d51b0a4623540a8be1ea103057b87cbc9433b5375f7cd70b3e7419ca50b42c36

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 08:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe
Size 16.6MB
Sample260720-ks7zdaex6s
SHA256 d51b0a4623540a8be1ea103057b87cbc9433b5375f7cd70b3e7419ca50b42c36
MD5 c06661edf5fb9a5cc7bd13ad3514649b
SHA1 4139789c419c304f6d5a38a9a61adc1797c7c136
SHA512 bb78dda4f94ded713d36d2808446a2889e48101b241ecc287161f0af13ac254e811bb9191f0c13fcb3304db1454055b702c19281481d336c700c620571f6294d
SSDEEP 393216:yJF6Kne2r7y1i5U5guFsd9oiH2wM0hCkQae9NQIRG+qv3RrRxnFb:yz6SFJ6Pqd9ouPM0siPIc1jx
TLSH
T17407330DD180807680EA9AB94FD4481FD4DF0BB7D8B82EA9F55ACE79297329C4C5F742
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery spyware trojan upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 15 IoCs

resource	yara_rule
behavioral2/memory/2464-0-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	UPX
behavioral2/memory/2464-180-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	UPX
behavioral2/memory/2464-202-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	UPX
behavioral2/memory/2464-224-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	UPX
behavioral2/memory/2464-226-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	UPX
behavioral2/memory/2464-236-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	UPX
behavioral2/memory/2464-238-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	UPX
behavioral2/memory/2464-240-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	UPX
behavioral2/memory/2464-266-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	UPX
behavioral2/memory/2464-268-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	UPX
behavioral2/memory/2464-279-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	UPX
behavioral2/memory/2464-302-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	UPX
behavioral2/memory/2464-304-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	UPX
behavioral2/memory/2464-318-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	UPX
behavioral2/memory/2464-328-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	UPX

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2464-0-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	upx
behavioral2/memory/2464-180-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	upx
behavioral2/memory/2464-202-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	upx
behavioral2/memory/2464-224-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	upx
behavioral2/memory/2464-226-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	upx
behavioral2/memory/2464-236-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	upx
behavioral2/memory/2464-238-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	upx
behavioral2/memory/2464-240-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	upx
behavioral2/memory/2464-266-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	upx
behavioral2/memory/2464-268-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	upx
behavioral2/memory/2464-279-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	upx
behavioral2/memory/2464-302-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	upx
behavioral2/memory/2464-304-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	upx
behavioral2/memory/2464-318-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	upx
behavioral2/memory/2464-328-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1476_408758434\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1476_408758434\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1476_408758434\manifest.fingerprint	msedgewebview2.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F	2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 0f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 19000000010000001000000014d4b19434670e6dc091d154abb20edc030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f7e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000052135310639a10f77f886b229b9f7afc1400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab553000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d0020004700320000000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa42000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 6b0000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab50f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f19000000010000001000000014d4b19434670e6dc091d154abb20edc2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 5c00000001000000040000000008000019000000010000001000000014d4b19434670e6dc091d154abb20edc030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f7e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000052135310639a10f77f886b229b9f7afc1400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab553000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d0020004700320000000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa46b0000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab52000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5700	msedgewebview2.exe
5700	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1476	msedgewebview2.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 1476	2464	2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe	88
PID 1476 wrote to memory of 3464	1476	msedgewebview2.exe	89
PID 1476 wrote to memory of 1968	1476	msedgewebview2.exe	90
PID 1476 wrote to memory of 1968	1476	msedgewebview2.exe	90
PID 1476 wrote to memory of 1968	1476	msedgewebview2.exe	90
PID 1476 wrote to memory of 1968	1476	msedgewebview2.exe	90
PID 1476 wrote to memory of 1748	1476	msedgewebview2.exe	91
PID 1476 wrote to memory of 4196	1476	msedgewebview2.exe	92
PID 1476 wrote to memory of 4196	1476	msedgewebview2.exe	92
PID 1476 wrote to memory of 4196	1476	msedgewebview2.exe	92
PID 1476 wrote to memory of 5056	1476	msedgewebview2.exe	93
PID 1476 wrote to memory of 5056	1476	msedgewebview2.exe	93
PID 1476 wrote to memory of 5056	1476	msedgewebview2.exe	93
PID 1476 wrote to memory of 5056	1476	msedgewebview2.exe	93
PID 1476 wrote to memory of 5056	1476	msedgewebview2.exe	93
PID 1476 wrote to memory of 1048	1476	msedgewebview2.exe	97
PID 1476 wrote to memory of 1048	1476	msedgewebview2.exe	97
PID 1476 wrote to memory of 1048	1476	msedgewebview2.exe	97
PID 1476 wrote to memory of 5700	1476	msedgewebview2.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe --webview-exe-version=1.4.2 --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2464.1120.1238509621421935274 /pfhostedapp:e1341042fdfd788de3c22c070c33bc15f5e4d98c
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView /prefetch:4 /pfhostedapp:e1341042fdfd788de3c22c070c33bc15f5e4d98c --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffdbd115fd8,0x7ffdbd115fe4,0x7ffdbd115ff0
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView" --webview-exe-name=2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe --webview-exe-version=1.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1804 --field-trial-handle=1808,i,6272864253777727604,13616540906129204197,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:e1341042fdfd788de3c22c070c33bc15f5e4d98c
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView" --webview-exe-name=2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe --webview-exe-version=1.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2096 --field-trial-handle=1808,i,6272864253777727604,13616540906129204197,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:e1341042fdfd788de3c22c070c33bc15f5e4d98c
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView" --webview-exe-name=2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe --webview-exe-version=1.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2436 --field-trial-handle=1808,i,6272864253777727604,13616540906129204197,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:e1341042fdfd788de3c22c070c33bc15f5e4d98c
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView" --webview-exe-name=2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe --webview-exe-version=1.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3536 --field-trial-handle=1808,i,6272864253777727604,13616540906129204197,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:e1341042fdfd788de3c22c070c33bc15f5e4d98c /prefetch:1
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView" --webview-exe-name=2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe --webview-exe-version=1.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4100 --field-trial-handle=1808,i,6272864253777727604,13616540906129204197,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:e1341042fdfd788de3c22c070c33bc15f5e4d98c
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView" --webview-exe-name=2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe --webview-exe-version=1.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1852 --field-trial-handle=1808,i,6272864253777727604,13616540906129204197,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:e1341042fdfd788de3c22c070c33bc15f5e4d98c
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5d41a6d4df683616b17233db660014154130e55eb8088cae6ea7e7847f9ec1c8
MD5 930b0a3b76e211cb448a6bb8f7b6b0f9
SHA1 f9806e71e1f9f0bc3ef722aa20a1f980c4cfab94
SHA512 9e95961858df689a143c2f29c71eb06a32d5c0347c562d74d8f5900886199240c3859128ddad67fe3cbea08f5402a8dc980df6dcb52880d09f2bc7b04b4f4b14
TLSH
T14CD012333A410238C4203533014371080440D90F410941045838856E2A465641D02492
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fc8d8999b33d1433f5bcbea4d966a7e80ca482296cbc3bdee6be86d9a623ab0e
MD5 bb73e9519f567e5d145533d0a1158f97
SHA1 80a1f4e59842d7fc994174ef23d0003ef347544e
SHA512 8b41836ac1a9434096c5f21eb77a60b93cdfd07db688ecf5c468785c2640c376fe8ea1012d58b72e77d373e61631a1bf816d2b2a957c31857efef1c5aeed94ae
TLSH
T196D004317D400114C4103531015151100154DC05110517040430005514C37145441151
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

0e1e56d3-cbc0-422c-bbf9-15e3326e31f1.tmp

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\Default\0e1e56d3-cbc0-422c-bbf9-15e3326e31f1.tmp
Size 6KB
SHA256 84f1a65f0805dd4a0f1aa758c96ff0e19766a26db7c95a04382bd98a39bde584
MD5 63d6af0154660d64288fd99e28d51dc4
SHA1 983750d4159bbd7e15f3706bf86b378e863f2139
SHA512 8398a2d86434291b5f7d22969b55c0fc6dc94c436cc8b9b2afdb611bca776543ff6fe6da7c8bfea02d4e5c2858be8dc068e351ba9ed8d71b14c78359935591db
SSDEEP 96:ste/dLxvNeb9JlkKo5h16Z57s7/x+6MhmuecSQ81ejeqK+gk28XM1C7K:stmv+lfoK7sV+F2Q8QjeqG6K
TLSH
T136D1A7066E28A97B4CCAF519BA397B06E2F5503265D51E58EBF84A1C04D76CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 264B
SHA256 1485802eace692a22bcae8d0e28ed05e3444c2fbb855b2874078876187878db4
MD5 79f5863f5cf438b77ade01e816be4d9f
SHA1 3cf87da04e2e3abf4b90ff30b6be8132ab884ded
SHA512 003e4714c4f31116b5223356ac6052e316f4707e748912e2142343249cf54d8552f2c82e62340ef4c842b334ebd14e7fd7b63e4bb645ae27dc26f925dcfd6534
TLSH
T113D0122899490226D3B9943250EC11C8333A387BE7533E2291D94270B86BFB93CCEB21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 aa1a59641a2b0a3fd29077efc96ef12aa140b87ef87b310ccc49476408d5a835
MD5 1a15b00a81f9d2ca12033503f9eab737
SHA1 ce95dd6b8d837cfa31ee01411451327b41881e79
SHA512 53b3891989adda22b0a6c030185c533afb225a762ab46fccd23b7ae2937d99e389a89041106a5b79917e398e22c818c375bde38985341c2d7f9a225904d77748
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\Default\Network\Network Persistent State
Size 949B
SHA256 7474d4638811b642383d8af088a71a848d93df554623113922a2d801c91f2b24
MD5 f5b3b91677f07006de54baf12d76ea13
SHA1 20b2c7ef7937edc3245239217643106c5250be39
SHA512 07db876b91bb42cba2904b3390bc1875e25f487cadf479315d3eae3374f7b6cdf64d17a34e037e05c9dc6982f72b02ae49f486003edab475a30860169c136111
TLSH
T181115BB2C3E4C67E894123E426247927CD2E151913282D2BCDE6FBEA5FE2471D710A0F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b023f.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\Default\Network\Network Persistent State~RFe5b023f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 4963b40d1ccadee4fe841b52c3060918468183cf1d91b4c3c3acba08f7c6aa72
MD5 55949f82e70457df7ba890dab9936509
SHA1 c078c1b8accae61d44d760ec55ceac1f49a7609a
SHA512 4d9436fd73476e10bccade50d123ba3a0e9439dac9cdcac56cdff010e85ff698211e1e4c7f68e00801dd0c87f228f885b6fc6595cf8f79a8a4268d478c43f0c1
SSDEEP 96:ste/dLxvkGeb9JlkKo5h16Z57s7/x+6MhmuecSQ81ejeqK+gs28XM1C7K:stmvElfoK7sV+F2Q8QjeuG6K
TLSH
T194D1A7065E28697B8CCAF519BA397B16E2F55032A5D11E58EBF84A1C04EB6CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\Local State
Size 3KB
SHA256 15f6e3c75c01e6c8d4b923f9d0fdb2e7f73c37000fc5f91954a213a8347797ad
MD5 b93141d9e39bbf3958fad617737287eb
SHA1 4afd5926d1fce6f96c10d437666a43075ef42d51
SHA512 9ae62432790b5db4be0a7e8420b9e2669ab3f1966fa367c57c9dac163a15f334249501cb8b216a3da26111c7709a097ddc5eaa60da50b726e70e60b495079588
TLSH
T1DC81953AA464A9779DF7D9057D863B07ABA55037E9923F94EAEC0F0C01D76481343827
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\Local State
Size 2KB
SHA256 a91edfeadf4e60fafa66a208cc4e12425b1be6925c2cba352f85015e4e6e7a60
MD5 402dc240125db45a6926db98d4d9d904
SHA1 ff4c39fbbd7bde501fe3bd4845b3c7ca8760e1d7
SHA512 dd878b9e9e55985a0761e82e18e05b1ef20d2aa1c5272bf702676ca2ad2bd3d90108d7d6f7f14f4ca2a199bffbd767da72acb5a90d2d0156e86f8254c705cc3e
TLSH
T11C517433B8185B77A9EB9A487D463F279A755076AE532F50AADC4B0801D790C1307C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\Local State
Size 3KB
SHA256 736eb508f1906217f843bbf0052b6df96ebe9bd97b68cd6b94c89f55bc37f97e
MD5 908b5ea53539eb26fc117037d8567fa8
SHA1 bacfa5ccbe7b0e3618af4d865fb0ccfbd1a2bbbf
SHA512 3b799268a2caaa4b5f105fc30e92ee032d65b5d0814c8df64206bec09706b07517894a6085cf00b77083d48fc20f9f5b9d409fc58126b37ddc279e16e99861fe
TLSH
T19171A73BB964A93B9DE79D057C863B1AB7A55037E9923F94E9EC0F0C01D76481353C22
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\Local State
Size 15KB
SHA256 79702b00aade71433920efab88f608c9822d5a63bbd930bf3080686ae65e0261
MD5 96144e553a0f107f77d3df0643d011fc
SHA1 bb849aecf32592892bee06ce318512d135d280b5
SHA512 7686b1277f907d9002eb126806a9f1fe7febc04f21be21a13aceaf09426246f462c6e22bf875bd50b2fae82874ecb86532cd296f52fef4efab5c7411280b7ceb
SSDEEP 384:6srv+89zHqlDNP9oid8NBSxSHsMevOZNNU:Frv+4UNbdcsZeNU
TLSH
T186729F33B53CA6379DF79504B8866B073BB860A796C30EA0E9985F8D41DA4C52317D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59eb12.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-20_c06661edf5fb9a5cc7bd13ad3514649b_hive.exe\EBWebView\Local State~RFe59eb12.TMP
Size 1KB
SHA256 0859cbb3a8fa86b50f2c2a01e6e35548a9a380ff7d809f3b143ea6ec297c3c62
MD5 08dbc7396c7219be9e199ab8190e5995
SHA1 1a144d59dabec3bd468c0c5cbe373cfa83884764
SHA512 ae766901db8c4c8f0c77c7aeb9ecc0d07cb3a02af142fa8d89f98baf66d771fa00d491d104b0934d772089a1fcaf9599751f035f75d03acc8bc45bbf853484fd
TLSH
T135317476F8285B32BCC7694A39427B5B6E61203BA7424F40B5DC8B1842E780D972BC31
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1048-281-0x00007FFDDDBB0000-0x00007FFDDDBB1000-memory.dmp

Download

memory/1048-282-0x00007FFDDE7D0000-0x00007FFDDE7D1000-memory.dmp

Download

memory/1968-44-0x00007FFDDDBB0000-0x00007FFDDDBB1000-memory.dmp

Download

memory/2464-240-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp

Download

memory/2464-279-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp

Download

memory/2464-236-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp

Download

memory/2464-238-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp

Download

memory/2464-202-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp

Download

memory/2464-180-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp

Download

memory/2464-226-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp

Download

memory/2464-266-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp

Download

memory/2464-268-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp

Download

memory/2464-304-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp

Download

memory/2464-224-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp

Download

memory/2464-0-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp

Download

memory/2464-318-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp

Download

memory/2464-328-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp

Download

memory/2464-302-0x00007FF6A5920000-0x00007FF6AB62D000-memory.dmp

Download

memory/5056-110-0x00007FFDDDBB0000-0x00007FFDDDBB1000-memory.dmp

Download

memory/5056-199-0x000001B783A90000-0x000001B783B04000-memory.dmp

Download

memory/5700-311-0x00000199B9020000-0x00000199B9021000-memory.dmp

Download

memory/5700-314-0x00000199B9020000-0x00000199B9021000-memory.dmp

Download

memory/5700-313-0x00000199B9020000-0x00000199B9021000-memory.dmp

Download

memory/5700-312-0x00000199B9020000-0x00000199B9021000-memory.dmp

Download

memory/5700-315-0x00000199B9020000-0x00000199B9021000-memory.dmp

Download

memory/5700-316-0x00000199B9020000-0x00000199B9021000-memory.dmp

Download

memory/5700-307-0x00000199B9020000-0x00000199B9021000-memory.dmp

Download

memory/5700-305-0x00000199B9020000-0x00000199B9021000-memory.dmp

Download