Analysis
- max time kernel
149s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/05/2026, 00:09
Static task
static1
5 signatures
Behavioral task
behavioral1
Sample
2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe
Resource
win11-20260513-en
windows11-21h2-x64
27 signatures
150 seconds
General
- Target 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe
- Size 868KB
- Sample260517-afkm7sax71
- SHA256 35e2b6e0dd05284e292dd79831f9f8641911c85141b27f96b545cbeade525804
- MD5 2018c00cd7560e2369452979c72c351e
- SHA1 8145eb5052e437455ec470d945f3339eb2b3ed76
- SHA512 288276ac4cd888c24f9908f9be8970f26536a4d3d9e93f688d25e9f631da74d5d858ee950607b72f784113e5d74980110a2d07f843d02b6490ba3e07a5e3b8e7
- SSDEEP 24576:Vri8bo/mHtxH/Yt44/JhZx2N0+wk4fia2iBkQWvyh2j:M8qmHtxm/JhZoxwk4frxyQWae
- TLSH T13B159E117A82C433F56201310A78ABA590BEF9355F7136CF63E84B2E69306C26D72B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Clears Windows event logs 1 TTPs 3 IoCs
pid Process 2568 wevtutil.exe 1800 wevtutil.exe 3344 wevtutil.exe - Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 4 IoCs
resource yara_rule behavioral2/memory/3420-0-0x00000000002A0000-0x000000000037F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/files/0x001a00000002b584-44.dat INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/2916-45-0x00000000005B0000-0x000000000068F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/2624-92-0x00000000005B0000-0x000000000068F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM - Detects command variations typically used by ransomware 4 IoCs
resource yara_rule behavioral2/memory/3420-0-0x00000000002A0000-0x000000000037F000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/files/0x001a00000002b584-44.dat INDICATOR_SUSPICIOUS_GENRansomware behavioral2/memory/2916-45-0x00000000005B0000-0x000000000068F000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/memory/2624-92-0x00000000005B0000-0x000000000068F000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware - Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 4 IoCs
resource yara_rule behavioral2/memory/3420-0-0x00000000002A0000-0x000000000037F000-memory.dmp INDICATOR_SUSPICIOUS_USNDeleteJournal behavioral2/files/0x001a00000002b584-44.dat INDICATOR_SUSPICIOUS_USNDeleteJournal behavioral2/memory/2916-45-0x00000000005B0000-0x000000000068F000-memory.dmp INDICATOR_SUSPICIOUS_USNDeleteJournal behavioral2/memory/2624-92-0x00000000005B0000-0x000000000068F000-memory.dmp INDICATOR_SUSPICIOUS_USNDeleteJournal - Detects executables containing commands for clearing Windows Event Logs 4 IoCs
resource yara_rule behavioral2/memory/3420-0-0x00000000002A0000-0x000000000037F000-memory.dmp INDICATOR_SUSPICIOUS_ClearWinLogs behavioral2/files/0x001a00000002b584-44.dat INDICATOR_SUSPICIOUS_ClearWinLogs behavioral2/memory/2916-45-0x00000000005B0000-0x000000000068F000-memory.dmp INDICATOR_SUSPICIOUS_ClearWinLogs behavioral2/memory/2624-92-0x00000000005B0000-0x000000000068F000-memory.dmp INDICATOR_SUSPICIOUS_ClearWinLogs - Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 8032 bcdedit.exe 8024 bcdedit.exe - Renames multiple (485) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 8040 wbadmin.exe -
pid Process 8048 wbadmin.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer_Service.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beserver.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe browser.exe - Executes dropped EXE 2 IoCs
pid Process 2916 browser.exe 2624 browser.exe - Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\exefile\shell 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" browser.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\exefile\shell\open\command 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\exefile\shell\open 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" browser.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\exefile\shell\open\command browser.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\browser = "\"C:\\Users\\Admin\\AppData\\Local\\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\\browser.exe\" " 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\browser.exe = "notepad.exe \"C:\\temp\\HowToRestoreFiles.txt\"" browser.exe - Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1168 powercfg.exe 1704 powercfg.exe 240 powercfg.exe 5184 powercfg.exe 5396 powercfg.exe 2484 powercfg.exe 3744 powercfg.exe 2100 powercfg.exe -
pid Process 2696 powershell.exe 3320 powershell.exe 1756 powershell.exe 5160 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wevtutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fsutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language browser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language browser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fsutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wevtutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wevtutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3416 cmd.exe 2032 PING.EXE 3408 cmd.exe 4496 PING.EXE - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName vds.exe - Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\.ywgulm_p2k browser.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\exefile\shell\open\command browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\exefile\shell\open\command 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\exefile\shell 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ywgulm_p2k\ = "p2kfile" browser.exe Key created \REGISTRY\MACHINE\Software\Classes\p2kfile\shell\open\command browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\p2kfile\shell\open\command browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\p2kfile\shell\open\command\ = "notepad.exe \"C:\\temp\\HowToRestoreFiles.txt\"" browser.exe Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\p2kfile browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\p2kfile\shell browser.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\exefile 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\exefile\shell\open 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\p2kfile\shell\open browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" browser.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 5728 notepad.exe - Runs ping.exe 1 TTPs 2 IoCs
pid Process 2032 PING.EXE 4496 PING.EXE - Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 2916 browser.exe 2916 browser.exe 2916 browser.exe 2916 browser.exe 2696 powershell.exe 2696 powershell.exe 2916 browser.exe 2916 browser.exe 2916 browser.exe 2916 browser.exe 2916 browser.exe 2916 browser.exe 2916 browser.exe 2916 browser.exe 2916 browser.exe 2916 browser.exe 2916 browser.exe 2916 browser.exe 2916 browser.exe 2916 browser.exe 2916 browser.exe 2916 browser.exe 1756 powershell.exe 1756 powershell.exe 3320 powershell.exe 3320 powershell.exe 5160 powershell.exe 5160 powershell.exe 3320 powershell.exe 1756 powershell.exe 3320 powershell.exe 1756 powershell.exe 5160 powershell.exe 5160 powershell.exe 3320 powershell.exe 1756 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: SeSecurityPrivilege 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: SeTakeOwnershipPrivilege 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: SeLoadDriverPrivilege 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: SeSystemProfilePrivilege 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: SeSystemtimePrivilege 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: SeProfSingleProcessPrivilege 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: SeIncBasePriorityPrivilege 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: SeCreatePagefilePrivilege 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: SeBackupPrivilege 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: SeRestorePrivilege 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: SeShutdownPrivilege 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: SeDebugPrivilege 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: SeSystemEnvironmentPrivilege 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: SeChangeNotifyPrivilege 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: SeRemoteShutdownPrivilege 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: SeUndockPrivilege 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: SeManageVolumePrivilege 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: SeImpersonatePrivilege 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: SeCreateGlobalPrivilege 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: 33 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: 34 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: 35 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: 36 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe Token: SeIncreaseQuotaPrivilege 2916 browser.exe Token: SeSecurityPrivilege 2916 browser.exe Token: SeTakeOwnershipPrivilege 2916 browser.exe Token: SeLoadDriverPrivilege 2916 browser.exe Token: SeSystemProfilePrivilege 2916 browser.exe Token: SeSystemtimePrivilege 2916 browser.exe Token: SeProfSingleProcessPrivilege 2916 browser.exe Token: SeIncBasePriorityPrivilege 2916 browser.exe Token: SeCreatePagefilePrivilege 2916 browser.exe Token: SeBackupPrivilege 2916 browser.exe Token: SeRestorePrivilege 2916 browser.exe Token: SeShutdownPrivilege 2916 browser.exe Token: SeDebugPrivilege 2916 browser.exe Token: SeSystemEnvironmentPrivilege 2916 browser.exe Token: SeChangeNotifyPrivilege 2916 browser.exe Token: SeRemoteShutdownPrivilege 2916 browser.exe Token: SeUndockPrivilege 2916 browser.exe Token: SeManageVolumePrivilege 2916 browser.exe Token: SeImpersonatePrivilege 2916 browser.exe Token: SeCreateGlobalPrivilege 2916 browser.exe Token: 33 2916 browser.exe Token: 34 2916 browser.exe Token: 35 2916 browser.exe Token: 36 2916 browser.exe Token: SeDebugPrivilege 2696 powershell.exe Token: SeIncreaseQuotaPrivilege 2624 browser.exe Token: SeSecurityPrivilege 2624 browser.exe Token: SeTakeOwnershipPrivilege 2624 browser.exe Token: SeLoadDriverPrivilege 2624 browser.exe Token: SeSystemProfilePrivilege 2624 browser.exe Token: SeSystemtimePrivilege 2624 browser.exe Token: SeProfSingleProcessPrivilege 2624 browser.exe Token: SeIncBasePriorityPrivilege 2624 browser.exe Token: SeCreatePagefilePrivilege 2624 browser.exe Token: SeBackupPrivilege 2624 browser.exe Token: SeRestorePrivilege 2624 browser.exe Token: SeShutdownPrivilege 2624 browser.exe Token: SeDebugPrivilege 2624 browser.exe Token: SeSystemEnvironmentPrivilege 2624 browser.exe Token: SeChangeNotifyPrivilege 2624 browser.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3420 wrote to memory of 2916 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe 81 PID 2916 wrote to memory of 2624 2916 browser.exe 82 PID 2916 wrote to memory of 2696 2916 browser.exe 83 PID 2916 wrote to memory of 2100 2916 browser.exe 90 PID 2916 wrote to memory of 1168 2916 browser.exe 91 PID 2916 wrote to memory of 3744 2916 browser.exe 92 PID 2916 wrote to memory of 2484 2916 browser.exe 93 PID 2916 wrote to memory of 5396 2916 browser.exe 94 PID 2916 wrote to memory of 5184 2916 browser.exe 95 PID 2916 wrote to memory of 240 2916 browser.exe 96 PID 2916 wrote to memory of 1704 2916 browser.exe 97 PID 2916 wrote to memory of 5160 2916 browser.exe 98 PID 2916 wrote to memory of 1756 2916 browser.exe 99 PID 2916 wrote to memory of 3320 2916 browser.exe 100 PID 2916 wrote to memory of 8024 2916 browser.exe 112 PID 2916 wrote to memory of 8032 2916 browser.exe 113 PID 2916 wrote to memory of 8040 2916 browser.exe 114 PID 2916 wrote to memory of 8048 2916 browser.exe 115 PID 3420 wrote to memory of 3416 3420 2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe 124 PID 3416 wrote to memory of 2032 3416 cmd.exe 126 PID 3416 wrote to memory of 5588 3416 cmd.exe 127 PID 2916 wrote to memory of 5728 2916 browser.exe 128 PID 2916 wrote to memory of 3344 2916 browser.exe 129 PID 2916 wrote to memory of 1800 2916 browser.exe 130 PID 2916 wrote to memory of 2568 2916 browser.exe 131 PID 2916 wrote to memory of 3408 2916 browser.exe 132 PID 3408 wrote to memory of 4496 3408 cmd.exe 137 PID 3408 wrote to memory of 4264 3408 cmd.exe 140 - System policy modification 1 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" browser.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All your files have been stolen! You still have the original files, but they have been encrypted.\r\nTo recover your files and prevent them from being shared, go to the website:\r\nhttps://client.pay2key.pro/?user_id=bI7LgZjChYCh5mKIJ8-GFMgmCzv--dFx4uHx9oE-vGM*ywgulm\r\n( http://23.137.254.233/?user_id=bI7LgZjChYCh5mKIJ8-GFMgmCzv--dFx4uHx9oE-vGM*ywgulm )\r\nBefore payment you will be able to send up to 3 test files for free decryption.\r\nAfter payment, the system will automatically issue a tool to fully recover all your files.\r\nIn the event of payment, our file copies will be deleted without publication.\r\nIf payment is not received within a week, we will start selling your data on the darknet.\r\nYour unique ID: bI7LgZjChYCh5mKIJ8-GFMgmCzv--dFx4uHx9oE-vGM*ywgulm\r\n* * *\r\nIf first address cannot be opened, visit our main site on the I2P network (similar to TOR):\r\nhttp://pay2keys7rgdzrhgzxyd7egpxc2pusdrkofmqfnwclts2rnjsrva.b32.i2p/?user_id=bI7LgZjChYCh5mKIJ8-GFMgmCzv--dFx4uHx9oE-vGM*ywgulm\r\nSpecial browser for accessing I2P sites: https://github.com/PurpleI2P/i2pdbrowser/releases/tag/latest\r\n\r\n\r\nВсе ваши файлы украдены! Оригинальные файлы остались у вас, но были зашифрованы.\r\nЧтобы восстановить ваши файлы и предотвратить их публикацию в общем доступе, зайдите на сайт:\r\nhttps://client.pay2key.pro/?user_id=bI7LgZjChYCh5mKIJ8-GFMgmCzv--dFx4uHx9oE-vGM*ywgulm\r\n( http://23.137.254.233/?user_id=bI7LgZjChYCh5mKIJ8-GFMgmCzv--dFx4uHx9oE-vGM*ywgulm )\r\nПеред оплатой вы сможете отправить до 3 тестовых файлов для бесплатной расшифровки.\r\nПосле оплаты система автоматически выдаст инструмент для полного восстановления всех ваших файлов.\r\nВ случае оплаты, наши копии файлов будут удалены без публикации.\r\nЕсли оплата не поступит в течение недели, мы начнем продажу ваших данных в даркнете.\r\nВаш уникальный ID: bI7LgZjChYCh5mKIJ8-GFMgmCzv--dFx4uHx9oE-vGM*ywgulm\r\n* * *\r\nЕсли первый адрес не удастся открыть, заходите на наш основной сайт в сети I2P (что-то вроде TOR):\r\nhttp://pay2keys7rgdzrhgzxyd7egpxc2pusdrkofmqfnwclts2rnjsrva.b32.i2p/?user_id=bI7LgZjChYCh5mKIJ8-GFMgmCzv--dFx4uHx9oE-vGM*ywgulm\r\nСпециальный браузер для доступа к сайтам в сети I2P: https://github.com/PurpleI2P/i2pdbrowser/releases/tag/latest\r\n\r\n\r\nTe han robado todos tus archivos. Todavía tienes los archivos originales, pero han sido encriptados.\r\nPara recuperar tus archivos y evitar que se compartan, visita el sitio web:\r\nhttps://client.pay2key.pro/?user_id=bI7LgZjChYCh5mKIJ8-GFMgmCzv--dFx4uHx9oE-vGM*ywgulm\r\n( http://23.137.254.233/?user_id=bI7LgZjChYCh5mKIJ8-GFMgmCzv--dFx4uHx9oE-vGM*ywgulm )\r\nAntes de efectuar el pago, podrá enviar hasta 3 archivos de prueba para su descifrado gratuito.\r\nTras el pago, el sistema emitirá automáticamente una herramienta para recuperar completamente todos sus archivos.\r\nEn caso de pago, las copias de nuestros archivos se eliminarán sin publicación.\r\nSi no recibimos el pago en el plazo de una semana, empezaremos a vender tus datos en la darknet.\r\nSu ID único: bI7LgZjChYCh5mKIJ8-GFMgmCzv--dFx4uHx9oE-vGM*ywgulm\r\n* * *\r\nSi no se puede abrir la primera dirección, visite nuestro sitio principal en la red I2P (similar a TOR):\r\nhttp://pay2keys7rgdzrhgzxyd7egpxc2pusdrkofmqfnwclts2rnjsrva.b32.i2p/?user_id=bI7LgZjChYCh5mKIJ8-GFMgmCzv--dFx4uHx9oE-vGM*ywgulm\r\nNavegador especial para acceder a sitios I2P: https://github.com/PurpleI2P/i2pdbrowser/releases/tag/latest\r\n" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = " " browser.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection browser.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer browser.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe"1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\browser.exe"C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\browser.exe"2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2916 -
C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\browser.exe"C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\browser.exe" -e watch -pid 2916 -!3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-BitLockerVolume | Suspend-BitLocker"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -H off3⤵
- Power Settings
PID:2100
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 03⤵
- Power Settings
PID:1168
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 03⤵
- Power Settings
PID:3744
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 03⤵
- Power Settings
PID:2484
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 03⤵
- Power Settings
PID:5396
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 03⤵
- Power Settings
PID:5184
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 03⤵
- Power Settings
PID:240
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c3⤵
- Power Settings
PID:1704
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5160
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1756
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3320
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:8024
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:8032
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP3⤵
- Deletes System State backups
PID:8040
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:8048
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe "C:\temp\HowToRestoreFiles.txt"3⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
PID:5728
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl security3⤵
- Clears Windows event logs
- System Location Discovery: System Language Discovery
PID:3344
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl system3⤵
- Clears Windows event logs
- System Location Discovery: System Language Discovery
PID:1800
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl application3⤵
- Clears Windows event logs
- System Location Discovery: System Language Discovery
PID:2568
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /d /c "ping 127.2 -n 5 & fsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\browser.exe" & cd /d "C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}" & Del /f /q /a *.exe *.ini *.dll *.bat *.cmd *.db *.tmp & cd/ & rd /q /s "C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}""3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\PING.EXEping 127.2 -n 54⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4496
-
-
C:\Windows\SysWOW64\fsutil.exefsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\browser.exe"4⤵
- System Location Discovery: System Language Discovery
PID:4264
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /d /c "ping 127.2 -n 5 & fsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\Temp\2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe" & cd /d "C:\Users\Admin\AppData\Local\Temp" & Del /f /q /a *.exe *.bat"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\SysWOW64\PING.EXEping 127.2 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2032
-
-
C:\Windows\SysWOW64\fsutil.exefsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\Temp\2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_.exe"3⤵
- System Location Discovery: System Language Discovery
PID:5588
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵PID:4500
-
C:\Windows\System32\BdeUISrv.exeC:\Windows\System32\BdeUISrv.exe -Embedding1⤵PID:2984
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:5204
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:6872
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:5816
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Defense Evasion
Indicator Removal
3Clear Windows Event Logs
1File Deletion
2Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 7f8f97ee615f534fb3a3d4ab1d554cd33b788f10c559754714d1e7ce0726b362
- MD5 a71e351e0584693771a3e1ab5ed855ee
- SHA1 5bbadb2db8240a293fce7bf6a965634703e51aa4
- SHA512 95148933c9fc727c3f88c9b5a0bd489f660bc0b24b3cb8b8e6e7ffbec937810d473cf57ff0c8a34075ce7f822f0c007be8893daa409738cd4782ab526bb5a185
- TLSH T18B71EE323375B0D4C9663F07192C1AC463BF4396EA58AF4CB658521ED92710BDB222F7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 12add38adbe932b3035142b22f1bd8638dd07472e6a94cf73c1147f2b21cea50
- MD5 5d51edda4a0a61b86eac2c9054c1f011
- SHA1 f3ae33bc73beb67c1826509b385123a353fc7a80
- SHA512 534bc3a1a77036ceb59a9484bc757ca68d3f4356aeb490836492c7fe807592ffd7f3679901a852752b025702e4321f5bff469f6c04005e123d98e12fe3036679
- TLSH T12321AB33B79CD134C8D9117A108DED01B2B5C7C7449ECE9B7B84C518A57F899DF641A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 7bf9f110f94fb6407f160972ae7b77b748bacd3f45ce047948acfae4165ad8ac
- MD5 545017bbef594bb3f5be8b10588299da
- SHA1 3ed61d667fd08d4e7e358a7366418eec5dde45ff
- SHA512 a3eb758fb2dfe9264782ab3ea4c71cca511219d8df187d8052263e5b651b64233016abff7c7119479ce4a15f4b1e2e29a6c0db0d919753be3155c8e8515b3b4c
- TLSH T157218633B79CD134C8D915BA108DAD01B2B5C3CB449ECE9B7B84C518A57F89EEA681A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 afe0976c48d4d9aecb25e2a0c52071964a3395ec69422b38d094981ad3fa9013
- MD5 9e9f1fb08950ab44d725c06fdf5edb7f
- SHA1 76aa194c2c7c7937f91efda2c5e203db590fbed4
- SHA512 5c3b363790328ee857ecdf7cecbdfeb5b94307b7432ad9bf7b8adbf14a88ed34c0570e62aa53a3826a245c03fa1a2b0d282105bc410a50a8c826ee633645f982
- TLSH T163219A23B3DCC1A5C8D9117A548D9D00B275C3CB449ECFCB2A84C228D93F6D9DB945A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t2acojhy.l0l.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\727d60e6-0709-4bd0-b2e2-d6313545e121.tmp
- Size 10KB
- SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
- MD5 78e47dda17341bed7be45dccfd89ac87
- SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
- SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
- SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
- TLSH T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\77e392ec-f42d-4ed9-bb10-511ddefc8339.tmp
- Size 147KB
- SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
- MD5 9c670f04d98ab7404f16423f6ee6cdfa
- SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
- SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
- SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
- TLSH T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\AdobeSFX.log
- Size 1KB
- SHA256 bc2269e707ea04dd54d1d2f1406402f2c4a49dd015d2d1e809ae3501bb39bc38
- MD5 6af5781d4ffdb0daec9a1f5ccaccbf33
- SHA1 78499e5fe8e03ef82ecd183d58be832b3735e60b
- SHA512 df85d6535af738a1bec94c9cd20b35efe143877d1f8ec8be9b3216a9d24fef9329cd067a471aabe6459323d11851696c353137075fc54d5084514e472501ee29
- TLSH T18A4126071BFAC1B76E028087A7686FFFCD50FB372E45D968674691283504D386E5350A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\DefaultApps.xml
- Size 1KB
- SHA256 e512d5149170e01023f8489b1c0ef18cc6e8ac8c0dbae6df4ca9a843e283a215
- MD5 8c39e302e20e76adf2744c25220da36f
- SHA1 8d5ea7e2e2acd35dc98f3deecbbb4536e49700bf
- SHA512 17765955e7b7bb592bf0f81d705220f56e051ad0df1dc770df5e062ef4295ad79b196ab71554b37b7dc50e42ff2e0d14c25ee3053741cebbca07b607fb1aab35
- TLSH T16A318AE9FBC249F2A3576A627A41D2CC72A981AFC7EC5B04B043612E901B7BC4777057
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\DefaultAppsNew.xml
- Size 5KB
- SHA256 5c37cd8e574cd0cde1736c60a15c180fcd5779bfb167d5e90e32eef97ec45f83
- MD5 ae24bdea41713eec181ad5279d34df3c
- SHA1 b3ffabca4678ddeff198ab81cfa2dc6740a13817
- SHA512 a2c469f0def3214121043200d0f204e180302dde412f349d364bd82e3281aee6cf53f4814ce76ad82b0c1ff7c6532a5fb6c862a6243e556ad85aa48cebd68cdd
- SSDEEP 96:/oWlCloLulNl0aOKV7lKl2cclljlplClLlslolrlJOOqDCDGf3qM:/oWlCloLulNl0aZ7lKl2cclljlplClL6
- TLSH T154C126137BFD1A49F1F22B659A7A246A0D7BBC584A3AC22D10212E0C5C71F55CC62FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\IOHDBSLO-20260514-0335.log
- Size 55KB
- SHA256 fe7cc0d7bceced98ad03877049bb3c211278d1825a23dc6ed53a34158224312b
- MD5 ef0a4e9c7811766de415fa72f94c293e
- SHA1 7e6944f262335a24dfa7789a41d0a47a0117a271
- SHA512 ba61ed1d623fcbb8946e2e4280a901a720f239ad0a62157a2bf6a6deac48dba7dbf8be351897a649671afd1260c69d5d1853fac0e24ef8b47568cad3c79126c9
- SSDEEP 1536:z4pqrgfnyVTIWYi+8x5gD9g5Hvd+3hD9zUSRIMtyC1iFSRSNxw//gcvGm2NICMeB:s9KVdwDhD9zpk
- TLSH T1934313186EF90657B2F38B8AA9F74026DB727E576934DE8D50910F0E1826E417821F3F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\IOHDBSLO-20260514-0335a.log
- Size 159KB
- SHA256 5c9e79bf38d87c51bacaab37c02c2fe4138b9facc513fcd39cad9ebefaceb77f
- MD5 cfeb9f30641effbc8d50ca8c72e567d5
- SHA1 3f94ab11f5ed35e3bacf6545e4c804fea323e3f1
- SHA512 08b74eddb0e50c3835471d404d9eb445d1a31fa198bd74d3794960c1a45ebfbcbcbaf3b8c5ea881903c69ad1c9a8d4310706fa77ba3d9c2a003d71ebc88481ea
- SSDEEP 3072:fNY9uIGV/WORoC5L7b1skpiiylINQagoHGELxKGvRA25haw8MXe4xocy0LolR2GU:Kg/hpiiAINQab/g/s
- TLSH T105F3662D6DF90616A2B2DACAAAF28027D732BD276935CD5E50910B0F0516D41BCB1F3F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\JavaDeployReg.log
- Size 13KB
- SHA256 9ce65345dd3d775617840684dd30cb1b5a488ac73867562a3c63cc9424956815
- MD5 3f54591e3e86d918d6a2c5ceb8d7bf83
- SHA1 33bf2c5feda1c998adbd9dc0d33aa6b8b87ec3dd
- SHA512 8c46db935e7cf41e1ca43d05af16c036f1b2f71b81026bcd2dddd9b6e7bf8718489acd0d13198ad9ad6dd2b7ff6898a6fa36af5a1eca1d16db292ca40ef8d880
- SSDEEP 384:Kfa/2RXJlX/2RXJl/Y0tIhJJJJJNe+ML+l:Kfa/2RXJlX/2RXJl/Y0tIhJJJJJx
- TLSH T1CB525B8104EF85F658D3C0D6CB436EF0E5A6BA7FA28BD81570D8D878F815D8452B34E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\Microsoft .NET Framework 4.7.2 Setup_20260514_033126883.html
- Size 93KB
- SHA256 b5c0d9294d2dddf2a7bf7ef7db7701d1785942a580900e23825a1ae2616759d8
- MD5 d37395045c6bd3d1818714ea6c938164
- SHA1 1cad152be2917166a2421606782f83144d8f842b
- SHA512 f2cec0e597934c2347391aecd78083ba80b7ec469e14d3f266d5f34f5323d7de5fb294d4d06c72eca704c02950867c278b2a91142b5d5efd551806f9b661593d
- SSDEEP 768:fdsOTLyUFJFEWUxFzvfDDOQqBmpKZcboA:fdsWyUr+WUxpvfDDOQcA
- TLSH T1C793C30377E80155A8F3BF4CE9B310251AB9BD865C34DD2C13A5895D0E96E24ECB2FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514033146.log
- Size 15KB
- SHA256 d171ada79b64df34f882b7818a83443500a94f45d8e04ddd4c803aea2ca2fda4
- MD5 9d464fe19298e7c6459822b68f251a8d
- SHA1 1f1f963b9d5c0f6d57bdba508ab3afda168add9f
- SHA512 c4397222f7d3e525822d94bbbaa3642ae98fcfb5dc1aabdf760bf802574fcba8793caf8888733b5857a82187bbe36bdcb2a6da710016110017d33f1e4d2fe4ff
- SSDEEP 384:ks3IVs313M3M3F3n3IO3owO3oUVbaFVKVAPV7B+Q3U3W3D3nx3oJU3f343sx3oh:kfpjwjWba78ANN7uAuh
- TLSH T14462EC471DE462861CB3B97EC7162BF88F0E766B5A20E5B06EC3031D42D6A65F38DE41
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514033146_000_dotnet_runtime_6.0.27_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514033146_000_dotnet_runtime_6.0.27_win_x64.msi.log
- Size 551KB
- SHA256 64c60011d03ea507e659f51e9c0459c432fe7233be26b46ba0319a34c31a0d44
- MD5 4381b61aff7b248d66c50cf025a0f0d0
- SHA1 05300479d8f1cf80d2131e14e52135d40d891b30
- SHA512 7a12e7ad3c3254d9fd597f5f38a48ea6e528dcd2e53ba16cbd578ca9e02467ededdf14e64165e31ba657c9b3143ab49018da1f23918bd764d992b46c6768112c
- SSDEEP 3072:yFowjPNuaAs9519kKtNUvgGlct4UxJ3XwA0YEOxLmqw8xccxTew5zekv30kf6Yut:gjlih
- TLSH T11EC43825AFF80216B2B38E57EEF384275576BD33AD38DD1C1091834E0471E05D9ABB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514033146_001_dotnet_hostfxr_6.0.27_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514033146_001_dotnet_hostfxr_6.0.27_win_x64.msi.log
- Size 95KB
- SHA256 ca6fa0fb8a602a69b121055effd550ddebc86cd422a4f10cf6ba5d96c9c2ff0b
- MD5 3dbfbc0797c68dec1b7f64b6f8106ccd
- SHA1 45b3437ab0a44e8b3428086a69ba91c096732e5e
- SHA512 8b7f06503ee065175a3dfa29beee98e86119133d11538875cb99f7c0037c2fe8f002101e2acff524187cd8d662b731e974133c30839ae1c65b218ce90e870755
- SSDEEP 1536:wqe9X7Ylsg6mVSsLuw/BEi1B7JQgzNVdHftnmeog0GOuR21jBY13Zkd8:wxjjBY13ZU8
- TLSH T12CA3062D2FF80046B2B79A57DEF744664633BD239D35DD0D3181825E00B290ADA6DBAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514033146_002_dotnet_host_6.0.27_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514033146_002_dotnet_host_6.0.27_win_x64.msi.log
- Size 105KB
- SHA256 ce3f47e791945c8073e6be65c0cf89e3e57031b9ed93ec4aec970f9f425633a7
- MD5 6ed8c62e100d54a187cdeeef2f18f757
- SHA1 d7ffda535a6975098dbb4f8c43a69b92cd79421c
- SHA512 0fb062c302e44a4a993ab585235f460c7a5ad8fb61962b5ba2fee78510ba07c16c934fad9d706d1387e9450f949791129be73eddd140dd4a861efc4158ab2859
- SSDEEP 1536:C0Xc/gNQJVL+Mt+7O2b/2YxpcJKHEWueQLkGH6kkoIDgKjZPmQm3XTF0o6KCl:Ch6jZPmQm3XTF0o6Bl
- TLSH T1F6B308192FF40145F2B36B47AEF3442B9673BD675A35CD0D2082835E04F2A09DA6D7AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514033146_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514033146_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log
- Size 847KB
- SHA256 89f5b23cb0aaa41756261db4363e28a6e5f5efe85fa22c3b155481e624350cb6
- MD5 44248ba57e9a0403b0bf3a35ab6aa8b8
- SHA1 e8db3d6deb6a603e339a60222f0e69a5c13a8aa4
- SHA512 bd90bab656f3aa140fae6484a0bcb48f04a7b86bee8bc8f12cb9a629c0af48866e594ae08f19c8f5cea959feb275cd048a42cd8fe31a047dc5f981c56e35bf04
- SSDEEP 3072:rzEwTj0KxI/hAHuhNAAuBo0J+Tzy2eKo6j0YEKiFgTQyfQEs1yx+Tp2uHSvUmMJY:VjbZ9Ti
- TLSH T16305F624ABF90626B3B38F57EEF344269537B932AC38C91C1055834D09B2F05D976B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514033207.log
- Size 15KB
- SHA256 1870cf0bb3bd4e59e24cd7bd2cf735304dcbb03721e57cbcf3fa4a028e29c48d
- MD5 575c04de44218baf1b28cb7f0b83aad5
- SHA1 529f71a2064909e9105143be0f390b349be309e1
- SHA512 b902ddd71690e0f3c619d7a297a056ad04df35976a982f102bcee305f627f73a4393d7630c69723f81bdff3db1e2977c7507099f7425ec12484f882b8ee78baa
- SSDEEP 384:E9aIVEaRa6aQada9a3PaSnPaSsV6j6VgVjCVSXh/a6ahaEaj2aShqaOatai2aSq:EnOdnde6jMSjk8NeLeq
- TLSH T12362F2066DEC61961C327176C7392EF98F17B3572E10D9B87F820A2E8043D61B74DB56
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514033207_000_dotnet_runtime_7.0.16_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514033207_000_dotnet_runtime_7.0.16_win_x64.msi.log
- Size 470KB
- SHA256 af9bcbbd081a382c90f28d375663c4172709242775c84fa7ef7b4411758b9950
- MD5 e2ca2c1bfefb224e9849c41e4473ed8a
- SHA1 d07c3ec91b13e11f4157085c89ba45e03ef5c994
- SHA512 4da67a0269a3dbc0c2e5f7817c4f526aeaf2b1fa956c1012c72f9b0d2f541f95372f471c3aa83a1c5c4c8fdac5f34b393711aeb76cf7b56d81f01bf6656ce1b4
- SSDEEP 3072:gEfGjDtujXZqUI3WQoC19+du31uVAV1ffUcnZqQGOHIq6cjFPaLZIGD8yV0jKNcA:Ijn4
- TLSH T139A43C24AFF80215B2B39F47EEF34416A476BC23AC39DD1C1192435E0476E06ED6A76B
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514033207_001_dotnet_hostfxr_7.0.16_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514033207_001_dotnet_hostfxr_7.0.16_win_x64.msi.log
- Size 95KB
- SHA256 4c52d2f37bfd313169b2266451c0ce7629f662afe8f7a427e770eb6b6a3c8968
- MD5 8f1a932fa375d4fb01470f7e9639aede
- SHA1 26083a4ae205bfa5f7201b29112a375705dc3506
- SHA512 d1bb2a125dd46c61742e007e0160ce2aa617ab845ec0d3b09a6ae5f4195fd5528aa6b08f69fff26f68ef3655e0efb0e56afcca024414dd9921952df348391b84
- SSDEEP 1536:30ri/jh8lZXVKmnoL+CTVqs0ZCZNtawYY2uQWPGducklb7oPTjaZSRi1QY:3X8jaZSRi6Y
- TLSH T19FA305192FF80115B2B39F47DEF30426AA77B9135935DD0D30C2875D00B6A06E96DBAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514033207_002_dotnet_host_7.0.16_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514033207_002_dotnet_host_7.0.16_win_x64.msi.log
- Size 109KB
- SHA256 8427bce231ac29e58858871e4d810b0d084edd825ec3d338b79bb42ebf9592f1
- MD5 b381751aab3b6a7d66890dc14e2c877f
- SHA1 d7731c0b830493e4bb1bffd2bfe969476309713e
- SHA512 fc04e490ed52388cef940f996514044f7c3a49ff974dd91746b4fe7d455039e88eb26d975d773e611751a00d2ec5adf9c708b71f4492c4d41853d7f10c000866
- SSDEEP 1536:kTygnnw9E4SNyQO7OQgv0CEpYJqDgKCSkfQmVm0Q+eweTjtQ2ZSMJ3NEhuakP:kf8jtQ2ZSMJ3NEhu/P
- TLSH T115B305296FF40119B2B3AF47DEF34416AA377D179935DC0C21C2870D04F6A0AA96D7AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514033207_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514033207_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log
- Size 852KB
- SHA256 f130ffe8f07da6393994a6dc6038d604269dc745360ebd404a9b4f744bad22e3
- MD5 8d0c0967d74e07b3a10cfe5abef7e212
- SHA1 2c225c9bfa97caf56b3b8ad5bbddc3ffb31b7041
- SHA512 7eb38e662cce16115df4101b345fe10b1378484ba804b54ab135041f63c665050a869757a4c3255a62a042946a1eb27d9c665c87f6470008c682e2d7f8623daa
- SSDEEP 3072:mOuAjdtQntCsMbl1YU6RIXbHzU4m1qp/AyCrKX3FazaYBUbXTtN/OyS0thV1mkEU:3j/iO
- TLSH T14105E724ABF80615B7B39F47DAF34416A83BBD32AC34D90C1056835E09B6E05DC6B76B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514033227.log
- Size 15KB
- SHA256 d49f9e0527bb89b565b10fd3d1f35fb3a7ced51179609d18dd7c67f2fca71449
- MD5 2045e073513437bc4bb91e3e0241e110
- SHA1 dd9c5b77e7664ee321148a55d136fd9619477127
- SHA512 40004dffa429e55bf97cc9921b6b25de06ab076c311642a5123112413dda932f9a0fdf838f2ba9ce621dab6821c0f26c91f3e547853a9358af382aee3a997636
- SSDEEP 384:19gCVSgLgggigngfgHNgwdNgw0VSv45N9OCDvVCV49IVG1WZXCgjgUgVg+QgwnMB:1bWrdr2b9rkOqz0MqM4
- TLSH T1F372214A3FA562CE1C76B17AC7376BF88B1773570B00E4E43A92021AC973858E78D647
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514033227_000_dotnet_runtime_8.0.15_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514033227_000_dotnet_runtime_8.0.15_win_x64.msi.log
- Size 470KB
- SHA256 ade31272c8d9019393394c82e1696a6479b2ba38781ad0c12129fe3eb7b0ad0d
- MD5 d83b4953daf186ae59c7d3395e6ae499
- SHA1 fe94e9bb6a18a16dc9273d12cff088fea1308383
- SHA512 fdb06a79295528053aa19aa8919f614818082c76ec6324e5cdd808fa8b97b17130ea6e86f28c064a5b14ac555220acca5c93bd87a6f68f955fe4449270394954
- SSDEEP 3072:4OroGiZnF6rKnyEwtXla0eIy7ejDxwqA2nSSYE4Pm10I2+59erqsHGkmIC8UEona:RjRifZ
- TLSH T13AA41814ABF80215A3B39F47EEF344169876BD72AC39C91C1092435D04B6E06ED6AB7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514033227_001_dotnet_hostfxr_8.0.15_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514033227_001_dotnet_hostfxr_8.0.15_win_x64.msi.log
- Size 95KB
- SHA256 edb6c7c75282e2a5350c30e1aa65094add3bac4227da2ad7bc03884b9360e3c2
- MD5 08ca6506747ee7433bb97c94ceec96bd
- SHA1 05b7d416e4c057ceecc0139b8f90164ad3447fbe
- SHA512 bce0aa876e9102a7ff1171c548d1defe3f6035ec6ab4d971882806705234f2c194eca99de5ea542bfab0479a2e5cd2f565c3e4677d8da8ac86249abb5f602ffa
- SSDEEP 1536:ioqgAdL9hnZfHtw5FrTjO1z2rmQIBzrhXps8vRZhLDxrCekBkM0MUM/zy8iI5GVd:ioqgAdL9Vl/fMzy8iI5/jtvZTgwV26cv
- TLSH T1EFA3FC1A2FF40165B2B79B8B9AF348279977BA225935CD1D20C2830D00F5909ED6D7FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514033227_002_dotnet_host_8.0.15_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514033227_002_dotnet_host_8.0.15_win_x64.msi.log
- Size 109KB
- SHA256 8d8e1f0fcd54e1b47f7942b1fe4c362cb5f77dc7243447855b603d4044b12a12
- MD5 ea1391cbdaa343ca10a9106021d3edae
- SHA1 64c7b237dc99a99664f9e5d7cb0c57f0a4415049
- SHA512 1c6d1fa3a3d9c96cc2eacbfd0fd1c1aeda7063567d6a97ebb7ccf2f3bb0abde66bae8da29eb10d5e647d30c20f3be6cec45dff4179f05a36326544beb9447019
- SSDEEP 3072:sADE3eIC+eg+EJ7WlIjIDHUMcHoc8ddOGV/6j2D:ojw
- TLSH T15AB317296FF80155B2BB9B47DAF30426A977BE229935CD0C61C2830D00B5909AD6D7FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514033227_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514033227_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log
- Size 849KB
- SHA256 84a7795642d20de438adebce969ed3355ee2e01ddc62d0529d6f777440e80efa
- MD5 cad11b66553b700a648837431ae2db60
- SHA1 e295a46c7f9b812d1bb0f82a72c4ae5bd27f29da
- SHA512 ae5f50daf6d5bb8c08b18cfa0b049efafb76e60c67e9a5dafcd2b4500a5451019299a9c471711425014a9ae98e33a27b9672178f6bbd04d480554a6358cab37e
- SSDEEP 3072:TORBW/9Tti8oz/7I3tPeAFxNoGwziUO8TzYjNbDbXvPBhsbV0fEYw7J3rxJQiZE4:XjJy
- TLSH T13705E824ABF90615B3B78F47DAF3441A943BBD22AC38C91C1056835D09B6E06DC6A77F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\aria-debug-1152.log
- Size 470B
- SHA256 98567337876ab1633de44f69159b85ccd2662c53a35d51b55508d0d876abe3f6
- MD5 edb3879be1b684654efbab5d56ab000d
- SHA1 c698be28841be531d61e58b4ac23c5bde3c49972
- SHA512 b2954003b8a90bf67914bcb389b6b2020f36e6457aad0b4d73d5ce3869c30da71d66d55b04fdecf3563bb64cd18b20f186e6e0ff7669edfc23f8bdf21b440164
- TLSH T134F09E4A0AAB4C73C20B76B3B4939AE328D4E77FB2D04710851D432810873985143C84
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\browser.exe
- Size 868KB
- SHA256 35e2b6e0dd05284e292dd79831f9f8641911c85141b27f96b545cbeade525804
- MD5 2018c00cd7560e2369452979c72c351e
- SHA1 8145eb5052e437455ec470d945f3339eb2b3ed76
- SHA512 288276ac4cd888c24f9908f9be8970f26536a4d3d9e93f688d25e9f631da74d5d858ee950607b72f784113e5d74980110a2d07f843d02b6490ba3e07a5e3b8e7
- SSDEEP 24576:Vri8bo/mHtxH/Yt44/JhZx2N0+wk4fia2iBkQWvyh2j:M8qmHtxm/JhZoxwk4frxyQWae
- TLSH T13B159E117A82C433F56201310A78ABA590BEF9355F7136CF63E84B2E69306C26D72B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\cv_debug.log
- Size 2KB
- SHA256 40dc4b2c342ddf9988637aa6f8c7a75c6713b884f096ba98abb45ec30c74b380
- MD5 e8795ec25d6662e0eb1f814744dd0faf
- SHA1 ea1bd7e8f7a13a7e7b65130f2fb5ba7c4ffd6f32
- SHA512 d626fe06f92e978ebfed358649bdfffdda148344993416f061b9add5fd521e49bcbdce89968ab9f1471a2e36b08db064f586a971679fe0cdd4fbd0fc34274ec8
- TLSH T1414129903575623F3BC747C560694C949661F180032F9B5CAE0A8074FE6CEB1A76EBC5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
- Size 1KB
- SHA256 0073e131d1818c5c8efeedc18eea79a942fac0684b462568c3db9c4a575dd397
- MD5 392fcc58c1102d94a1d7404ed1352a69
- SHA1 97096b2fad196a5fea5fbaff040fb8d4e7dfc900
- SHA512 ddb350f2c6d2460620a06600e7cb9ef8e6827297033da23ac06bfbbd31d51efc2f63838a06a839c23fd309ad8166dac21beb41158922fac6a48087212ed6ede0
- TLSH T1BB2129CB0DE9D86064EFA8A1C60DBEE391E6006F329599FB7DD4458E2403458B5FD4C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\dd_vcredistMSI6CF5.txt
- Size 426KB
- SHA256 f7b75f3cbc32fba4c2e1326dee3703b5d5716a89cd752df4b4c887d3cde3c476
- MD5 363db19fbafa462ef57059edcfe11988
- SHA1 14f6d645b759e0963a118405ddedcecc3ca3658f
- SHA512 b25357daad8ccb498dafa6a211998ff51c9a0d1ca361aa589603fd87cf42dedbb93d028c073af8a93cdfe46d21d40eec99f7c8e4dd41904edc03d1a17dae4d23
- SSDEEP 1536:fCedIf39nDw4IxkE53Kbuj6LDVxcxDnXVlGozxfUIMAXn0mCRRND5Eor1t1PG399:fCJqjn9ibVQo/U/1
- TLSH T1589438295FF50265F2F29E8799F30527A833BDA3B935DD0C2190830D06A2F059975FAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\dd_vcredistMSI6D0F.txt
- Size 414KB
- SHA256 c6e023a6e396e524f65a73174e01a4bda8d623a9e13b8f966342c46f1279aed6
- MD5 a6b9cb8fdfb5ca8de4aa70c80421181d
- SHA1 232585204ca36af2d5c8f1ca264f882c29786259
- SHA512 1cc6f5f1ee6be7e3f0588882a7194e6e78895c2fa1fcdb50a1811b25b6bc369ad4e0d83d866ab55bb8cc982e3bacc971c2ff97f4ff6b9daa11e0319433c943fd
- SSDEEP 1536:ffwSqvXd3TQYBBEckXnzGAnY/BicOf77EZzRP9Too4kzTAKOFFp0JLfMu22oNASU:ffB7jn5rheAJaFJWfe
- TLSH T1EF9467295FF90225B2B6DE43DEF3442759337D96EC35DD1C2280830D06B2A05997ABBB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\dd_vcredistUI6CF5.txt
- Size 11KB
- SHA256 c8f450b4aacefa5707841609648b6ae53595ef8b14c59173ef0d6afe2be479d6
- MD5 43cb6ac9fd4e3dc20a1e89fff3a7d1cb
- SHA1 a24187b531a44f93a5e289bebf718e5b7bdca6a3
- SHA512 7a566c9bede904911808e7bfec05c581d0152d5306e3e736341e9b37ab3b83214ac07cbb42eb7bdb6336504271d844e61ed45fb9dbe1bbf8c07d7e8aa44a4e81
- SSDEEP 192:cTp0r9tmbQW4nInjSnInYMqqv/TynInZ2PG8chxp8vP:cTp0r9tmbQW4IOIYMqqv/TyImj5vP
- TLSH T19732821AA7F40445B8F2DA4FE8F35017AFB7BD825A78DD1D02F5334A05AA500F5A236B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\dd_vcredistUI6D0F.txt
- Size 11KB
- SHA256 9dc1066fd2fb85b21d651d4931febf42e0f6f2e005fe28b1a28269321105e082
- MD5 fe0483bea8462df8a6c570bcee530a4f
- SHA1 c00dec2865bd0346a8de9dd960f6ab26ca9210b4
- SHA512 eda330ed78798ec174a3b159283d2da3e2e18eebc0176a59d1d08dbcfbbd1be9b8ab83f13f247ec65e7faf1db0643bcc1169ff8c00334cfe29448e2086a66976
- SSDEEP 192:7HJsC+2nt1+jwOgnQnzKnQnAMveninxeXu8Uhpx8Hv:7HJsC+2nt1+jwOgQGQAMveiOLBHv
- TLSH T18232732AE7F40445B8F2DA4FD8F25017AFB7B9C25A78DD0D02F5338A15AA501F4A136B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\jawshtml.html
- Size 13B
- SHA256 7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73
- MD5 b2a4bc176e9f29b0c439ef9a53a62a1a
- SHA1 1ae520cbbf7e14af867232784194366b3d1c3f34
- SHA512 e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\jusched.log
- Size 163KB
- SHA256 f1ce4a852ed4c7903bcb50d023c6839e287496bc3ac279faac85651eb72c4a5f
- MD5 8a0681771d0083b59b1b8c50bf05081d
- SHA1 50c20dc59ec13b364e5dd2d36400d11c608a264a
- SHA512 6b18f4ecb35cae7101c9cc434e2e8304b13b305c185c1c179256fd1257941ae6b18d7b2e6b18c871ef7a2037c61b473da7c6bd1508fa15dfc162d1d83fb3d1b6
- SSDEEP 3072:e87ZchxJracfsrCxUm1FIDQ6XU6xxnfoA1tam/iTq4f:l3Y5
- TLSH T173F31246C92E84BA39538BD3C37A5D64D692162E839E891831CFC2EFB445D03D52E4EF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\mapping.csv
- Size 120KB
- SHA256 2684d360ec473113d922a2738c5c6f6702975e6ac7ee4023258a12ed26c9fefe
- MD5 d3186aada63877a1fe1c2ed4b2e2b77d
- SHA1 f66d9307be6cbbb22941c724d2cf6954b41d7bb0
- SHA512 c94e8aa368a44f1df9f0318ca266f5a6a9140945d55a579dee2fd10aff3d4704a72a216718b35e44429012d68c2bb30a92d5179fbc9fb4b222456a017d8981c0
- SSDEEP 768:oauu63GP/3Go+73GEVF3GL2QkUQ1HqfEe0/+dg5iwFeCo6QOATLJ1R4pbfyQw+t0:gu63GP/3Go+73GEVF3GGUn
- TLSH T11DC35121D2F6619CF5F3AF941AB41AA91E73FC16AD2DED9C0250620D0466E61DE31F33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\msedge_installer.log
- Size 2KB
- SHA256 f0a126711b745f855ccbef55dd2e750f9294b49dcf9d34434526ae39a80f112e
- MD5 30d07ef621b6a88ef9f909ba82bffa49
- SHA1 70a6bf237356166ea1c38ab832cc7a7a546a7473
- SHA512 0515cb61898494f6dd49aca4f10d530e66e1f884fc71f8e0349b4f749586a6bf58309389f09c615de5c82838a020a9e477cae9abaad8fdab7da12cfd2663d32e
- TLSH T1D651D9146A03863D1FD961EF725B773C01F916AA81C1EF20B5F9E410B042AB91A7F8E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\wctECA2.tmp
- Size 63KB
- SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
- MD5 e516a60bc980095e8d156b1a99ab5eee
- SHA1 238e243ffc12d4e012fd020c9822703109b987f6
- SHA512 9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58
- SSDEEP 384:poaSLGTSy3S0XuMU9mCzHS7vpvpJGV6Hu/i49Pji7iJI5TZCP56vS1xDR+dBUFvT:WryF7U9mCzHS7vu/xV2iP56vcDR+P0T
- TLSH T18A53DD9E2108B66FE215AD5A7EABA9861C31746E3842CFCDF1CDC26C5F40DC4334A5A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\wmsetup.log
- Size 693B
- SHA256 cb7d4f1c0c57d6bff0c8df25c73813653a46e2dab00803205dd877a4eff88b3b
- MD5 a40a7172cd468f2ef3de01212a757309
- SHA1 3fe1b8d708f614d5d51d23e33fdeba133a564663
- SHA512 a7c148be3e113c91dc29eb23f17a40a677b8ee610293cb182f85402a06ba212daeca80906ec5c9fd49d8d4a50333c8aef3cdca29c5f671936f5bfc23d3ac7fad
- TLSH T18A014CD7090998B49DD01BA769CCCE3573BAE3CF4794E027A34AD416440913DB33E06D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{C433BD9A-A0CF-0CB5-735E-38D659A0EE11}\~DF2295E2963C0CB5C5.TMP
- Size 16KB
- SHA256 205d000aa762f3a96ac3ad4b25d791b5f7fc8efb9056b78f299f671a02b9fd21
- MD5 679672a5004e0af50529f33db5469699
- SHA1 427a4ec3281c9c4faeb47a22ffbe7ca3e928afb0
- SHA512 f8615c5e5cf768a94e06961c7c8bef99beb43e004a882a4e384f5dd56e047ca59b963a59971f78dcf4c35d1bb92d3a9bc7055bfa3a0d597635de1a9ce06a3476
- SSDEEP 3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
- TLSH T19B7202427234D665D54809368D41D5CC9776BD00DE14D14375DA775F0A314E04454652
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\HowToRestoreFiles.txt
- Size 6KB
- SHA256 87e5310f755bd2b83a15e4ae556a66d5dcb1ca2ec6eabe446ceeba517d60c8ad
- MD5 3979dc073cba0f411eb87a347fecb002
- SHA1 764c45c217c73002927d7b863439b740195250c7
- SHA512 92b1b71053aabb8646369f338f5e39e036b1816b4bb69f17cd76c73e81ce858bbbda2423b674143fb7b39ea97e5ec9a64e53dc61ea2391d934f6b0fddf29c793
- SSDEEP 192:c1yz/zTSoczRHzNTrz/z777zmnzpyEz/zHRxpzsgCzXIEp:0yz/zTVczhzlz/zn7z+zMEz/zHJzsdzV
- TLSH T1D8D1691733FD4645B3F3AB89197555A00B7BFAD26E3CCA8C01A6141D08B5B78E960FA3
- MD5 SHA1 SHA512 SSDEEP TLSH