b929b85a98a1d390e600d17643ab91b07979c2ad4e5f601b7a66c9e91

SHA512
ccc0b401654d063003f1546b3d894eeb6358f8d3abc330528ba5ff928134b2edbb22d08079ad0d01ed4ffb0b7d1fa492449a25daac1fdd647faee523cbc8fb8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4f9ed10dba4f3cdb4fcb2fa52a8a36a9

SHA1
d72eeffdd477515bc2395b7af2c087cea9efe874

SHA256
42cdac124814f1956eab7d1a7e8efdf898f2b9cce9dc331f9a9f160b0d493bfe

SHA512
680b2c18fa5465207c9b283ac2295d42ac97bc530fd9a9048d06834f0268b69fc8ccad928ad68e16de2bf3e5ee1dfea28daaa8c2235347390e1b7834424c59ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ea7e44316fa390cca464c32bbd6a9738

SHA1
4c200354451fdd557b48262d7bdfee97785722a8

SHA256
b9869934aac9b1df2cfee31e76218f1f3364396633916bf95ef355462eac69f7

SHA512
05680728d5ee264fd164b0e9efbe6d719d1886d7e864a33bd589896976d679c5513d355018529a4a4b5366c3fa9016657afa2f33e2b77b1c48ade57acd3249aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b65cbb665d16581b544dac049a00324f

SHA1
8d767ad6e472eb60d9e128658d54faf1a5dad0f9

SHA256
828aa37c2362514cff3050a87ebab788d21e88e8a25a0da8215424bd35ac864f

SHA512
c22e4bb2d19ab18d1052f73790d7c2c1a406ad3135ac2824823cb682773fd71a7760d50181281209d2fae4d8c8d96af7474cbb9fa56d3a68882a606750f4b9ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
7916edf7ef0b2ab48f2ef122f1e1a386

SHA1
abce0906f1e0c95a9cc316a59c8fa7c2661338d6

SHA256
a6a61ebe33896f5f29aff71e9f4001b08bc6f469b523150f4d09f18cffffb5de

SHA512
17d04fedaedd1a45b4c30c4c2f9d1f34fb378827fdb410513f7876c364ad43aef044196d1214bbf185158e6a049cb6bc96bdee8d195ba2fc0fe128a76a8f5768

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
137KB

MD5
aac39f423206dac34d8d8a4988dd5389

SHA1
aac2a7c186a05cc6433eb38b30e65549de1ed7f7

SHA256
ca7867d63fe1afe1f16a0ca9211707c595bbdd54d64b8cc4555506d0068ffca4

SHA512
66a540e670cb3d352cba2d823d218f0030c64a06f17129bbf229571aa325ea840861cd146039b57f7a48cdd7cca57731b7c6a9583ce0c5789943885b5f7569c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
156KB

MD5
accb9879422486d580080bc245ef1e71

SHA1
fef59f7b1b8253fa48deebf05ba3fbd063f2d553

SHA256
939189d050b752cc5cecf8df377fa770d5bd2bb030f0c9ad9099f20a5702fdcc

SHA512
70120f5e44d8fad2db3b180f86bbf9318695a11fb79c981079b64426d337a56561768465ba5e6f7806406fd2b9a6e8761c667b727695b04a636c46fd3cad4329

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
138KB

MD5
79b567c965d2a6a2a1785c439e15ca45

SHA1
8ae72946827fcb0468fe0fb1590d67cf646e2067

SHA256
d854757bc62a15d38ac66b58b7cb2fcfc366bced4ad27002222def86065f1fb9

SHA512
a3250da402a45c6d4353576c652086f16196fc2a63743e61b16550d3ecd86bbb2bba54402f9f9869122b46a05020f267168e8a6d97774a5e1844e343b755c7a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
105KB

MD5
cf1eeb7d0978226d9f7cf40cb1ef0d50

SHA1
af0ecd070d628a333a6a238b04c4d615d86f9da8

SHA256
a3e5197e9c06cd92a4becc6cfe9d589ca3c918a34eaa58e3fb1769e114f9de00

SHA512
a18664478d7626891afa3ffa50adb82b20c172f206666f13ab33d04ad14b02f6e4c76710722117bd6baa3e7bf3e6dc9c57a6ac4b85afbea0c121b360e42cfa16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58118f.TMP

Filesize
98KB

MD5
1bc2c1ef43b2842ae26f12f37e2a685e

SHA1
6ba4a2a9687af2b383fd78a7a15fa2eb7c1041bb

SHA256
7702051b1d98ac27f9c6cc0247167fc1660b99410e2f383c7384f82393c55a88

SHA512
3f38ec9ab4e816e2c2aed74b21cbb95c6149b1e166338a3ad171629c890f9eacbc5a61cdc9617a5643daf2f424ee4c17975f796c300ae04f4b7f5c6c01f6107a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Downloads\Ransomware.Hive.zip.crdownload

Filesize
6.6MB

MD5
33dc6cf9108fa7a395d632c29021791c

SHA1
61ccffbfb8f2458be139aa1d3c9dd715f25cd06d

SHA256
af9e8f301a3677b457345921d7ee765a842eceb7df107714eaffc6193bfc6bbe

SHA512
5b7206cd076e313f15a13c4f6278ea80c109577530bc43614efc631aeb8b53f8b0abba1135298ba6b6b7fa2f19321ab673b257d3b4c0cbc95bd4c50c8040466d

Download Submit
C:\Users\Admin\Downloads\Ransomware.Hive\hive.bat

Filesize
176B

MD5
af3806b02937353a2dc48566145b4f75

SHA1
58884e1c23eb6087a164e1027cd6fd22d3843e17

SHA256
f53b9dbe7275f408254c3e3d43b51d3e467ae68df4980b289f56a5b1436994e2

SHA512
a2c976c7161452ad69230eb8984874f5c7007866793eef7305f3e465fe78109a4c9c22c0412759719671cd136dd79dfae6e507df0be776feb4748e63316b7b9c

Download Submit
C:\Users\Admin\Downloads\Ransomware.Hive\hive.exe

Filesize
764KB

MD5
2f9fc82898d718f2abe99c4a6fa79e69

SHA1
9d336b8911c8ffd7cc809e31d5b53796bb0cc7bb

SHA256
88f7544a29a2ceb175a135d9fa221cbfd3e8c71f32dd6b09399717f85ea9afd1

SHA512
19f0879b1c54d305ab7a97a0d46ab79c103d4687fe37d5f9ef1934904eea48a1c66b1ac2de3dace6dc0d91623309287044c198cb0b3fc9f8453fbc9d1c0cae8b

Download Submit
C:\Users\Admin\Downloads\Ransomware.Hive\shadow.bat

Filesize
57B

MD5
df5552357692e0cba5e69f8fbf06abb6

SHA1
4714f1e6bb75a80a8faf69434726d176b70d7bd8

SHA256
d158f9d53e7c37eadd3b5cc1b82d095f61484e47eda2c36d9d35f31c0b4d3ff8

SHA512
a837555a1175ab515e2b43da9e493ff0ccd4366ee59defe6770327818ca9afa6f3e39ecdf5262b69253aa9e2692283ee8cebc97d58edd42e676977c7f73d143d

Download Submit
memory/360-16407-0x0000000000CF0000-0x0000000000DDE000-memory.dmp

Filesize
952KB

Download
memory/360-1664-0x0000000000CF0000-0x0000000000DDE000-memory.dmp

Filesize
952KB

Download
memory/3660-308-0x0000000001000000-0x0000000001263000-memory.dmp

Filesize
2.4MB

Download
memory/3660-19087-0x0000000001000000-0x0000000001263000-memory.dmp

Filesize
2.4MB

Download
memory/3660-298-0x0000000001000000-0x0000000001263000-memory.dmp

Filesize
2.4MB

Download
memory/3660-309-0x0000000001000000-0x0000000001263000-memory.dmp

Filesize
2.4MB

Download
memory/3660-3610-0x0000000001000000-0x0000000001263000-memory.dmp

Filesize
2.4MB

Download
memory/3660-13076-0x0000000001000000-0x0000000001263000-memory.dmp

Filesize
2.4MB

Download
memory/3660-5288-0x0000000001000000-0x0000000001263000-memory.dmp

Filesize
2.4MB

Download
memory/3660-7397-0x0000000001000000-0x0000000001263000-memory.dmp

Filesize
2.4MB

Download
memory/3660-20513-0x0000000001000000-0x0000000001263000-memory.dmp

Filesize
2.4MB

Download
memory/3660-21942-0x0000000001000000-0x0000000001263000-memory.dmp

Filesize
2.4MB

Download
memory/3660-21944-0x0000000001000000-0x0000000001263000-memory.dmp

Filesize
2.4MB

Download
memory/3660-21946-0x0000000001000000-0x0000000001263000-memory.dmp

Filesize
2.4MB

Download
memory/3660-21948-0x0000000001000000-0x0000000001263000-memory.dmp

Filesize
2.4MB

Download
memory/3660-21950-0x0000000001000000-0x0000000001263000-memory.dmp

Filesize
2.4MB

Download
memory/3660-21956-0x0000000001000000-0x0000000001263000-memory.dmp

Filesize
2.4MB

Download