4c74a3c955ebc80bb55e395e910bf0d210b360cbe476ef314fca56b1ab9b95c0

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe
Size 7.4MB
Sample260809-25ayvaxbkd
SHA256 4c74a3c955ebc80bb55e395e910bf0d210b360cbe476ef314fca56b1ab9b95c0
MD5 53d3d790de225d6d9c86107fd6c6029c
SHA1 a1fe57fe645ac12d527a923291d7ed596001be0c
SHA512 11ae58a6610a221f171576178fb314f1dc1df3222fa7f009d70c54bf32226697b6adee5880cd8cdd8e1784f7bad2fb4c89eeef5a1f624570099d55bef934ce9c
SSDEEP 196608:6Ez1e75d2QcTzeP2YwPB+6rFjhmwjb6yEfw:D1e9d2XTMv8BrruwjbAo
TLSH
T1787633D4F8A7E111C270D2F22AF8E1F4282E80B6D519D81277A94EC614CEFAD54EE177
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery spyware trojan upx

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 14 IoCs

resource	yara_rule
behavioral2/memory/1952-188-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1952-207-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1952-226-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1952-228-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1952-237-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1952-238-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1952-239-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1952-264-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1952-265-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1952-275-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1952-295-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1952-304-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1952-317-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1952-326-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

UPX dump on OEP (original entry point) 15 IoCs

resource	yara_rule
behavioral2/memory/1952-0-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	UPX
behavioral2/memory/1952-188-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	UPX
behavioral2/memory/1952-207-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	UPX
behavioral2/memory/1952-226-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	UPX
behavioral2/memory/1952-228-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	UPX
behavioral2/memory/1952-237-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	UPX
behavioral2/memory/1952-238-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	UPX
behavioral2/memory/1952-239-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	UPX
behavioral2/memory/1952-264-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	UPX
behavioral2/memory/1952-265-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	UPX
behavioral2/memory/1952-275-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	UPX
behavioral2/memory/1952-295-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	UPX
behavioral2/memory/1952-304-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	UPX
behavioral2/memory/1952-317-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	UPX
behavioral2/memory/1952-326-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	UPX

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1952-0-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	upx
behavioral2/memory/1952-188-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	upx
behavioral2/memory/1952-207-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	upx
behavioral2/memory/1952-226-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	upx
behavioral2/memory/1952-228-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	upx
behavioral2/memory/1952-237-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	upx
behavioral2/memory/1952-238-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	upx
behavioral2/memory/1952-239-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	upx
behavioral2/memory/1952-264-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	upx
behavioral2/memory/1952-265-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	upx
behavioral2/memory/1952-275-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	upx
behavioral2/memory/1952-295-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	upx
behavioral2/memory/1952-304-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	upx
behavioral2/memory/1952-317-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	upx
behavioral2/memory/1952-326-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3788_1119094003\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3788_1119094003\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3788_1119094003\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3788_1119094003\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3788_1119094003\ct_config.pb	msedgewebview2.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 19000000010000001000000014d4b19434670e6dc091d154abb20edc030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f7e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000052135310639a10f77f886b229b9f7afc1400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab553000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d0020004700320000000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa42000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 6b0000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab50f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f19000000010000001000000014d4b19434670e6dc091d154abb20edc2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 5c00000001000000040000000008000019000000010000001000000014d4b19434670e6dc091d154abb20edc030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f7e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000052135310639a10f77f886b229b9f7afc1400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab553000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d0020004700320000000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa46b0000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab52000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F	2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 0f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3028	msedgewebview2.exe
3028	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3788	msedgewebview2.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 3788	1952	2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe	89
PID 3788 wrote to memory of 5052	3788	msedgewebview2.exe	90
PID 3788 wrote to memory of 3052	3788	msedgewebview2.exe	91
PID 3788 wrote to memory of 3052	3788	msedgewebview2.exe	91
PID 3788 wrote to memory of 3052	3788	msedgewebview2.exe	91
PID 3788 wrote to memory of 3052	3788	msedgewebview2.exe	91
PID 3788 wrote to memory of 1688	3788	msedgewebview2.exe	92
PID 3788 wrote to memory of 5176	3788	msedgewebview2.exe	93
PID 3788 wrote to memory of 5176	3788	msedgewebview2.exe	93
PID 3788 wrote to memory of 5176	3788	msedgewebview2.exe	93
PID 3788 wrote to memory of 6064	3788	msedgewebview2.exe	94
PID 3788 wrote to memory of 6064	3788	msedgewebview2.exe	94
PID 3788 wrote to memory of 6064	3788	msedgewebview2.exe	94
PID 3788 wrote to memory of 6064	3788	msedgewebview2.exe	94
PID 3788 wrote to memory of 6064	3788	msedgewebview2.exe	94
PID 3788 wrote to memory of 1332	3788	msedgewebview2.exe	98
PID 3788 wrote to memory of 1332	3788	msedgewebview2.exe	98
PID 3788 wrote to memory of 1332	3788	msedgewebview2.exe	98
PID 3788 wrote to memory of 3028	3788	msedgewebview2.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe --webview-exe-version=1.4.7 --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1952.3300.4759117419790955638 /pfhostedapp:808277b9e30b81597b6f092b63d118a52cc63787
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView /prefetch:4 /pfhostedapp:808277b9e30b81597b6f092b63d118a52cc63787 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x19c,0x7ffdd5485fd8,0x7ffdd5485fe4,0x7ffdd5485ff0
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView" --webview-exe-name=2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,16446296678388079054,4260823050907667712,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:808277b9e30b81597b6f092b63d118a52cc63787
    3⤵
    PID:3052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView" --webview-exe-name=2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2104 --field-trial-handle=1756,i,16446296678388079054,4260823050907667712,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:808277b9e30b81597b6f092b63d118a52cc63787
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView" --webview-exe-name=2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2196 --field-trial-handle=1756,i,16446296678388079054,4260823050907667712,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:808277b9e30b81597b6f092b63d118a52cc63787
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView" --webview-exe-name=2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3472 --field-trial-handle=1756,i,16446296678388079054,4260823050907667712,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:808277b9e30b81597b6f092b63d118a52cc63787 /prefetch:1
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView" --webview-exe-name=2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2264 --field-trial-handle=1756,i,16446296678388079054,4260823050907667712,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:808277b9e30b81597b6f092b63d118a52cc63787
    3⤵
    PID:1332
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView" --webview-exe-name=2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2304 --field-trial-handle=1756,i,16446296678388079054,4260823050907667712,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:808277b9e30b81597b6f092b63d118a52cc63787
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 73626a61cd7b13c79f351b36bd02f2b57716715260d8d72f1e93f40d046b169e
MD5 c6819aa2939502cb41e7a3e62eaf4a53
SHA1 eb4007541ebacbabc9be89a46a8a994295165a90
SHA512 2e5b57df888505156abb78e32024ceebda9aa81812d845754fea08c7758e0d8d42f65f67bcd7e0dbb6982047803ec139b73e4f1307bf64d0267cffe1085684e8
TLSH
T1F5D0123A77510134C81020330022A1480A80D60B8109C002942E852F2A540701962441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1f5ceb38913069e307963daeac3ece8c5248707d2352680c6d5fc4a63ccb4853
MD5 536932cd148c120e0dd61063ef64b9e8
SHA1 6456d789e18f4ee4fc18c4659777b3101ea9ce1c
SHA512 d66d00189211aefdcbd177658955482cab55f795159e437ec6dc6908ad4c98c9b2a0f0ebcfaf5b123b69feb6f386725e3ba3ce0acd7031b71c1dc83546df0efe
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

41d26d1e-a833-42df-a030-2982c17a50f5.tmp

Path C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\Default\41d26d1e-a833-42df-a030-2982c17a50f5.tmp
Size 6KB
SHA256 cc369d51f6aba522d801621901e4ed98deb5e89005bc6ff3e417570bd63f3e64
MD5 1160d6f57a6146b99d428a3fcc338d26
SHA1 7845362c92d79068fe2a85d5cd8d620e0135caf8
SHA512 4107cce19a5318e1d2575925ff383b4af160c02cd97660289e04f1e609f477f627c94285bcbae202d1e0be270f3fea219b029e32ea31208a14144634d2b9032c
SSDEEP 96:sty/dLxp/Qb9skFo5h16Z5ss7/x+6MhmuecS341eje0K+g3i28XM1C7K:stKvjYoKssV+F234QjQQG6K
TLSH
T10DD195015E28697B4CC6E119BA29BA13E2F5607270D52D58EBFC5A2C08D76DC7307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 e2d913111e73728114331ba70d8ec940a8d6c0d68641703ee3169bd9dbc3c7f6
MD5 abeb904fe2f8f6fbc24298f133f69a2f
SHA1 31c8079259af9e11560f1f1432fc3489785ccba3
SHA512 5d9dbfa7fb77cdb5fb5e0ec597db8ef71da31326310fe9cd301150c4370c6bb795829d393ba5acdcd7b0c5098f0912c295ccbd3d115f82866da149a78dc8f87b
TLSH
T185D0C95D04C3D4A4D3D5057129D0EE107F724CE781D74D05E7544D73AA85789F147218
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599a81.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe599a81.TMP
Size 48B
SHA256 ba2dc9f10dcb155456de6d4941ea971e68484d95b198c62b807f7b637a3bd516
MD5 de050ca70bd55fe5bfd8d7a685225d50
SHA1 c36fcdb711d1373e00cb84892d0877654db5b892
SHA512 ea894d4b44f67bea882071ab998ead69f1c1a71be9d9c082e3a5fa43f4ae58fab61c34d5d6867d8b3539596fae98076159c24c2af27196ce672676ae210ca1f3
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\Default\Network\Network Persistent State
Size 949B
SHA256 461a125430b5894f3c9d8d17cf98fa89a9cd14eaa88cf309e49c32deb9635a1d
MD5 df61d5b1636bd86a30e2a9d88cec1b8d
SHA1 ee97c2dae474987d891b88c7339dfa116b6adf6a
SHA512 08ce600bb32f1e8c3df100de24872f62f8fcc3edb91bd7a0db3e7f8429cf46a7e8dfb21d55a2029bef5a1a60a26e732695ffbb93216ac34d135ad35e66bb8a4b
TLSH
T1D2117DB683E4C67D894162E467243927CD2E011912282D27CDE6FFEA5FF1471D71060F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a5cd7.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\Default\Network\Network Persistent State~RFe5a5cd7.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 672578eb897afdb1f2b7ac750d48c0cffa6ea1f0b6b81d47f506195e8d573119
MD5 57773b537c42de9738260d6e242390af
SHA1 85e451eaa6938182a75662ec9304229264d38ff1
SHA512 5ea33693fb512544074cac0c8cf57a803db3f61d7c0eef688f1b541d1681b39281915610669e25e11029cfeea18e4525eb55dc557daf3f58c4b0d3db5dd9ac7f
SSDEEP 96:sty/dLxp+GQb9skFo5h16Z5ss7/x+6MhmuecS341eje0K+g4bP28XM1C7K:stKv9YoKssV+F234QjQOLG6K
TLSH
T1D3D195015E28697B4CC6E119BA29FA13E2F5607271D52E58EBFC592C08EB6DC7317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\Local State
Size 15KB
SHA256 afddcf83cc2780c8df6637783662a6123b257e0590196716ab053518955baa32
MD5 44cc3715399f874151db30dfc17ec5b0
SHA1 9d63b36c7ca9037be3cdcf056909634897e27b00
SHA512 42f9fa101e3bcb0d69e7cf8f2cff206db43c23904a0b18e71bffb5bbedf26171b4dd4f9033761f0d570b86d2e9efe1a823db27b7dddaa136ad4da568d402eaaa
SSDEEP 384:j+aQikB+z/xvxjg/qhEwNBSEMkpmAVdpH9zO:C/UxvxjgC+1SmUHFO
TLSH
T18872AF2B65793E3795B3EA05795D5B8BCEB884B294C17E744EBD6F0D02C72941343C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\Local State
Size 1KB
SHA256 e812b3981bc59a4ca8c45071992179f86a622e53e0348ac49a4ed3d829b3e3d8
MD5 9926d584d1e2dcfbb87d27c078da787c
SHA1 9003f72cf4182482a9fc13ef3b93091a3eab415f
SHA512 a216545d3ad3719b76f9256608dc46a3d5b81a4d2a0df8e4aef4567550c22c02b609f79f561846457fbf6707177557a167de750bd2f08196b7e725d6358d30c2
TLSH
T1502192F2A4642F739DA123027107FB172E3010AB91400F10A6DD1A2D82E715CF357D33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\Local State
Size 2KB
SHA256 12636c6c77dca589bb29ddd48b2c919c80df5a84971f0e5a772ff8fc799f2641
MD5 1f50ab23b95171a66a34fe12f986f0f3
SHA1 2e8db7a2a7bf5c030cb74c02522a7f2e558aaa2b
SHA512 659b2503888667c803681f933b87d0c6946a9be798f0420e1f0b8d18febe1453b87dc19fc0ff43c5e4597cf3209ea6a7bcaa0254c94c2065e75e1ee91734c9f4
TLSH
T15A51957379246B7BCAB24B04B54BBF239E3550A6AA412F209ADC1B1C41D756C7343C73
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-09_53d3d790de225d6d9c86107fd6c6029c_hive.exe\EBWebView\Local State
Size 3KB
SHA256 cd6b1fbb7c3948ab5c230f4a631104254a249f30f72158512c8da7da6005fe40
MD5 5112c8219488d1759d452c04130dabdc
SHA1 3fd88babeaa858fe607d2d5b4fb86513678d5919
SHA512 12ffd6b362b5eeb656c46135a8924182f75ed05b8d1ccbb7f33afca73bc20162be8dec9d948e624ad638da6f96ace5fab0bea9a23aa750a897c4a94078c1d67a
TLSH
T1E661A7766970AA3B8EF29B01B48A7B17AB715067E4853F60CAEC1E0D01D72983343C23
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1332-278-0x00007FFDF7F90000-0x00007FFDF7F91000-memory.dmp

Download

memory/1332-277-0x00007FFDF8240000-0x00007FFDF8241000-memory.dmp

Download

memory/1952-304-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp

Download

memory/1952-0-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp

Download

memory/1952-237-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp

Download

memory/1952-238-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp

Download

memory/1952-239-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp

Download

memory/1952-226-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp

Download

memory/1952-207-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp

Download

memory/1952-264-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp

Download

memory/1952-265-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp

Download

memory/1952-275-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp

Download

memory/1952-188-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp

Download

memory/1952-326-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp

Download

memory/1952-295-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp

Download

memory/1952-228-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp

Download

memory/1952-317-0x00007FF60DB50000-0x00007FF6115DA000-memory.dmp

Download

memory/3028-305-0x0000027621670000-0x0000027621671000-memory.dmp

Download

memory/3028-316-0x0000027621670000-0x0000027621671000-memory.dmp

Download

memory/3028-315-0x0000027621670000-0x0000027621671000-memory.dmp

Download

memory/3028-314-0x0000027621670000-0x0000027621671000-memory.dmp

Download

memory/3028-313-0x0000027621670000-0x0000027621671000-memory.dmp

Download

memory/3028-312-0x0000027621670000-0x0000027621671000-memory.dmp

Download

memory/3028-311-0x0000027621670000-0x0000027621671000-memory.dmp

Download

memory/3028-307-0x0000027621670000-0x0000027621671000-memory.dmp

Download

memory/3052-39-0x00007FFDF8240000-0x00007FFDF8241000-memory.dmp

Download

memory/6064-110-0x00007FFDF8240000-0x00007FFDF8241000-memory.dmp

Download