Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/05/2026, 18:10
Behavioral task
behavioral1
Sample
file.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win11-20260513-en
windows11-21h2-x64
24 signatures
150 seconds
General
- Target file.exe
- Size 344KB
- Sample260526-wsdajsax21
- SHA256 eef5cb41b2c7fe11ce2a0b05de8c6ed583286a0bbc8c632aa073772dcad3efc6
- MD5 8eed221c03dada349c651260e2e61845
- SHA1 ede50e64f0afc854ce3b2f2edcc401c4a564fcb0
- SHA512 20cd5937df68a9992729be39945b8b29a02efc343592f710550a35d8bfefbd185aba3f5282282f4cc0637bfaf9f96235cd5c9e3ca5b231dfa30cadf23a1339fe
- SSDEEP 6144:pO8txB35TDQtK92ZefDm+Fd0Kdd/+CDbLwL6Qgg/wAG/kaRC0y8BAJL0y5f6O:TtiefWKdd/+CPLE6Jg4AQRzy8BG6O
- TLSH T15E7412A721BCA0D1F45D2CB62419C32A26454C5602331B58F7DBBAE1CE7B58BF6132F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Clears Windows event logs 1 TTPs 3 IoCs
pid Process 6544 wevtutil.exe 6560 wevtutil.exe 6552 wevtutil.exe - Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 7916 bcdedit.exe 7908 bcdedit.exe - Renames multiple (472) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 7924 wbadmin.exe -
pid Process 7932 wbadmin.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_x64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe browser.exe - Executes dropped EXE 2 IoCs
pid Process 860 browser.exe 4488 browser.exe - Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\exefile\shell file.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command browser.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\exefile\shell\open\command browser.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" file.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\exefile\shell\open\command file.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\exefile\shell\open file.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" browser.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" browser.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\browser.exe = "notepad.exe \"C:\\temp\\HowToRestoreFiles.txt\"" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\browser = "\"C:\\Users\\Admin\\AppData\\Local\\{E4343229-119A-C66F-D851-4262261C6478}\\browser.exe\" " file.exe - Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 4328 powercfg.exe 4168 powercfg.exe 3524 powercfg.exe 4184 powercfg.exe 4392 powercfg.exe 3996 powercfg.exe 1228 powercfg.exe 3420 powercfg.exe -
resource yara_rule behavioral1/memory/5092-0-0x0000000000AA0000-0x0000000000B8C000-memory.dmp upx behavioral1/files/0x0007000000024561-55.dat upx behavioral1/memory/860-56-0x0000000000600000-0x00000000006EC000-memory.dmp upx behavioral1/memory/4488-114-0x0000000000600000-0x00000000006EC000-memory.dmp upx behavioral1/memory/5092-131-0x0000000000AA0000-0x0000000000B8C000-memory.dmp upx behavioral1/memory/860-1099-0x0000000000600000-0x00000000006EC000-memory.dmp upx behavioral1/memory/5092-1107-0x0000000000AA0000-0x0000000000B8C000-memory.dmp upx behavioral1/memory/4488-1109-0x0000000000600000-0x00000000006EC000-memory.dmp upx behavioral1/memory/860-1108-0x0000000000600000-0x00000000006EC000-memory.dmp upx behavioral1/memory/860-1111-0x0000000000600000-0x00000000006EC000-memory.dmp upx behavioral1/memory/860-1115-0x0000000000600000-0x00000000006EC000-memory.dmp upx behavioral1/memory/860-1117-0x0000000000600000-0x00000000006EC000-memory.dmp upx behavioral1/memory/860-1123-0x0000000000600000-0x00000000006EC000-memory.dmp upx behavioral1/memory/860-1142-0x0000000000600000-0x00000000006EC000-memory.dmp upx - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe -
pid Process 800 powershell.exe 3136 powershell.exe 2524 powershell.exe 3984 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wevtutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fsutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wevtutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fsutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language browser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language browser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wevtutil.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 6700 PING.EXE 1184 cmd.exe 3908 PING.EXE 6572 cmd.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName vds.exe - Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command file.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\exefile\shell\open\command file.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\exefile\shell\open file.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\p2kfile\shell browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\p2kfile\shell\open\command browser.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\exefile\shell file.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" browser.exe Key created \REGISTRY\MACHINE\Software\Classes\p2kfile\shell\open\command browser.exe Key created \REGISTRY\MACHINE\Software\Classes\.74et2_p2k browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" file.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\exefile\shell\open\command browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\p2kfile\shell\open\command\ = "notepad.exe \"C:\\temp\\HowToRestoreFiles.txt\"" browser.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\exefile file.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\p2kfile browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\p2kfile\shell\open browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.74et2_p2k\ = "p2kfile" browser.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 6508 notepad.exe - Runs ping.exe 1 TTPs 2 IoCs
pid Process 3908 PING.EXE 6700 PING.EXE - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 3136 powershell.exe 3136 powershell.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 3984 powershell.exe 800 powershell.exe 2524 powershell.exe 3984 powershell.exe 800 powershell.exe 2524 powershell.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe 860 browser.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5092 file.exe Token: SeSecurityPrivilege 5092 file.exe Token: SeTakeOwnershipPrivilege 5092 file.exe Token: SeLoadDriverPrivilege 5092 file.exe Token: SeSystemProfilePrivilege 5092 file.exe Token: SeSystemtimePrivilege 5092 file.exe Token: SeProfSingleProcessPrivilege 5092 file.exe Token: SeIncBasePriorityPrivilege 5092 file.exe Token: SeCreatePagefilePrivilege 5092 file.exe Token: SeBackupPrivilege 5092 file.exe Token: SeRestorePrivilege 5092 file.exe Token: SeShutdownPrivilege 5092 file.exe Token: SeDebugPrivilege 5092 file.exe Token: SeSystemEnvironmentPrivilege 5092 file.exe Token: SeChangeNotifyPrivilege 5092 file.exe Token: SeRemoteShutdownPrivilege 5092 file.exe Token: SeUndockPrivilege 5092 file.exe Token: SeManageVolumePrivilege 5092 file.exe Token: SeImpersonatePrivilege 5092 file.exe Token: SeCreateGlobalPrivilege 5092 file.exe Token: 33 5092 file.exe Token: 34 5092 file.exe Token: 35 5092 file.exe Token: 36 5092 file.exe Token: SeIncreaseQuotaPrivilege 860 browser.exe Token: SeSecurityPrivilege 860 browser.exe Token: SeTakeOwnershipPrivilege 860 browser.exe Token: SeLoadDriverPrivilege 860 browser.exe Token: SeSystemProfilePrivilege 860 browser.exe Token: SeSystemtimePrivilege 860 browser.exe Token: SeProfSingleProcessPrivilege 860 browser.exe Token: SeIncBasePriorityPrivilege 860 browser.exe Token: SeCreatePagefilePrivilege 860 browser.exe Token: SeBackupPrivilege 860 browser.exe Token: SeRestorePrivilege 860 browser.exe Token: SeShutdownPrivilege 860 browser.exe Token: SeDebugPrivilege 860 browser.exe Token: SeSystemEnvironmentPrivilege 860 browser.exe Token: SeChangeNotifyPrivilege 860 browser.exe Token: SeRemoteShutdownPrivilege 860 browser.exe Token: SeUndockPrivilege 860 browser.exe Token: SeManageVolumePrivilege 860 browser.exe Token: SeImpersonatePrivilege 860 browser.exe Token: SeCreateGlobalPrivilege 860 browser.exe Token: 33 860 browser.exe Token: 34 860 browser.exe Token: 35 860 browser.exe Token: 36 860 browser.exe Token: SeIncreaseQuotaPrivilege 4488 browser.exe Token: SeSecurityPrivilege 4488 browser.exe Token: SeTakeOwnershipPrivilege 4488 browser.exe Token: SeLoadDriverPrivilege 4488 browser.exe Token: SeSystemProfilePrivilege 4488 browser.exe Token: SeSystemtimePrivilege 4488 browser.exe Token: SeProfSingleProcessPrivilege 4488 browser.exe Token: SeIncBasePriorityPrivilege 4488 browser.exe Token: SeCreatePagefilePrivilege 4488 browser.exe Token: SeBackupPrivilege 4488 browser.exe Token: SeRestorePrivilege 4488 browser.exe Token: SeShutdownPrivilege 4488 browser.exe Token: SeDebugPrivilege 4488 browser.exe Token: SeSystemEnvironmentPrivilege 4488 browser.exe Token: SeChangeNotifyPrivilege 4488 browser.exe Token: SeRemoteShutdownPrivilege 4488 browser.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 5092 wrote to memory of 860 5092 file.exe 89 PID 860 wrote to memory of 4488 860 browser.exe 90 PID 860 wrote to memory of 3136 860 browser.exe 91 PID 860 wrote to memory of 4184 860 browser.exe 98 PID 860 wrote to memory of 3524 860 browser.exe 99 PID 860 wrote to memory of 4168 860 browser.exe 100 PID 860 wrote to memory of 4328 860 browser.exe 102 PID 860 wrote to memory of 3420 860 browser.exe 103 PID 860 wrote to memory of 1228 860 browser.exe 104 PID 860 wrote to memory of 3996 860 browser.exe 106 PID 860 wrote to memory of 4392 860 browser.exe 107 PID 860 wrote to memory of 800 860 browser.exe 109 PID 860 wrote to memory of 3984 860 browser.exe 110 PID 860 wrote to memory of 2524 860 browser.exe 111 PID 860 wrote to memory of 7908 860 browser.exe 120 PID 860 wrote to memory of 7916 860 browser.exe 121 PID 860 wrote to memory of 7924 860 browser.exe 122 PID 860 wrote to memory of 7932 860 browser.exe 123 PID 5092 wrote to memory of 1184 5092 file.exe 134 PID 1184 wrote to memory of 3908 1184 cmd.exe 136 PID 1184 wrote to memory of 4980 1184 cmd.exe 147 PID 860 wrote to memory of 6508 860 browser.exe 163 PID 860 wrote to memory of 6544 860 browser.exe 164 PID 860 wrote to memory of 6552 860 browser.exe 165 PID 860 wrote to memory of 6560 860 browser.exe 166 PID 860 wrote to memory of 6572 860 browser.exe 167 PID 6572 wrote to memory of 6700 6572 cmd.exe 172 PID 6572 wrote to memory of 6876 6572 cmd.exe 175 - System policy modification 1 TTPs 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer browser.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" browser.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = " " browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System browser.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All files have been encrypted due to security problems on your computer.\r\nIf you want to recover them, please visit our website:\r\nhttps://client.pay2key.pro/?user_id=BGIxEdq2cYXM8x7ELMirhwm_8AI5QA6YKvzNSYk6c2Q*74et2\r\n( http://23.137.254.233/?user_id=BGIxEdq2cYXM8x7ELMirhwm_8AI5QA6YKvzNSYk6c2Q*74et2 )\r\nBefore payment you will be able to send up to 3 test files for free decryption.\r\nAfter payment, the system will automatically issue a tool to fully recover all your files.\r\nYour unique ID: BGIxEdq2cYXM8x7ELMirhwm_8AI5QA6YKvzNSYk6c2Q*74et2\r\n* * *\r\nIf first address cannot be opened, visit our main site on the I2P network (similar to TOR):\r\nhttp://pay2keys7rgdzrhgzxyd7egpxc2pusdrkofmqfnwclts2rnjsrva.b32.i2p/?user_id=BGIxEdq2cYXM8x7ELMirhwm_8AI5QA6YKvzNSYk6c2Q*74et2\r\nSpecial browser for accessing I2P sites: https://github.com/PurpleI2P/i2pdbrowser/releases/tag/latest\r\n" browser.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\browser.exe"C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\browser.exe"2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:860 -
C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\browser.exe"C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\browser.exe" -e watch -pid 860 -!3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4488
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-BitLockerVolume | Suspend-BitLocker"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3136
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -H off3⤵
- Power Settings
PID:4184
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 03⤵
- Power Settings
PID:3524
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 03⤵
- Power Settings
PID:4168
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 03⤵
- Power Settings
PID:4328
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 03⤵
- Power Settings
PID:3420
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 03⤵
- Power Settings
PID:1228
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 03⤵
- Power Settings
PID:3996
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c3⤵
- Power Settings
PID:4392
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:800
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3984
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2524
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:7908
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:7916
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP3⤵
- Deletes System State backups
- Drops file in Windows directory
PID:7924
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:7932
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe "C:\temp\HowToRestoreFiles.txt"3⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
PID:6508
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl security3⤵
- Clears Windows event logs
- System Location Discovery: System Language Discovery
PID:6544
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl system3⤵
- Clears Windows event logs
- System Location Discovery: System Language Discovery
PID:6552
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl application3⤵
- Clears Windows event logs
- System Location Discovery: System Language Discovery
PID:6560
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /d /c "ping 127.2 -n 5 & fsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\browser.exe" & cd /d "C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}" & Del /f /q /a *.exe *.ini *.dll *.bat *.cmd *.db *.tmp & cd/ & rd /q /s "C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}""3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:6572 -
C:\Windows\SysWOW64\PING.EXEping 127.2 -n 54⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:6700
-
-
C:\Windows\SysWOW64\fsutil.exefsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\browser.exe"4⤵
- System Location Discovery: System Language Discovery
PID:6876
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /d /c "ping 127.2 -n 5 & fsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\Temp\file.exe" & cd /d "C:\Users\Admin\AppData\Local\Temp" & Del /f /q /a *.exe *.bat"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\PING.EXEping 127.2 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3908
-
-
C:\Windows\SysWOW64\fsutil.exefsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\Temp\file.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4980
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵PID:2756
-
C:\Windows\System32\BdeUISrv.exeC:\Windows\System32\BdeUISrv.exe -Embedding1⤵PID:4960
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:8124
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:4280
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:6956
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:7788
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4764
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:7836
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1864
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1008
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4492
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2796
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5104
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5412
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5432
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Defense Evasion
Indicator Removal
3Clear Windows Event Logs
1File Deletion
2Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 b40673df4c5dcc1dee67b875d8bd04f90cf30c5fec69adbd74d44d58ae790d76
- MD5 4ef863667431fe69953f02ee771d179c
- SHA1 980e096a9c27dd5513373945b6e531af615322c4
- SHA512 bebbb9f3ece4d5c72132d601b33520ce809aad3c6ea87808be80f8c6bf844905cbe3b72de6098a8737de4a1434bd5fa0537da6318e80bfd16dc6ebfb446a2f10
- TLSH T12071BF323375B0D4C9567F072A2819C063BF4396EA98AF4CB25C621ED92751B9B122F7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 68249b53b873ba938532a5f28f79060643fe9fc957bf0e123a9a334b86179c02
- MD5 a314a9ddc4847a2c7e3b1bac3be66c0d
- SHA1 f15f80ab6dd061e1b6a3b785d2f604bda6dc3b9a
- SHA512 65e0ad3cd74f2f9b2091559c99baf9d27d0a230a57cad6fc274a784a76dddb80f75656adb411526eae2946bda511060a108fa43f79417d570bdbaffac0d27a21
- TLSH T194112223F38C89A1CC861639509DAC5172B686CB81AEDFDF7FC0C210E5AF584CB61294
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 b14a02b5cbfb55c6bf368d4ade7e7b85435660907832938fed31241a5fe0a51c
- MD5 c87c8a6c281b5dd82d832989a48710b5
- SHA1 55a002e6951e03c7966fcae5da1bbb2a5ea4bd75
- SHA512 ca8adf5f76443b728777049be6400d7d22434bf6255085bf76a401dee6a45e7bbff4ae374d16652bd1514e47ede0bd96b9efe409654980881a5eabf7bca20ebf
- TLSH T1CC216527B3DD8861DC96123A109D9C1076B783C7809ECFDF6AC0D614A57FAD8CB61290
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 c6216467be543936cfb060624ac52f8e191e877b851dc388ccf4af5ac4c8f51a
- MD5 a7dbe075ec7be9c58c85829b54b0fb5e
- SHA1 b0b2365f1ebe5804aea6842238c90aa74e11f4dd
- SHA512 2be286b332a28691b0cdd87679ae80fd49938a0f58a991166204a729c727565dda67a7b780e5ea7db789e0889f8f75b33953bcbb17fd79f158bdb7ac861f2513
- TLSH T17B219727B398C961CCD5153A949D9D103276C3CB809ECF8F6A84D225D07FAD8DB61690
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ujee2uqi.geu.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\18e190413af045db88dfbd29609eb877.db
- Size 24KB
- SHA256 2869f91a7c6afe6fcd74a2cad8ffd2e77aba4324d1fdf933d762f6d968a2c7c2
- MD5 9cf07076853c315fa013b71609eb8ecb
- SHA1 5b379d020fcbfb4f237b739ca5b8e1168965067e
- SHA512 9be33f276984f71cf0b280c2794e9c391949060111230a840695236ca836c1f10b4ee36b167a6c1d3d7f7321b1e70fbd986ff45297c221cb6f9bdeb3452eca28
- SSDEEP 48:TJO8VFDYMmtKPlSogMPHnSQDtQruV9/S6wr:1jVGDS9gMfSoQ4/S6wr
- TLSH T1E9B2964237F00165D49B94B6C0FB9FAA27BDC444012303EFDAB4916249C04CAE82E8FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\18e190413af045db88dfbd29609eb877.db-shm
- Size 32KB
- SHA256 1d626a851db00f44a6f96e8e5f89718e0fb92f8a2573599c9ec00188395c40fe
- MD5 aea6a95b44190112b89b3037223298ad
- SHA1 baffd19e66210c5bf105ae284438517cabf60569
- SHA512 e5e8f7c923f6598ba7286f5dd3c4900b0c8383f86cd2acc780147a9ef1a804945902e5fd6ddeacbc034dd1f683ca5662df0da28ec04bc53ece9c5abce48b9ef6
- SSDEEP 3:Gr/hbgaAhfrW9oR/hbgaAhfrWlMRa9//Vlqll2lUlZll:Gm1ox1ou89XVzUl
- TLSH T196E2021566E57C5BCC55023F991342441239BD154A83C347A596733A5435DCD0745DA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\18e190413af045db88dfbd29609eb877.db-wal
- Size 16KB
- SHA256 e385d5ed32bb89ce32571c4c3a8a01e429e22bf3ca63729b9e22794d24a09e4c
- MD5 fac551350c3af1c27fed886fef8aa09e
- SHA1 ec3cc23133958e61a6034d132ac92771d530c67e
- SHA512 bae5c2ecec8ed8c330e7ea99c5003da6f9062de419182435c6258174bd84c7b67c80819cc00d0bf958b7649f0a17f3d268970a28032ec67a488e83845bf96093
- SSDEEP 96:MjVGnUx9gMfSoQ4/S6wrgUx9gMfSoQ4/S6wrK:M4nuDSoxSSuDSoxSA
- TLSH T18372974637F2026AD49BD8B6C1FFDE9A27F9C444112303DEDAB8922349804D7E41EDA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\18e190413af045db88dfbd29609eb877.db.session64
- Size 64KB
- SHA256 75bd397acca91eb235e6a66aaadb51f5727730634711862f5a5ee730e474f593
- MD5 a9224056c324d0a06234af888649d3c3
- SHA1 a1eef1cef7ddb4793330199b046e160b08f7df08
- SHA512 3401d497ca3d5468a81167ae20738a35ad4235aea16e2a789ccddfccd19982dcb06c91698653406ffd645daa10e0ab3f898c319b99011062fbc08124350d14ca
- SSDEEP 6:ujmt/B5g4I7M/T//3/SC+QstGgsAI7M/T//l1V47BkGkk:r1B5gv7M/xlj37M/dOBkG7
- TLSH T1F85322423901DA70C4CFD93481AD802C2B34AC803D7E3632380472081EE727406842A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\3d396bad-b8dc-4e91-a3ef-54089e109a0d.tmp
- Size 10KB
- SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
- MD5 78e47dda17341bed7be45dccfd89ac87
- SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
- SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
- SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
- TLSH T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\AdobeSFX.log
- Size 1KB
- SHA256 bde34cade94e12e34ad1dd9e4420fe3a150dfed03bcb7adccc8c45d4ec1df16e
- MD5 7d859d0b03de7b28467f55df41be2ef9
- SHA1 a11c5ffeb85a32600ca0aa860ff00ad972ac8070
- SHA512 ebbc07a1bf002abb464076c7be8fa5e3d8682c12bac84d21a11e19be6c493866776721bfc30ab77edc0cb5acb81f59af3c5be549660b8472c974cf824bedfea7
- TLSH T120417A571AFB01772A418686B3A66FFECE90F71B1F4D9960638940383906D3F5EC360A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\DIJHFWDH-20260514-0058.log
- Size 57KB
- SHA256 8671ca0b8291d68aa50eaf3f592634b8cc309ebc3802538c684ff36103dfb96a
- MD5 5e15f827cc98e7781bff0ad3422077c5
- SHA1 256db2887e3c1ced385e3b1595e29b0664d55bf5
- SHA512 316e46e5c874b28ea705250e22e009da7e2e31d9acd8b5fb0c4adb6cdca0e0cca36e3b081b4d584491c05abaa81b39eeaf0cf2670bdd66a9231b89a16fa683dc
- SSDEEP 1536:j96xrCyW5zaDBWJjORdgDAQ40gtGERYtgcC2/7x2ueJVSCFGzJ77MYL6aaH2Tq/4:kDyaUf4RYtgRu
- TLSH T1E6435C2C6EE90696F2F79B869AF74066DA72BD966834DD4D10920F0E1423E417C60F3F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\DIJHFWDH-20260514-0058a.log
- Size 180KB
- SHA256 d414a80ba1fa2d56a85076a1c11e806ea27b8d01750f4db11a0549facadc671d
- MD5 7aabfe8c8a812d75ae94b209c9e683fe
- SHA1 715d7dd89a621017accb4d7c5ba80ca3ba63ba6d
- SHA512 3b454f542ea32a407afd772f0535932cfd192b0d2b4f7a41992374f282899f9eb533ef60b314d3f37de243a1f18589b027bd0b5410e70762097d9e9439a7a301
- SSDEEP 1536:5aIxVdZkleQf7h8TmzYTyw2CjanfTSFtOlT/pTwRfYJqyylIZQagZBEETsZTWn/M:DUm8JqyylIZQagL/Y/j/AW
- TLSH T16804892C69F90656B1F2DA86AAF24023EB71BD666835CD1E50D20B4F0513D42BCA5F3F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\JavaDeployReg.log
- Size 13KB
- SHA256 b8f3c49c52a10f92d9489c3534a93262e9a642ae5923437ceacd9217451df79c
- MD5 a2e5cbba12f3a9fb291934fe7ab0822e
- SHA1 f9390065db54122fe6a5e52882b844adb633066b
- SHA512 b8995859f809a12062aebc95805353b568e40bda85e1a81c6370706c6a90df19e59f5071f4a4d932a9337f19d4b2ee28d641e82bf9518db0276e49535e19226c
- SSDEEP 384:CbaAmHKMHlfKCjQKCj/KCjyKCjCHKCjaKCj9nepmgMVppUmHKMHlfKCjQKCj/KC0:CbaAmHKMHlfKCjQKCj/KCjyKCjCHKCjW
- TLSH T1C652578108EA4DF668F522D6B7023EF2D5B5B04B938B0C14B6D5C578F816D4C63AB4ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft .NET Framework 4.7.2 Setup_20260514_005328156.html
- Size 93KB
- SHA256 08e566c3b70cea6c93693f4f8163869bee33619c86cef18040f2124b8032e800
- MD5 1517f3ac49cfd3088d3c396e9f31e074
- SHA1 b611b654c171328d6c86b294bd87056cf54d14e9
- SHA512 4cce664b4b4ac8061df426cdab085c5de2fa2cd493703e92bac4c444212ebd808c3f544dc674c6fa294d5afc3c0f58978668af64ab4cb596b512ee351bfee5ac
- SSDEEP 768:fdsOTLyUFJFEWUxFzv3v66MK/QvRu5tJPLgz:fdsWyUr+WUxpv3EK/Q3z
- TLSH T10C93B60377D80195A8F3BF4DEDB710260AB9BD855C34DD2C13A54A5D0A96E20ECB2FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514005349.log
- Size 15KB
- SHA256 afdd268e3e9cb333e014c8c820171f7903d1bdaddf456ff89dcefed46174a4ae
- MD5 548cd99eec9dd97d3c4d6fb84fc7e812
- SHA1 2619c67f30ad23104824d10d5d76e33c026dec07
- SHA512 c1b673e10e31a4171c2be156455a50745c4d251cb2d21237aeeed2cd83dc7fb24ac1b1612718f73c25216345be30022b01ae334a412cd71dea46bd2cc3137bfd
- SSDEEP 384:gK3uVc3p3g3g3p3j3MO30QO30kVbagV4V1PVreq+O3e303F3xx30ZM3F3q3Ox30X:grNTQTGbaS61NNFiCiX
- TLSH T1F962AE8769F493820CB0B6DAF31A7FE49F06B4479F2415B06ED3071E8982939F35DA45
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514005349_000_dotnet_runtime_6.0.27_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514005349_000_dotnet_runtime_6.0.27_win_x64.msi.log
- Size 551KB
- SHA256 f20af810f9cab1585290c6ed59cd696b6ba6e02f8f4c7769a33d672b284370a9
- MD5 bcbaf4d195aba8990569df41b8fa958b
- SHA1 49bbd08cefa7bd201838a6a413cbabf423f8798d
- SHA512 bbb226207bf1d1aefc246bdd0833aabd600ef29c4d4276662ae4f57e9217d0e2a4f849c14abd410b3a8c5bce2dd101840d13acd231744cec985ddf76238adfd8
- SSDEEP 3072:sWQDjewhLQh0g8GXhIAn07lmv+x9oIms7LfrfYnN51vzGG+zRcJIyfPv3v8WjR/z:Aj3w5
- TLSH T1B8C44824ABF80266B2B74E57EEF34416E476BC32AC38DD1C1192435D04B6E05D86AB7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514005349_001_dotnet_hostfxr_6.0.27_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514005349_001_dotnet_hostfxr_6.0.27_win_x64.msi.log
- Size 95KB
- SHA256 fc6e33e3cac3db6147c96020b7a7967b311c5a27bd343d79ebc858707de30312
- MD5 37a97098f29c4bcb9be8f3b6c9483074
- SHA1 1191e578ffbac38441e5b786a58e969cccbaa007
- SHA512 aecb0231f7f7c0d82c0bb2ec5afca889be767e324a78b77ebc1242f88e8e2a3f875d79ec16cb270dc7dba6117f039524ccda7739402bc421eef6aeb011253c8b
- SSDEEP 1536:w75TnFibu6gZl3jTmcQaTJppIprjAaiSUs60xG7DARU0e5Jj2eMiHwZ0:wC+j2eMiHE0
- TLSH T1CFA316153FF40196B2B7AA47DEF3882A9A33BD225D35CD1D2182930E05B1904D96DBBF
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514005349_002_dotnet_host_6.0.27_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514005349_002_dotnet_host_6.0.27_win_x64.msi.log
- Size 105KB
- SHA256 9ff56ed7485da3624489dc377a67069927fa7d2ac9e083195c8564fb896138da
- MD5 247eef9b3ea88a43a7d0ab263920558b
- SHA1 c0f5fc02470dfab432da17a9773c9a593059f4b0
- SHA512 cc5ecdc4bbb63f217564cec7e31d0ca3f1b5906063207b85801f0311e5da0cde24691e747cf87deb5a11e2cb23d089bcf0fbe1f673d73ad26edd6c29acaafeac
- SSDEEP 1536:yWsFHJEpw8OZQXRj2JocUa0BbZawTt19nsjOgqkZQwZP5jQwGr1p0zurUJegA:yNhjQwGr1p0zurUJvA
- TLSH T103B305153FF40096B2FB9A47DAF348279673BD265A35CD1D2182830E04B5904DA7EBAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514005349_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514005349_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log
- Size 847KB
- SHA256 68662e17174046ebf02f335bd827c41ae05985cb439730b1b2eaac3c3406010a
- MD5 651b611636c4178d3add5677becd16cd
- SHA1 283e10ee2509d9d81c2ba2c01936b9f074b4bed3
- SHA512 c253b8fb5e438e24f69102896fa9b000423f5b4eac4471d9e32527362a68dc181c4b319ccf3ebefe6f0ee9cd5a504730781a88545b428f092905b09c8a6d3864
- SSDEEP 3072:rNsq2jVHpKkQwB3JQt1EzqWbMBBQOWSQSb8AsC6XSB0Gr0QC1CDMh70s1UpiQ0xK:cjzRfJa
- TLSH T116054B24ABF80666B3B78F17DAF344569437BC22AC38C91C1156874D09B2F05D87AB6F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514005411.log
- Size 15KB
- SHA256 602841df73bb194d37f87bdc3c31ef5254125cb0459b0d7044ab901412a8d90e
- MD5 579eeb39a60e35c16f90d74fc3d0c8fc
- SHA1 59abd1163ee061a7dc4f58893830984e10d26666
- SHA512 5781985f206c78aca4d8eb40c309e67a0317f1d47b906593d897f0f44203398724b17888745a6f2993dc6560f5e58f654206ba0dd3e3eddc1a07633d9d68db1b
- SSDEEP 384:U5alVTauaRazawagaAPa8yPa8iV+jzVPVZCV1xhmazaGaDaS2a8bIahaGa72a8n:UWN/y/E+jhNZkbSQAQn
- TLSH T19B621F816DECA1920DB1B366DB761FE68F17F0870B1017742EEA0E2F9561834978DED8
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514005411_000_dotnet_runtime_7.0.16_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514005411_000_dotnet_runtime_7.0.16_win_x64.msi.log
- Size 470KB
- SHA256 879ea523e558cfa95aa7d9f10dd8afb0d86b9b2d2f4c0083317488a4a4f1f79f
- MD5 2c59febcfef1b5463d7d8043436745a0
- SHA1 93e4e24a38361d12a997c440b55cc8ea4bfd3056
- SHA512 8c19fbd226e52f1b19f4908bf7f030a4f10f8496479647146ccf10b4f2470505a84336b6fba97b02c0b826a22c21a8c1808058f5ae6a20c0d082cf909fce8845
- SSDEEP 3072:Fxe1jFKvOuQljvgJ3nlCCxy5IetBMpZDnoArCRjG90b53DEKQ1cmfRUjtGrsd6jw:Ajn7
- TLSH T12BA44814AFF90266B2B39F47EEF384179476BC21AC3CD51C2182934E0571E09D96BB6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514005411_001_dotnet_hostfxr_7.0.16_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514005411_001_dotnet_hostfxr_7.0.16_win_x64.msi.log
- Size 95KB
- SHA256 5c863c026584e13b97e389ed64bc04ce77887a16eb37dc9dee7109af69e67d80
- MD5 21f089b2d07deb0c21d56fc4e7170c66
- SHA1 27a176882818169d4ddb09c1f4caac5020b23931
- SHA512 9c823c66160994bec05e69be1f1cb0dd40c8336ba74ff516d56a7c01eac4437cee72c2216bd26e385ab6e476a34474e3b766c79d69d4657c70391b2ff82c8420
- SSDEEP 1536:ptqRHMyL+Kwsu0A7uRbNSEqZ6J1VyowwuGIOH2V2UoSyB/CjA+vsh2us:pJhjA+vshBs
- TLSH T1DFA3F4252FF81186B2B7AA47DEF3052396737D129939DD4D2282D30D00B2A0DD96D7AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514005411_002_dotnet_host_7.0.16_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514005411_002_dotnet_host_7.0.16_win_x64.msi.log
- Size 109KB
- SHA256 e58fbf9c32d4fab6d6b1fb13659c9840d9a924239a3f84ea69f34ca3ae5e47f0
- MD5 b93ca8f7a4026fabe5f68fb5a53077eb
- SHA1 2b2efa5d1a3f7b046869bb12eb8416eb1cf2a31c
- SHA512 5b8bc8826b70321552f8acf8f6c6952687eeacedb370095ee0b21e8aa3f61a574101be67c54ccf95e771ba1e5d677c38860dc88bbe6e4bc59f4f64f6c9e17cba
- SSDEEP 1536:yDT3vwHmjvx00ne7O/gPESix9JqSFrD7x21eKvkm4Y0O6jTPmSaJjH3jcLq39:yXbjTPmSaJjH3jcL09
- TLSH T1FAB313156FF80296B2F3AA07DEF305178673791A5A38D84D6182D30D04B2909DE7DBAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514005411_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514005411_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log
- Size 852KB
- SHA256 27db72b16e8698abe85b09b092a4e62cdedd0e758bf50ad67431e61ae5e0ec35
- MD5 9adc740723bebd72f1904b1f5cdc140a
- SHA1 589e4c19eb5d5d5ede3224f0e18c424cb9bc2485
- SHA512 0c555abc23efa4d470b3c7fcf4c44454ff26d9fd4023a8e335f018fd0b4125e1dc3076f46b7741a33eca32b1c9100d849d9d6ea800d82bff4a4c09ba928932c1
- SSDEEP 3072:oZF1jKtb7WmkQpgIyu2dU7AkwP7luxKFyTrKT++EmvmU9IXJ90UV7fJ/Oi2vE22q:GjeGF
- TLSH T10C051724AFF80766B3F75F46EEF344169436B825AC38C95C1156834D08B2E09DC6AB6F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514005433.log
- Size 15KB
- SHA256 3e8b5049b62dd7673c94d5d09e2179593b3d667a5a0ed3d84ffae2f9ee511509
- MD5 c3690ac75e9dfb2f35da568d8d3ca3fe
- SHA1 17cf1abfe657c51fc4d52874c5b6aad60cb94681
- SHA512 280d5411242b14c2de606d470886fdfcdee84c2646e75638cf08f30b17e2d2bdb43a5522275cadacc13f26c2f8f2dc26526bcc6c4cfe627f7a687ee9d7015193
- SSDEEP 384:pHgcVSglgigEgxgNgFNgAjNgA4VHnL+H9mElRVFVR9IVxQ1/LXTgQgdgUgdQgA5M:pXCLjL689F7rqKbEXEB
- TLSH T1BE72238A2EF8E1D61DF4729AD32A5FE85F23710B0F1015F439A1062ECC93854E7AD5C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514005433_000_dotnet_runtime_8.0.15_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514005433_000_dotnet_runtime_8.0.15_win_x64.msi.log
- Size 470KB
- SHA256 3afe756a54e52229496bffacc38a4f911e7f338e29a400df83e6f40180fdde77
- MD5 8562fe09ee12e0c49be4bc604c419d7f
- SHA1 6038a2e8f9318edf7558e0b86e7cf5cdfa4f0aa5
- SHA512 1faa5de27cd320144f261c4ef07b96d10ce379bf449cf8819ea658e12374ff4f408549993356335eacde8bb4318295d52ca5aedfb14c48dffc628e4280dcff3a
- SSDEEP 3072:IWZIGv64oVF7sIkQqsidf5TFYXjDKPJ26FVuIMAHeePL8UTverQGFGlf5OwIoU7w:WjQHEs
- TLSH T1E8A45915ABF80256B3B38E47EEF344179572BC32AC38C91C5192935E0472E05ED6BB6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514005433_001_dotnet_hostfxr_8.0.15_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514005433_001_dotnet_hostfxr_8.0.15_win_x64.msi.log
- Size 95KB
- SHA256 e146a5bbe7c35b925862305b5a024e47543897281d505428ce820314426b4c12
- MD5 e7c1e4356f83786827344f160a0dbbd0
- SHA1 b33ce1f2c120e6a8c8cbb0013969a42b42d9bbc7
- SHA512 f222938fe5345e856c3ee856cd8be00d7753796ec9c519cae05180186a63b0ea20fff340872db66de8dc7e4263f977bada83a31a2c7d6a3ae7c194351abcecef
- SSDEEP 1536:CPQiwNYC2tu3kC7eqgfbo8LOumpBi0zZOppp20McaiU672ZE0o0aUadT0a02Lrdd:CPQiwNYC5tr9cT0a02LYjtIZK1nnsbEC
- TLSH T100A336192FF90056B2B79A47DEF304279673BA935938CD4D2282A31D00B2D05D96DBEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514005433_002_dotnet_host_8.0.15_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514005433_002_dotnet_host_8.0.15_win_x64.msi.log
- Size 109KB
- SHA256 269a08b9e0180267fbf3097e45b9719c3350061be94ca87a5ff483a61a908252
- MD5 842ebca4d8ee2f35f216666527a21faa
- SHA1 a2a79096a4aae114101f1d24179a83aa13bcc19d
- SHA512 5f40f921e694e67a17d7e7559172269b40cc40b2438fd24fe6c3cef109b01bcce1e0f0195ad53a88ecb299c7c81833f8090b0521f57e392fdcad59a6a10c3518
- SSDEEP 3072:5A0/TiAKoAkQkZ5IX+jYsZt0nbYgbCSFlgqyK24:1jq
- TLSH T1C8B316196BF80095B2BB9A47DEF70417D573BD929939C81D3283930D00B2909D92EBEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514005433_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514005433_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log
- Size 849KB
- SHA256 a9599998f5b263bf0d743c70df696a1db27b299202765fe58beb584918389d5a
- MD5 476ca22ff425bd2b7e95c1c1a5b868e5
- SHA1 ca4ab4865bb368edcf0796f0ec2cbe8f246c4dd2
- SHA512 fc5a0b19b36e2136b002100d6acfa654930e32de6a82fe3e80b8c34ab68e6c4448aab58e65e47107599241985dc16eace141076359da919e453aa217610361a7
- SSDEEP 3072:scgreXkunFfUiqjoPVX2YdJ1QuYr682Eb7WjsDcCfgFIHlD+tG9BRhD9hLDKodw0:ljqp
- TLSH T185050514ABF80655B3B38F07EEF34417A436BD26AD38C91C1156934D08B2E46D87AB6F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\aria-debug-3884.log
- Size 470B
- SHA256 218a455a24d342267c38cb8cabb629b5ec7f8968f0fd63debe6795ab4355493c
- MD5 c95925823504a3d942d1bf035dffaf80
- SHA1 d8a6de91ed825eed90d2a8d42d8e6f3ffa1b2afc
- SHA512 13e520d0065b0f8d3bf31f2e70d2832928cea1e7b10c3dd9b586b50c8f404e5d3c9afb3b21bc36c1b6af8523d56833495ced1417d5a18e7effd7eb9178cf80dd
- TLSH T129F09E8A1A675C63D20B33B3B4938AD329D4E67FB2D00704851D43281047388A247C84
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\aria-debug-4352.log
- Size 72B
- SHA256 d3bd9c1bf13fd46db728452f6ea09a3fec9b3bb5ba7bb2eac98e9de6e3caf732
- MD5 c671109feb7efbbfc7faef6b5202fbb7
- SHA1 cac2370848cf59952fdf459e1143e6fac2eb3bbd
- SHA512 8b31f7e2c113fc0ac812b7f9696db694f96ecb4cc117c9753b3778083f6697955a0a1a843199a832f5568b8cce94f005f9433a0131e7b3533278ba754d80f7f2
- TLSH T171A0220080CF8B0EC300C28300B0C00CC0FA0C0E2FC0E3088F02882CC302338BA8B200
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\be4e1726-608c-445a-8e77-6c7c9740a8ab.tmp
- Size 147KB
- SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
- MD5 9c670f04d98ab7404f16423f6ee6cdfa
- SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
- SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
- SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
- TLSH T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\browser.exe
- Size 344KB
- SHA256 eef5cb41b2c7fe11ce2a0b05de8c6ed583286a0bbc8c632aa073772dcad3efc6
- MD5 8eed221c03dada349c651260e2e61845
- SHA1 ede50e64f0afc854ce3b2f2edcc401c4a564fcb0
- SHA512 20cd5937df68a9992729be39945b8b29a02efc343592f710550a35d8bfefbd185aba3f5282282f4cc0637bfaf9f96235cd5c9e3ca5b231dfa30cadf23a1339fe
- SSDEEP 6144:pO8txB35TDQtK92ZefDm+Fd0Kdd/+CDbLwL6Qgg/wAG/kaRC0y8BAJL0y5f6O:TtiefWKdd/+CPLE6Jg4AQRzy8BG6O
- TLSH T15E7412A721BCA0D1F45D2CB62419C32A26454C5602331B58F7DBBAE1CE7B58BF6132F6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\cv_debug.log
- Size 353B
- SHA256 1fded2e2ec5f37240331be6530225780c354eb6bef1eebbf49324c35a9e03ca6
- MD5 c5de330ce13e026cca4e2b5b002350c7
- SHA1 960e5a341c0bb86f236d2f795f87cc9d9edf4f4b
- SHA512 9705e50688c066f10e9326fd5496b6858f4f96d9b82a8da9c97cad6e58ac5e372327d8b18f068126a821df72ec316f2954d5c834adaa8a8cb2b4c30dc7fc3d34
- TLSH T17FE06FA238A2222FBBC643C480280C80A872E294036F230C9C0240B0AE9C9B1E70E388
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
- Size 1KB
- SHA256 6eb4ed9b4e6fe0ae74024e8bdb5db6356b5d4999f40d62eff6549c802ca60301
- MD5 31c630f8d44db97a34f29dce2beaf87b
- SHA1 5b5f73f0497f5efd2215238cb48fe2af2ce5c74e
- SHA512 0e19561f86539a6a7db6d629600072c254b3ed09f8f28ff1da72d158c3d471223c87080df8e45fc99f3502b4abee4f21adaf51dec42a281ca06025429b8ccb5d
- TLSH T153216E8E80DED0B124D161C1C71EBED3A9FB404A72E980B2BDE4658C240715DBAA54CA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\dd_vcredistMSI73F7.txt
- Size 427KB
- SHA256 5c20956c34e5519b7857bcbb59265e345575bf932e5bbb751a853d2c53c679ed
- MD5 02cb5bb921b45db0419323fd1cf2411d
- SHA1 11d6836c8dc2804b566d1db3e9a9098449184938
- SHA512 13075e476ea01b94852cbe63b0623956261d6f24a0213d84bad56cda2414db01bf2f25b6abf08e03daa31ff5b2d752d5e4fc90ba3920bfce13017a7e15d51ea9
- SSDEEP 1536:u5mKNmPY+C1NkUhvinkre0H9oVKcqjvXF2GYDK/0PcQn3kGSxRd1JeKtDLTpshbS:u5cojLtpblUrHo3F
- TLSH T127946A286FF50215B2B2DF47D9F34523A833BD95ED35D91C2281830D06A2E06D97AB6F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\dd_vcredistMSI7414.txt
- Size 415KB
- SHA256 997599ee06e2c269e659b884c9b8e192428686efb4e334dacd0e3762ce5b5398
- MD5 47a22bf8b81fb83ec697fd0948a8cb55
- SHA1 fc0595c90e2cbe9926673cc3dcf347f08a7b67e0
- SHA512 a7fe33aa86e270926237371cdd9da5a389ac3b32e4515c106a066c52d3a50080446faf90d8487f7bfb94373f14cc5e6169636ef2ead1e2a1068c7ceb620bc6be
- SSDEEP 1536:8nKMhKsN3ZTHUcs1w3UXDD2n6a9xrc3/r7EFjRvxzoUAUDDgaeF1pHpAMfhpx7aq:8nKMhtjLfUhWAkJVQeHwx1Bmo4ob
- TLSH T1249450296EF90255B1B7DB47DAF304139833BD66E935C90C22D2830D05A2F06E569FAF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\dd_vcredistUI73F7.txt
- Size 11KB
- SHA256 5c26387de7c5c83a1451ff7a6db422bbf0ba8f1ccae6e963f500b7ee3b7cd084
- MD5 afcf90cd8ccea31b31d5fc710a3be672
- SHA1 fa4a186ab6b72420797602c765f7a5e76c36510e
- SHA512 91587dc7c070d1e2591ee097f469e9d91b4c11208dc1e3d9589dfd79478988c7d9dbcba4093ec1c4e84074644fef340e7aaeea92d4711c47849512d1f0bcad06
- SSDEEP 192:z61ZFixwoPJnxnzbnxnTMWnnxnehux8nhTL8Vf:z61ZFixwoPJxHxTMWnxvqOVf
- TLSH T1E332AD19B7E44486B9F6DB4FE8F25113EFB6B840697CD50E02F7234A04A6909F4A532F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\dd_vcredistUI7414.txt
- Size 11KB
- SHA256 86fda0d93b872ba31811e8f667d33873f0410ad3da90ee7fe638a3f970fd7dab
- MD5 377483deaabb538c518d1fa83789aed8
- SHA1 1e1e81b9f8b313243cf6a4b7dc87d37114dcbd9b
- SHA512 902316dea97d9c9901e484191393309cce26d3749d062b17fde25b7e564cd72a6246b53c76f603e4e4f66d9ced1df05fcd5b8f014ec34e436c95d3a11d0bfb14
- SSDEEP 192:GR/IVEDeY1jnrnjRnrnxMM9n5nQDET8lhB58/v:GR/IVEDeY1jrNrxMM951ww/v
- TLSH T12032511EB7E44586B8F6DB4EDCF25013EFB6FA806578C50E01F6274A08A6901F4A536F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\jawshtml.html
- Size 13B
- SHA256 7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73
- MD5 b2a4bc176e9f29b0c439ef9a53a62a1a
- SHA1 1ae520cbbf7e14af867232784194366b3d1c3f34
- SHA512 e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\jusched.log
- Size 163KB
- SHA256 b65a8c8ddaa7182ec74e8e99c97362c799244d6a00bbc297de88036c74715c57
- MD5 d38c6fa9bc9ca6822f43c27f6704fda9
- SHA1 c98dc03a6f874dd87110aaeb902c3cd6a492545c
- SHA512 745464e0fd4e51d238df4751dd7ba490e0e6bd8df958a874c5c60a5d50b1d1bad26a82a6c945b1f944ac5622a7c4aa82e2ff8c97b8c49852074e3192f058e5a3
- SSDEEP 3072:zUkpXiHqUDsusNcBKQl/yrqkzJ7kkmq+ygeORpQKJJQR:r4Jw
- TLSH T1EAF35486846E48FA38734BD7E3695D6486B3150F539F091C71DFC2AEA046C07C66E8EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\mapping.csv
- Size 120KB
- SHA256 2684d360ec473113d922a2738c5c6f6702975e6ac7ee4023258a12ed26c9fefe
- MD5 d3186aada63877a1fe1c2ed4b2e2b77d
- SHA1 f66d9307be6cbbb22941c724d2cf6954b41d7bb0
- SHA512 c94e8aa368a44f1df9f0318ca266f5a6a9140945d55a579dee2fd10aff3d4704a72a216718b35e44429012d68c2bb30a92d5179fbc9fb4b222456a017d8981c0
- SSDEEP 768:oauu63GP/3Go+73GEVF3GL2QkUQ1HqfEe0/+dg5iwFeCo6QOATLJ1R4pbfyQw+t0:gu63GP/3Go+73GEVF3GGUn
- TLSH T11DC35121D2F6619CF5F3AF941AB41AA91E73FC16AD2DED9C0250620D0466E61DE31F33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\msedge_installer.log
- Size 3KB
- SHA256 ccd1d304d97c36db3d583ea707fb23069ed2c6b0cdf31a1a129abd894565c667
- MD5 904dbbe43c8a7bcbc6c46b7e4de032c8
- SHA1 12b145e9915841a4dc62ce3a402defb9ab024e06
- SHA512 5012764d842068e7e9a70cc3ed6e48a81884a546f0f644cd18324753bf31d80a7da40527e53769d874c65fa1f590b6413f281a6afc46887213beee95d3de0166
- TLSH T1DE61B391131AB77B6FD692F3105A376D87BB0584C181352878FC6024B6C2AB1853FEAF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\offline
- Size 24KB
- SHA256 bc6d53facfa1dab15d76fcd600be9153915a249243569d549751eb55aeacf5ae
- MD5 be66e9125fdd835784e63fdecc33ad4b
- SHA1 dacb7b37e340c40bf06c6db7f976a8d8df6137d0
- SHA512 093a8405242d905fb034c61d4dcfbf4d589582310d5707ddb4a22b254877feccb1504877d6d369629214863d5f066dc39728c3789af9a1eaeecb0fa6034701fa
- SSDEEP 48:TIO8VFDYM2tKrlSogMPqq8/aK3UIrE9/S6Fr:UjVG9m9gMi5/aYE/S6Fr
- TLSH T109B2854237F00168D496C5B6C0FB9F5A67BAC554516203DED9F591639CC0187A82E4FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\offline-shm
- Size 32KB
- SHA256 15c82a37d36c2e011becdb2e4259ba0df592b2712454ca19c027471f5044c9b4
- MD5 425fdf4c2fc284744e30ff4692d278ce
- SHA1 903e8e17163a6f0d0d9a9430b4505c9fa8bfce3e
- SHA512 82f32f9a614a2957e30e8328b35e0f2041b59650a385b07da0bf8853348a6519f8cd65837ccfc06d21372a83bdbb14454907f26c1b58979f16f4bfbf115317ab
- SSDEEP 3:Gr/hPFkb7ffphO/hPFkb7ffp5X8Ra9//Vlqll2lUlZll:GE3phb3p5M89XVzUl
- TLSH T150E20228D2A49CAFDA4409365E17429C5522EC07479383173E48F61915337D80E80A91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\offline-wal
- Size 16KB
- SHA256 6d6fac77b2e6ca4e2f7fa19f14534187861fb05c3ff7507eae21ecf96651a0a9
- MD5 d8640cf8b73a8f3b2d58b477ef4260d0
- SHA1 8dc57d98ea03d2f1cff1a4738b088c147ad9d42f
- SHA512 894ff61676e3d672a3a6f6430603732ad51b45e74d8f9f64afd564f247887ebc6008aa62e3e536fa4966c29d918988fbb423bd5c8d01b3692aa5520fcd9438f7
- SSDEEP 96:KjVGZclSw9gMi5/aYE/S6FrFLw9gMi5/aYE/S6FrN:K4/wO5/aNS2wO5/aNSk
- TLSH T10A72C84637F102ADE496C4B7C0FF9F5A66BAC554516203CED5F5D1239CC0147A83E8AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\offline.session64
- Size 64KB
- SHA256 397685ac2261f9bbf9797a0bc82df6bb8da5a7101b2ff0c1fea195dfdf161b14
- MD5 37fe3a91cfbb80cb2f99eccc05798c77
- SHA1 4857d12082b14bec2f30949d00da75e8d5a2ea3d
- SHA512 14cf78d545295f48d59ced465ce40e12fede7e1013c1bdce024b9d3f85ed76d02074a3a4e5993839fa2104c6dd82818c1fc04a791e890df6ece255d5883c7738
- SSDEEP 6:ujmt/B5gHt/T//3Z+QDgs/t/T//l0pUtn:r1B5gN/9Dj1/WpUtn
- TLSH T1E95322833900C4B0C5C2CE38059B112C97305E803E3E3226294973084AFB6210554232
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\wctBBCE.tmp
- Size 40.2MB
- SHA256 e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9
- MD5 fb4aa59c92c9b3263eb07e07b91568b5
- SHA1 6071a3e3c4338b90d892a8416b6a92fbfe25bb67
- SHA512 60aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace
- SSDEEP 786432:YMwQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59w:YpQcWxDMPnN+dk65gGUjku4vNjLjw
- TLSH T170972212ABD88075F2B79270697A63B5867ABD703F36C5CF62843A5E1B30DC19931723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\wctF675.tmp
- Size 63KB
- SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
- MD5 e516a60bc980095e8d156b1a99ab5eee
- SHA1 238e243ffc12d4e012fd020c9822703109b987f6
- SHA512 9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58
- SSDEEP 384:poaSLGTSy3S0XuMU9mCzHS7vpvpJGV6Hu/i49Pji7iJI5TZCP56vS1xDR+dBUFvT:WryF7U9mCzHS7vu/xV2iP56vcDR+P0T
- TLSH T18A53DD9E2108B66FE215AD5A7EABA9861C31746E3842CFCDF1CDC26C5F40DC4334A5A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\wmsetup.log
- Size 697B
- SHA256 3d091ed9eb6125218c01e467e45c6b3333e155082bb84510bb3882f612cbe9e7
- MD5 c46192dd76aaf6b95bd313e2e74122d4
- SHA1 2606d88bdbce3a50c5cb51e25125f875685d8d3a
- SHA512 4ae3a59cc2f58c5bd6e194cf7b6263c3e077a69fc99504b1665db8d199155301e72e6f48629d247409e1333d37862f9327ae5a0043291a1daffe46449135a506
- TLSH T1A9014C971B4DD87089D41B972EDCCE25737BC3CF8390E066B348D025440662D673E05D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\~DF615D05C77522DFAA.TMP
- Size 16KB
- SHA256 205d000aa762f3a96ac3ad4b25d791b5f7fc8efb9056b78f299f671a02b9fd21
- MD5 679672a5004e0af50529f33db5469699
- SHA1 427a4ec3281c9c4faeb47a22ffbe7ca3e928afb0
- SHA512 f8615c5e5cf768a94e06961c7c8bef99beb43e004a882a4e384f5dd56e047ca59b963a59971f78dcf4c35d1bb92d3a9bc7055bfa3a0d597635de1a9ce06a3476
- SSDEEP 3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
- TLSH T19B7202427234D665D54809368D41D5CC9776BD00DE14D14375DA775F0A314E04454652
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\HowToRestoreFiles.txt
- Size 1KB
- SHA256 089a7d2576d6b24cd92f5e20be0bb1cb05c6e1a98fc455d9ed2aae4ca1bbb6fe
- MD5 dcab48c49100a8239d8920b9ef9d442c
- SHA1 cbed8c2cc4bd212494c2ee6495985245b750ff18
- SHA512 4a14c8ac7fdae99f0fc8b52e19932e73a059e2e68902ddd094aadb4e92561a859624a4a53ceba4cecfccf74202ea0092b8ac4f8edcd796eed5e9ac3e061fd46b
- TLSH T14331C62973F65505F2F2AF196E7165604A3E3E92AD3DD35C02A0104E08F6F95E8B0B67
- MD5 SHA1 SHA512 TLSH