Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
26/05/2026, 18:10
Behavioral task
behavioral1
Sample
file.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win11-20260513-en
windows11-21h2-x64
24 signatures
150 seconds
General
- Target file.exe
- Size 344KB
- Sample260526-wsdajsax21
- SHA256 eef5cb41b2c7fe11ce2a0b05de8c6ed583286a0bbc8c632aa073772dcad3efc6
- MD5 8eed221c03dada349c651260e2e61845
- SHA1 ede50e64f0afc854ce3b2f2edcc401c4a564fcb0
- SHA512 20cd5937df68a9992729be39945b8b29a02efc343592f710550a35d8bfefbd185aba3f5282282f4cc0637bfaf9f96235cd5c9e3ca5b231dfa30cadf23a1339fe
- SSDEEP 6144:pO8txB35TDQtK92ZefDm+Fd0Kdd/+CDbLwL6Qgg/wAG/kaRC0y8BAJL0y5f6O:TtiefWKdd/+CPLE6Jg4AQRzy8BG6O
- TLSH T15E7412A721BCA0D1F45D2CB62419C32A26454C5602331B58F7DBBAE1CE7B58BF6132F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Clears Windows event logs 1 TTPs 3 IoCs
pid Process 1052 wevtutil.exe 1936 wevtutil.exe 884 wevtutil.exe - Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 7820 bcdedit.exe 7812 bcdedit.exe - Renames multiple (478) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 7828 wbadmin.exe -
pid Process 7836 wbadmin.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer_Service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" browser.exe - Executes dropped EXE 2 IoCs
pid Process 1288 browser.exe 4124 browser.exe - Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command file.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\exefile\shell\open\command file.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\exefile\shell\open file.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" file.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\exefile\shell\open\command browser.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" file.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\exefile\shell file.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" browser.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\browser.exe = "notepad.exe \"C:\\temp\\HowToRestoreFiles.txt\"" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\browser = "\"C:\\Users\\Admin\\AppData\\Local\\{E4343229-119A-C66F-D851-4262261C6478}\\browser.exe\" " file.exe - Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2340 powercfg.exe 1908 powercfg.exe 1464 powercfg.exe 4964 powercfg.exe 2416 powercfg.exe 1368 powercfg.exe 1816 powercfg.exe 2336 powercfg.exe -
resource yara_rule behavioral2/memory/428-0-0x0000000000300000-0x00000000003EC000-memory.dmp upx behavioral2/files/0x001900000002b3c5-46.dat upx behavioral2/memory/1288-47-0x0000000000E30000-0x0000000000F1C000-memory.dmp upx behavioral2/memory/4124-96-0x0000000000E30000-0x0000000000F1C000-memory.dmp upx behavioral2/memory/428-121-0x0000000000300000-0x00000000003EC000-memory.dmp upx behavioral2/memory/1288-1097-0x0000000000E30000-0x0000000000F1C000-memory.dmp upx behavioral2/memory/4124-1118-0x0000000000E30000-0x0000000000F1C000-memory.dmp upx behavioral2/memory/428-1132-0x0000000000300000-0x00000000003EC000-memory.dmp upx behavioral2/memory/1288-1133-0x0000000000E30000-0x0000000000F1C000-memory.dmp upx behavioral2/memory/1288-1135-0x0000000000E30000-0x0000000000F1C000-memory.dmp upx behavioral2/memory/1288-1139-0x0000000000E30000-0x0000000000F1C000-memory.dmp upx behavioral2/memory/1288-1141-0x0000000000E30000-0x0000000000F1C000-memory.dmp upx behavioral2/memory/1288-1147-0x0000000000E30000-0x0000000000F1C000-memory.dmp upx behavioral2/memory/1288-1166-0x0000000000E30000-0x0000000000F1C000-memory.dmp upx -
pid Process 3828 powershell.exe 2160 powershell.exe 2736 powershell.exe 1336 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language browser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fsutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wevtutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language browser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wevtutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wevtutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fsutil.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2440 PING.EXE 3540 cmd.exe 928 PING.EXE 4528 cmd.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe - Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\exefile\shell\open\command browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\p2kfile browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\p2kfile\shell\open\command browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" file.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" file.exe Key created \REGISTRY\MACHINE\Software\Classes\.74et2_p2k browser.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\exefile file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" browser.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" browser.exe Key created \REGISTRY\MACHINE\Software\Classes\p2kfile\shell\open\command browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\p2kfile\shell browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\p2kfile\shell\open browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\p2kfile\shell\open\command\ = "notepad.exe \"C:\\temp\\HowToRestoreFiles.txt\"" browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.74et2_p2k\ = "p2kfile" browser.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command file.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\exefile\shell file.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\exefile\shell\open file.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command browser.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\exefile\shell\open\command file.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 6204 notepad.exe - Runs ping.exe 1 TTPs 2 IoCs
pid Process 928 PING.EXE 2440 PING.EXE - Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 1288 browser.exe 1288 browser.exe 1288 browser.exe 1288 browser.exe 3828 powershell.exe 3828 powershell.exe 1288 browser.exe 1288 browser.exe 1288 browser.exe 1288 browser.exe 1288 browser.exe 1288 browser.exe 1288 browser.exe 1288 browser.exe 1288 browser.exe 1288 browser.exe 1288 browser.exe 1288 browser.exe 1288 browser.exe 1288 browser.exe 1288 browser.exe 1288 browser.exe 2736 powershell.exe 2736 powershell.exe 1336 powershell.exe 2160 powershell.exe 2160 powershell.exe 2736 powershell.exe 1336 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 428 file.exe Token: SeSecurityPrivilege 428 file.exe Token: SeTakeOwnershipPrivilege 428 file.exe Token: SeLoadDriverPrivilege 428 file.exe Token: SeSystemProfilePrivilege 428 file.exe Token: SeSystemtimePrivilege 428 file.exe Token: SeProfSingleProcessPrivilege 428 file.exe Token: SeIncBasePriorityPrivilege 428 file.exe Token: SeCreatePagefilePrivilege 428 file.exe Token: SeBackupPrivilege 428 file.exe Token: SeRestorePrivilege 428 file.exe Token: SeShutdownPrivilege 428 file.exe Token: SeDebugPrivilege 428 file.exe Token: SeSystemEnvironmentPrivilege 428 file.exe Token: SeChangeNotifyPrivilege 428 file.exe Token: SeRemoteShutdownPrivilege 428 file.exe Token: SeUndockPrivilege 428 file.exe Token: SeManageVolumePrivilege 428 file.exe Token: SeImpersonatePrivilege 428 file.exe Token: SeCreateGlobalPrivilege 428 file.exe Token: 33 428 file.exe Token: 34 428 file.exe Token: 35 428 file.exe Token: 36 428 file.exe Token: SeIncreaseQuotaPrivilege 1288 browser.exe Token: SeSecurityPrivilege 1288 browser.exe Token: SeTakeOwnershipPrivilege 1288 browser.exe Token: SeLoadDriverPrivilege 1288 browser.exe Token: SeSystemProfilePrivilege 1288 browser.exe Token: SeSystemtimePrivilege 1288 browser.exe Token: SeProfSingleProcessPrivilege 1288 browser.exe Token: SeIncBasePriorityPrivilege 1288 browser.exe Token: SeCreatePagefilePrivilege 1288 browser.exe Token: SeBackupPrivilege 1288 browser.exe Token: SeRestorePrivilege 1288 browser.exe Token: SeShutdownPrivilege 1288 browser.exe Token: SeDebugPrivilege 1288 browser.exe Token: SeSystemEnvironmentPrivilege 1288 browser.exe Token: SeChangeNotifyPrivilege 1288 browser.exe Token: SeRemoteShutdownPrivilege 1288 browser.exe Token: SeUndockPrivilege 1288 browser.exe Token: SeManageVolumePrivilege 1288 browser.exe Token: SeImpersonatePrivilege 1288 browser.exe Token: SeCreateGlobalPrivilege 1288 browser.exe Token: 33 1288 browser.exe Token: 34 1288 browser.exe Token: 35 1288 browser.exe Token: 36 1288 browser.exe Token: SeDebugPrivilege 3828 powershell.exe Token: SeIncreaseQuotaPrivilege 4124 browser.exe Token: SeSecurityPrivilege 4124 browser.exe Token: SeTakeOwnershipPrivilege 4124 browser.exe Token: SeLoadDriverPrivilege 4124 browser.exe Token: SeSystemProfilePrivilege 4124 browser.exe Token: SeSystemtimePrivilege 4124 browser.exe Token: SeProfSingleProcessPrivilege 4124 browser.exe Token: SeIncBasePriorityPrivilege 4124 browser.exe Token: SeCreatePagefilePrivilege 4124 browser.exe Token: SeBackupPrivilege 4124 browser.exe Token: SeRestorePrivilege 4124 browser.exe Token: SeShutdownPrivilege 4124 browser.exe Token: SeDebugPrivilege 4124 browser.exe Token: SeSystemEnvironmentPrivilege 4124 browser.exe Token: SeChangeNotifyPrivilege 4124 browser.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 428 wrote to memory of 1288 428 file.exe 80 PID 1288 wrote to memory of 4124 1288 browser.exe 81 PID 1288 wrote to memory of 3828 1288 browser.exe 82 PID 1288 wrote to memory of 1464 1288 browser.exe 89 PID 1288 wrote to memory of 1908 1288 browser.exe 90 PID 1288 wrote to memory of 4964 1288 browser.exe 91 PID 1288 wrote to memory of 2416 1288 browser.exe 92 PID 1288 wrote to memory of 1368 1288 browser.exe 93 PID 1288 wrote to memory of 1816 1288 browser.exe 94 PID 1288 wrote to memory of 2336 1288 browser.exe 95 PID 1288 wrote to memory of 2340 1288 browser.exe 96 PID 1288 wrote to memory of 1336 1288 browser.exe 97 PID 1288 wrote to memory of 2736 1288 browser.exe 98 PID 1288 wrote to memory of 2160 1288 browser.exe 99 PID 1288 wrote to memory of 7812 1288 browser.exe 111 PID 1288 wrote to memory of 7820 1288 browser.exe 112 PID 1288 wrote to memory of 7828 1288 browser.exe 113 PID 1288 wrote to memory of 7836 1288 browser.exe 114 PID 428 wrote to memory of 3540 428 file.exe 123 PID 3540 wrote to memory of 928 3540 cmd.exe 125 PID 3540 wrote to memory of 3656 3540 cmd.exe 126 PID 1288 wrote to memory of 6204 1288 browser.exe 127 PID 1288 wrote to memory of 1936 1288 browser.exe 128 PID 1288 wrote to memory of 1052 1288 browser.exe 129 PID 1288 wrote to memory of 884 1288 browser.exe 130 PID 1288 wrote to memory of 4528 1288 browser.exe 131 PID 4528 wrote to memory of 2440 4528 cmd.exe 137 PID 4528 wrote to memory of 4216 4528 cmd.exe 139 - System policy modification 1 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection browser.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = " " browser.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer browser.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" browser.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System browser.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "All files have been encrypted due to security problems on your computer.\r\nIf you want to recover them, please visit our website:\r\nhttps://client.pay2key.pro/?user_id=a2hy-jEj-p-EQAFPPYuqoGp5LpZcDBSuX6fLQamL5mQ*74et2\r\n( http://23.137.254.233/?user_id=a2hy-jEj-p-EQAFPPYuqoGp5LpZcDBSuX6fLQamL5mQ*74et2 )\r\nBefore payment you will be able to send up to 3 test files for free decryption.\r\nAfter payment, the system will automatically issue a tool to fully recover all your files.\r\nYour unique ID: a2hy-jEj-p-EQAFPPYuqoGp5LpZcDBSuX6fLQamL5mQ*74et2\r\n* * *\r\nIf first address cannot be opened, visit our main site on the I2P network (similar to TOR):\r\nhttp://pay2keys7rgdzrhgzxyd7egpxc2pusdrkofmqfnwclts2rnjsrva.b32.i2p/?user_id=a2hy-jEj-p-EQAFPPYuqoGp5LpZcDBSuX6fLQamL5mQ*74et2\r\nSpecial browser for accessing I2P sites: https://github.com/PurpleI2P/i2pdbrowser/releases/tag/latest\r\n" browser.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\browser.exe"C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\browser.exe"2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1288 -
C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\browser.exe"C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\browser.exe" -e watch -pid 1288 -!3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4124
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-BitLockerVolume | Suspend-BitLocker"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3828
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -H off3⤵
- Power Settings
PID:1464
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 03⤵
- Power Settings
PID:1908
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 03⤵
- Power Settings
PID:4964
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 03⤵
- Power Settings
PID:2416
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 03⤵
- Power Settings
PID:1368
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 03⤵
- Power Settings
PID:1816
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 03⤵
- Power Settings
PID:2336
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c3⤵
- Power Settings
PID:2340
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1336
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2736
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2160
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:7812
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:7820
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP3⤵
- Deletes System State backups
PID:7828
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:7836
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe "C:\temp\HowToRestoreFiles.txt"3⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
PID:6204
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl security3⤵
- Clears Windows event logs
- System Location Discovery: System Language Discovery
PID:1936
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl system3⤵
- Clears Windows event logs
- System Location Discovery: System Language Discovery
PID:1052
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl application3⤵
- Clears Windows event logs
- System Location Discovery: System Language Discovery
PID:884
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /d /c "ping 127.2 -n 5 & fsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\browser.exe" & cd /d "C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}" & Del /f /q /a *.exe *.ini *.dll *.bat *.cmd *.db *.tmp & cd/ & rd /q /s "C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}""3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\PING.EXEping 127.2 -n 54⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2440
-
-
C:\Windows\SysWOW64\fsutil.exefsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\browser.exe"4⤵
- System Location Discovery: System Language Discovery
PID:4216
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /d /c "ping 127.2 -n 5 & fsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\Temp\file.exe" & cd /d "C:\Users\Admin\AppData\Local\Temp" & Del /f /q /a *.exe *.bat"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\PING.EXEping 127.2 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:928
-
-
C:\Windows\SysWOW64\fsutil.exefsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\Temp\file.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3656
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵PID:1376
-
C:\Windows\System32\BdeUISrv.exeC:\Windows\System32\BdeUISrv.exe -Embedding1⤵PID:1388
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:8124
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:8188
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:5344
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Defense Evasion
Indicator Removal
3Clear Windows Event Logs
1File Deletion
2Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 7f8f97ee615f534fb3a3d4ab1d554cd33b788f10c559754714d1e7ce0726b362
- MD5 a71e351e0584693771a3e1ab5ed855ee
- SHA1 5bbadb2db8240a293fce7bf6a965634703e51aa4
- SHA512 95148933c9fc727c3f88c9b5a0bd489f660bc0b24b3cb8b8e6e7ffbec937810d473cf57ff0c8a34075ce7f822f0c007be8893daa409738cd4782ab526bb5a185
- TLSH T18B71EE323375B0D4C9663F07192C1AC463BF4396EA58AF4CB658521ED92710BDB222F7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 e0c73a934be02e85d770d569421fd51c86828433fef99efa6b2b852d9b97805b
- MD5 e4a3678a1f2d7254a5b1709697cd99fb
- SHA1 582509305d3c0e5f2b0a26bfb8973b534da37ea6
- SHA512 bec8741086fb1fc5fd8a7f57d7a98a090b78f94a449fe1a792446c83125e00aa07ab6af6f76ebd32c60e65dcd0a74ec235e46c9552669cbd051428b72fe52ddb
- TLSH T1ED218933B79CC134C8D9117A108DAD01B1B5C7C7449ECE8B7B84C508A57F999DB645E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 b3ca4a62a1ca75013b20b5fbcb743ac3cec374da9e3a76ac5e6fc6755bcd3d04
- MD5 ec89bc6579761ec3f913e62be90c9ea1
- SHA1 41100c2a02fca84e109629c3b4d90ff661e9aacd
- SHA512 385491dd8e7714771502185c859541bf8b43b2d6e3872eb3c7ee6cd27f6f492ebaa5c9ff3f4369ed63a6efc76124d16b7c66791f6a8b4103b878c048a2e5976c
- TLSH T17321A933B3DCC565C8D9117A208DAD00B2B5C3CB449E8F8B7A84C629957F9DADF541A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 4a716b456c1dcaa175881d99d6dda17c1c8376dc99249140e1c0bd6b165a9532
- MD5 e059da15ee68cca31bf22fcff5754c19
- SHA1 40cba271bb3f2651cc9e15a78170561c8a655cbf
- SHA512 a36d6408298a62eddb45c0e978af9b1ea49f5e3680996ae99332fbe5d1030cdabbb827b47a881e3f5bc1c39b12e92008ae5996c48004afa63133620862915be4
- TLSH T1FE219D63B3DCC0A5C8D9157A548D5D007276C3CB449ECFCB2A44C228D97F6D9DF945A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_03bk1ypu.pq0.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\01b1af74-e4fa-460d-9092-a767eb6f7380.tmp
- Size 147KB
- SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
- MD5 9c670f04d98ab7404f16423f6ee6cdfa
- SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
- SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
- SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
- TLSH T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\0327be4e-40d5-47b2-afff-3592f0069359.tmp
- Size 10KB
- SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
- MD5 78e47dda17341bed7be45dccfd89ac87
- SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
- SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
- SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
- TLSH T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\AdobeSFX.log
- Size 1KB
- SHA256 e12550675d7e5d069bf81889cd70bdcfd9c1dc1b50f4caefee663422351735f5
- MD5 dbe0854a95f1f3944f68a699e1449d01
- SHA1 31cdb8ca7097d23e0681ec5d4b6957ecbb02ee7f
- SHA512 36d4a0dfe32949c66ec988766f1c9947f6fbc9382449afb966f8a38d11ba3a9b837076d1b7a7599b7389f66824a5cc516f1e785306eb348932f0316ab301db60
- TLSH T16641CB431AFF25E33E014085B3647FFFCE50FA172E2589E263898128B502EB47E4356A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\DefaultApps.xml
- Size 1KB
- SHA256 e512d5149170e01023f8489b1c0ef18cc6e8ac8c0dbae6df4ca9a843e283a215
- MD5 8c39e302e20e76adf2744c25220da36f
- SHA1 8d5ea7e2e2acd35dc98f3deecbbb4536e49700bf
- SHA512 17765955e7b7bb592bf0f81d705220f56e051ad0df1dc770df5e062ef4295ad79b196ab71554b37b7dc50e42ff2e0d14c25ee3053741cebbca07b607fb1aab35
- TLSH T16A318AE9FBC249F2A3576A627A41D2CC72A981AFC7EC5B04B043612E901B7BC4777057
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\DefaultAppsNew.xml
- Size 5KB
- SHA256 5c37cd8e574cd0cde1736c60a15c180fcd5779bfb167d5e90e32eef97ec45f83
- MD5 ae24bdea41713eec181ad5279d34df3c
- SHA1 b3ffabca4678ddeff198ab81cfa2dc6740a13817
- SHA512 a2c469f0def3214121043200d0f204e180302dde412f349d364bd82e3281aee6cf53f4814ce76ad82b0c1ff7c6532a5fb6c862a6243e556ad85aa48cebd68cdd
- SSDEEP 96:/oWlCloLulNl0aOKV7lKl2cclljlplClLlslolrlJOOqDCDGf3qM:/oWlCloLulNl0aZ7lKl2cclljlplClL6
- TLSH T154C126137BFD1A49F1F22B659A7A246A0D7BBC584A3AC22D10212E0C5C71F55CC62FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\JavaDeployReg.log
- Size 13KB
- SHA256 a2f2bbd3cc5a243f1649adb0241bef221b2b9075171894d62d0ccf61679d484d
- MD5 7dbc050f440fee3164c33df8c92fd824
- SHA1 8a662ab5039541ef5034a9a980db6ca307711e16
- SHA512 3ad0bb0eea3f7e05f6caa25a2df8d1727bd4e8b608e925bbf2cb7ea9cb87c219547ca1f0bd460fd204711d24f7651caecaff93dfa0f0d9fb35d58d6b7e57b9f7
- SSDEEP 384:W7QxYvPvrvxYvPvrHEwp8RVVVVVpU+f2+4:W7QxYvPvrvxYvPvrHEwp8RVVVVVU
- TLSH T16C5238C254B9E5FA78F640DAF7026EB0DAD5E14B918A086470E4DC68FA0AD4071F78F9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\MJNYKXSZ-20260514-0024.log
- Size 55KB
- SHA256 c876c27e4fa207f8a0495dfa9b57a075e2ce99f912373a38b4f259520bbd7d4c
- MD5 33fb4db28c94d333f37d2bb1414a7c93
- SHA1 2ea4fe57e62148c7ade5789bd98037b6ae55bfa4
- SHA512 fe92e9d6e446e207dd3d8dc878cd91b5b7ef144a0fc145cb68be05f81390500a1f7b89157da12695d27d8f28aa102264ce9feed6b4522560e83606e6da048b98
- SSDEEP 1536:4DmN0wRt+kMcEWUuz+sIM9IMznFRCBe9ubyBgpm1wHqSbUV4AIIS+VsMktZQHErS:MsFMWsfBe9u+b
- TLSH T14043162C6AF90646F2F3DB46ADF24066DB72BE576835DE4D60A10E0E0922D447C61F2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\MJNYKXSZ-20260514-0024a.log
- Size 181KB
- SHA256 9fd11b0e4ff718ce76156118e39c2c4726be60b92058e0624cd5920e8298e051
- MD5 605b89ebe44c2fa3027486c31cb6871e
- SHA1 892db0ac55483601f5290e7a1e07306def0861c2
- SHA512 2a6a9eaf064a2eb41b48a734b59c0935f979bc62f367770eadaa3de83f064394f669ac04f5c6ba462376313ee15f4907f547b1a873a73685f06c066cf8f3004c
- SSDEEP 1536:EqmE4NWMU4P0neMExDnEb+xp15OVftc9HxgEEH2EnpnpquylI5Qagu/EVmEYs/r2:pd3TpquylI5QagZ/s/6/Qv
- TLSH T15604782DAAF90656B2F2DA859AF24023D772BD676935CD5E40D20B0F0522D41BCA1F3F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft .NET Framework 4.7.2 Setup_20260514_002010506.html
- Size 93KB
- SHA256 7b59b4821b44cc4abdbd729ac7292db174c01980636af2b2deb3cde8a3527ad6
- MD5 3c7a0ba5f7ea10556b3f9ddfc33de162
- SHA1 7a0a193100b10d74c4e3121da6ac04b81979789d
- SHA512 40b1e1068383a0a0ca942a7fd6f6be78135671b1afe173c56777fe6dd2a41caffeef404cb9bc5ebb00f83de8a47e9a2ab4b73635bf4efa5ad42f7d58b3418d55
- SSDEEP 768:fdsOTLyUFJFEWUxFzvCT1IQYBWp4ZWbYS:fdsWyUr+WUxpvCT1IQ6S
- TLSH T11393B41377E80195A8F3BF4DEDB310260AB8BD855C34D92C13A54A5D0E95E24ECB2FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514002032.log
- Size 15KB
- SHA256 86a45053abbffb4cd51d416518aaca75e747859f7744cb7206156976d5de21e0
- MD5 01893044c28f68a735037ee7c0e83915
- SHA1 b33700a73b142937722c265564045f4a9c4678ee
- SHA512 26fe2f6251b2ac13ef962c46429261b43bf69c370469e034653c57b629f5347c256225514d8055062a5975c6005bb64cf00b6db3beebfd3866e0e31c7668b957
- SSDEEP 384:yC3iVi3b3y3G373B3+O3cuO3c4VBaGVGVbPVhh+o3U3a373jx3cZw3b3M3Ax3cx:yrLzuz6BaoobNPDC8Cx
- TLSH T1356225971EE493960C7076AAD3562BE4FF06F643064056F06EC3071E8B93D28E39BE65
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514002032_000_dotnet_runtime_6.0.27_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514002032_000_dotnet_runtime_6.0.27_win_x64.msi.log
- Size 551KB
- SHA256 56f6c0b68410e3e09933ba9ebcaf53fd1f4976f93a4149344527d29d10bf7d83
- MD5 944db3007e874da302bbc5163848241c
- SHA1 1a4555f271baea0203f066d8250d33102fc587bd
- SHA512 d54d092e262aab526f3a4ee71b794563a98f50ca425ad52fb817068cec8d3f9e6852c7c0ec4324a9fc66bbec020742bc28bd927d50c6dc98a62186c6ba63aaf7
- SSDEEP 3072:15OAjAvRSQ1EOCyJPGufciUXu/PIN1bLcsYE4PuMJtn7u+W7p9DiIFtv39scpLlH:ljicV1
- TLSH T1A9C42625AFF80266F2B38E47EEF344179476BD32AC38DD1C11D2835D0572A05E866B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514002032_001_dotnet_hostfxr_6.0.27_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514002032_001_dotnet_hostfxr_6.0.27_win_x64.msi.log
- Size 95KB
- SHA256 f3fe3cbc6d14e0034447ad79fc5f444754994f2a0a03e51fdaea07ab016857a7
- MD5 33dcf3f3cc338402ea1df950cf3735dc
- SHA1 7b7273f64f72e15e27784c64c94ec56b202119c4
- SHA512 f121def952918ba60cf16a9ff579bcf287d8f0abf0a69bda0bfab93c80dfc8718c2b5b62ecfe7eb8def09dd1b799dff534598e92492743f6afb6bf9c12f87bce
- SSDEEP 1536:f2aKvQ7C/zdKpnw7OzzdweNBtZSS17TrhJbBcuav0rb7gIZj52YyN3iJ:f9Fj52YyNyJ
- TLSH T1DBA317293FF40196F2B39A479EF344679573BD165A39D90D21C2830D01B1A08E96E7FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514002032_002_dotnet_host_6.0.27_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514002032_002_dotnet_host_6.0.27_win_x64.msi.log
- Size 105KB
- SHA256 465eae47cf06aca00c32dd43583cc8bcc653184bd9d5f167770d8ac92c4f596e
- MD5 3af3ed3d2791c925eb038750002b14ec
- SHA1 749ba29d1892a45f3cc639580b07b67966d01ed9
- SHA512 cec6be95f63fe207b0b587bff64a375cad80eb9f93b9c0e24cdd2971af1f00e5033e55fcad1431ec1f1c7c2d1267d05b1a5a4e536d66cebd0a65f1ae1eb06480
- SSDEEP 1536:Vc7hnNQtkYySm38rOzlBMathHJq8vB5h7gfO090uSyVhhjJ/jJ3JBTDkKU324:VqijJ/jJ3JBTDkKUm4
- TLSH T14EB3043A2FF40196F2F3DA479EF3441749737D969939DD0D22C1830E01A2A09EA697E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514002032_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514002032_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log
- Size 847KB
- SHA256 5019da6863b6f0a885ea45d6564adad220296ac39e06a888f739d0a2f68d8d7a
- MD5 724079bd392e7497404f6c62637d4297
- SHA1 2e78209afa75b47e421782bb03270506366c8eee
- SHA512 4c8a9f8f27831a2a3ab00af9ebe7a1c9a615f5795c7aa5f0df69935eb194cf590a9e8ac4110ad59743106ed6326aee6f3d83ca1021a5ab55930a7e19043bf07e
- SSDEEP 3072:EshhnjszIIlCMZRRIV92R4kZODjiqGCgCbcg8CaLOd4634s01y5p8m5pIxcXtu7J:NjVaDjBR
- TLSH T11A05E825ABF80665B3F38F47DAF384169436BD36AC38D50C1196834D09B2F09D876B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514002057.log
- Size 15KB
- SHA256 e7de3067ea6b83c139100b1faa4ac3aac7469ef9a4cd07f0549c5689779f23b5
- MD5 28f98ff4b29821db90774d384cd81790
- SHA1 6dcc2f6345c21cfa3d017e6031a1309f71908159
- SHA512 0eb39f062065dbf69dad1703b7c6815da9d6a158c322aa60c6d294c7e9c452afeb293deb6c36036266c45584d1e6e9177dafc0b32f18e3cbfc8bb8fb45444a04
- SSDEEP 384:1NaQV/apacaEaPazaTPa9ePa9aVO1jjVVVsCVVxhwa4aJauaF2a9nsakataq2a9p:1jN6e6sGjxrskLOR1Rp
- TLSH T12962FF423EED62821CB06576B33A2FF5CB17F34B160059F0BAD64A2FC651C19938EA75
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514002057_000_dotnet_runtime_7.0.16_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514002057_000_dotnet_runtime_7.0.16_win_x64.msi.log
- Size 470KB
- SHA256 b6b98bd5e531bb56eb3e7200ab9a6f6f78bb18a776510762da0fc2d89daefe77
- MD5 46a98d7d33c463529cc8c489f50f9ea8
- SHA1 4832b81cf509df2ec47b20d8faf30161482cf555
- SHA512 ba88c274df52587a51c9a5d1d01e18fd9f2dfea4dd8aad925fee8d568deff755589252459d549bab3173ebe57de874d25face87e9e72edd0ce41bf392e9a1375
- SSDEEP 3072:yCB/jklKVSBxHrUtlFnaKZqBQqpFu7rx90cn5KQGOnoK7d6UurioBfKNQ7qNUjiO:Hj/YV
- TLSH T1DCA46E39AFF80255B2B79E47DEF34417A472BC32AC39D91C2182434D0572E06E96E76B
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514002057_001_dotnet_hostfxr_7.0.16_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514002057_001_dotnet_hostfxr_7.0.16_win_x64.msi.log
- Size 95KB
- SHA256 4265267eee97759691b1ff4366019cd4e1acba482c04a4c51d6173d62786dcb8
- MD5 4bdc66f2ea4d1f546f381edad5087965
- SHA1 6beec0ae4ca3ce77fd6aa82d7bd4b4a5740bb233
- SHA512 7d15a9ac7d07f7b94d33d2dc073b1d2e0cfa39eefa9a459ca7ce97508537e8571c9bc7f623df7cd31c33cb9f2cd8ff52d57d5fa1cbbf06e29e62b22a33afbe63
- SSDEEP 1536:tbGrXisxYkWLlXPTmikuyc/J+phZ2kssKiEqLWhR0DuOyc7jZn3fxD+U:t+tjZn3fxiU
- TLSH T1CFA3F5293FF8019AF2B79A47DEF3082796737D125936D90E2182834D01B2905E66D7FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514002057_002_dotnet_host_7.0.16_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514002057_002_dotnet_host_7.0.16_win_x64.msi.log
- Size 109KB
- SHA256 64053e0a815c185d82cd113416f2c58c23a3ff9128e00abb4e4db2a48fe28cef
- MD5 4a48b821725dc98bb26af073ee18a0cb
- SHA1 5335fb18a95000bf3f2d89be9d881d4157d9d748
- SHA512 a6b1234109e603ffcb13d1704dd7f4f977f15816ccbeb6244311b177324e49104acb6cfc0e51caa4bb3769b4cfdd329987995fcdfa2b1a70363f1aaed6f717b3
- SSDEEP 1536:+6f1vuVIBNTjyHQLu1ethLDpupqJGUcc6lW2RwUEhBdXjjmwuya9qXm8A5C3Mh:+rIjmwuya9qXm8A5iMh
- TLSH T19FB326292FF90195F2B79A07DAF3082395337D125A39D81D21C2839D05F2A05EA6D7EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514002057_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514002057_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log
- Size 852KB
- SHA256 985c3d14087e35a6261f07829cd317f145476c5d7ace5771ff457c1b9cb65690
- MD5 6d28a3dfd1a65d9675d8c842f3c215e9
- SHA1 6b76639226107f7ce3fb012daf4eb8bcd59f6a37
- SHA512 c107abf6dd4bff85396ee086833ae31c68ac356bccdfa07df47565e22bf5d5c438ce644620f0fa63922af9dc87f609da7bef5186a6716484952164a4eebdb04a
- SSDEEP 3072:8qALFjddz31MQlrygJVl2/Qcw6VBvELwvYa6nGbr5qJQy7OR95QQLyuwGvfLbo6o:MjPxTf
- TLSH T1D305F525ABF80666B3B39F07EEF348179436BD22AC35D50C1155834E09B2E05D86AB7F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514002119.log
- Size 15KB
- SHA256 81688cb1595c32d0ee9f5d9221b2d12ad7b860a0b8b500e9619bb3232a6ad3ec
- MD5 bd9da5eecbd3a6608908982471429dc2
- SHA1 7b321594a85108e50f139c7671756d11d8dc17da
- SHA512 7af41f3bbf5b4396dd5a969f3b17c20bb5886c714f672c1c7497a972a674cc7df68f9926bf8b1a6a8bee5796da616c9ce0cad90b8e90e1b2b009a22dab031096
- SSDEEP 384:mBgeVOgFg2gAgRgdgpNgwvNgwIVMxebr9TR1gVuVt9IVdoudXmgbg8gtg2QgwjM0:m3CnvnqB92gvqtAUiUZ
- TLSH T12A7201462EECE1D21C74B267D37A1BF48F52735B071055F8B992022BCD93C68E38DA96
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514002119_000_dotnet_runtime_8.0.15_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514002119_000_dotnet_runtime_8.0.15_win_x64.msi.log
- Size 470KB
- SHA256 187c36d2d32e20d8b2ffd5033200790ab539ea03b72b071cc30a0727c1521d2b
- MD5 ed2865187a4f828c199361c233d67478
- SHA1 85e1a9c6542d65715ac50c6afb2880d6555ae42a
- SHA512 078e29cbc34373467edcc43920ddaa96baa32d43554e435566f7e79237be6db7ca81a72f03405bd97d5b8f651ca65f16eb9be04be67bbd4060f11f3674ea1b2a
- SSDEEP 3072:50aW9wpHjl3CV+9MASUaFXhrNAhjLO8+Dqqt2RFJuXXOSYe59e76c3GE2YnjbTPX:Rj4cJpB
- TLSH T17AA44B15AFF80216A2F39E57EFF384269476BC32AC39D51C2182835D0572E05E8667BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514002119_001_dotnet_hostfxr_8.0.15_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514002119_001_dotnet_hostfxr_8.0.15_win_x64.msi.log
- Size 95KB
- SHA256 c8cad94ebbe1531c16afed9d8d33739d67c27b42350aba81bcfb5e367e2a0a60
- MD5 b72537a2ac16ab35f22e22f70b587101
- SHA1 9819034c741a5fdf9ea8894398083e5125325d24
- SHA512 f380aec9aa7df4f12adeb0da7f0aebb8991aef5a86489036a4eab7693eaf539e9a9941f2212c8c36fef4921754db4dba4beceb080f3470e88ff6f89d36d3a064
- SSDEEP 1536:fhFpQFbmR6/Ivmse0Vp/3dgp1bFbXIrubmtVX9QZQZDbIiq6c0C852DOEi0nUnkX:fhFpQFbmR6/IvmseEw1UkrtH1rGpjiHh
- TLSH T141A3E22A2FF40115B2F3DA57DBF304265573B9A2A939D90D32C1D30D01B2906E969BEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514002119_002_dotnet_host_8.0.15_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514002119_002_dotnet_host_8.0.15_win_x64.msi.log
- Size 109KB
- SHA256 77b0df01eb97ed80827bdf87052b985f9f67660083af639f470dbca467557bd1
- MD5 e2b3fcc10e828f11447bcda9f9531dd8
- SHA1 e63c1c905598d3c9e5ad81fe900a65a8dc86df16
- SHA512 5f664f079ee47b4d3d8ede6ce908ae7226738768d2304d37c857fc2e8785e98b093ad44d2ab41dc16148db141cb282aeb9b00bc474e18d9a78face0bb9e4bda9
- SSDEEP 3072:6Aw+WXU2FRQEUJdcT9jOL47k6K4J0u5eFADER2k:6jOP
- TLSH T1AEB3F31E6EF81116B2F3DB879BF314264972BD6A5939D80C31C1D30D01B290AF9697EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514002119_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514002119_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log
- Size 849KB
- SHA256 ba5131a84a5075c1614523cdbecfeea07574ea45d04d0904bf4be92c176666d3
- MD5 d977037f88861d91633f1bacfad366d7
- SHA1 c7de33a66378f2a4cc5287adb1e675c84d762787
- SHA512 40d77b6c4c5c47e54776558d42f6f4f79d0931657e272e537a3ece62ed847c2aff99824b7994af5c2a18b9f435f40dac45b09e3b25f746e3a18dd639bf1f5621
- SSDEEP 3072:8hGX7ieUHfbHn0TwGA+3VQk4NfFyjBnpiSFj/Ds0nPFbAXrKZSpVlO0SWM093yHI:hjKwO
- TLSH T1C8051815ABF91625B3F38F07DEF344269437BC22AC38D51C2196C24D05B2E46D86A7AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\aria-debug-3612.log
- Size 470B
- SHA256 8d2d1cbed75be72a4f32646fecdc5d950ea5457661353b8c5b3cb6adfb6ef3b2
- MD5 75c18c161cf62820b7d03240b4b97e3c
- SHA1 61b3368cdd044b8376b7f86710bb316de1be84dc
- SHA512 0c97638ea5c80b7ff7e63c380d316d93b9dbcb65d5e63163b5cd5beb709d43b6f2cf362919c439d91b32da49132237bcde688f612ba2e46d72929bb10e08004d
- TLSH T1ABF09E8A0A6B5C63C24B32B3B4538AD328D8D67FB2D00750851D432820473886147C80
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\browser.exe
- Size 344KB
- SHA256 eef5cb41b2c7fe11ce2a0b05de8c6ed583286a0bbc8c632aa073772dcad3efc6
- MD5 8eed221c03dada349c651260e2e61845
- SHA1 ede50e64f0afc854ce3b2f2edcc401c4a564fcb0
- SHA512 20cd5937df68a9992729be39945b8b29a02efc343592f710550a35d8bfefbd185aba3f5282282f4cc0637bfaf9f96235cd5c9e3ca5b231dfa30cadf23a1339fe
- SSDEEP 6144:pO8txB35TDQtK92ZefDm+Fd0Kdd/+CDbLwL6Qgg/wAG/kaRC0y8BAJL0y5f6O:TtiefWKdd/+CPLE6Jg4AQRzy8BG6O
- TLSH T15E7412A721BCA0D1F45D2CB62419C32A26454C5602331B58F7DBBAE1CE7B58BF6132F6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\cv_debug.log
- Size 353B
- SHA256 8b78e3fc2dcd23b1b79ac8ee2911434a78be479d020c079bf44f5038a23e4770
- MD5 dc8587f0add4eef121ac624c67034189
- SHA1 4723367829f65978773d4c360ba7b0bfa765f51a
- SHA512 0ba2385c64cae91331e0fa69ceb6622f263209e71b5ff97f61d271349d66736cce14468c38aedd8366daa370054525c6f59b1909f4090d6c88f89aa7469a0fff
- TLSH T1A6E0D8A17621636F6A8A0FC860656CC46591F141431B0A4CDD16D038FE2CEB2671D7C4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
- Size 1KB
- SHA256 2687634b46dab5d86ea852b3c45d4adfe02dee46cfd4bea92389d34ddd73704c
- MD5 2c98c77d198ca979f76177ee134f4ded
- SHA1 b5482a66aeaf52190e227700638f468148620ae6
- SHA512 75449bd94e311e350a5e5f913c5ac83ea7dc7cff0cf2c6fc90de691d5c6b93ebbd79acc3944714755730132f3de94b7c964d87b9752083b3c1c8286f90677bfd
- TLSH T1052168DA10EAD8733CC0A180DA2FAED1D1F2804D3AC5D0FAFD94665E140306CFB965E2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\dd_vcredistMSI5AAE.txt
- Size 427KB
- SHA256 3208534f2f24008e8923aba4c07d3b9840a79237028d18d9010ff5c47bff89d9
- MD5 da1ce4fc13573c9671c0a80b05790473
- SHA1 9b7eb6654ffe10e84512c82d35dcb923a2cfba62
- SHA512 0d8dcfd43f91d05a204089afd418adc74d3563712c5438221dd1e82eb49a3cde69e8141733a12307c2b281d280002dae0d3392e40dc4d94ee87b1ee85646d8d9
- SSDEEP 1536:VFX8L/601TCQ71+fwW691DdMJ3q+ncbOp/W/bllcVznH1bWoDv/0ysg3nkGyxRtO:nCprjPIy7lk6rd1c
- TLSH T1DD949A245FF90235B2B39B479DF3052359377DA6B935E90C2280831D06A2F09D97AB6F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\dd_vcredistMSI5AC8.txt
- Size 413KB
- SHA256 f153f17bdf1cb1f37b8c8f3236d1511ea23396ca17a7221057eb4a07e237dd37
- MD5 1e73abf3b863c5ccb9eb9261d33d54d5
- SHA1 bb2d2d733e9317947c6b21bfb9089382f8c78556
- SHA512 7eb1aa90cbc7d60654b8feea8530af157db55e0c60aad43f08e6f88d2673d4569c4419d54f4dcdd84f59ff4feab930d033a636b0e1db518d6883a840f0e0c0cd
- SSDEEP 1536:m2g1IJ3rBFSKaXePRXYLuh6EExmcivDzc7Tp337omQszboiW1N5yJLX02++wFo6n:m2pojUULhOgaie6+Q8
- TLSH T1D3947A295FF90226B2B3DB579EF3082359337D66E835D90D22C0835D05A2E04D976BAF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\dd_vcredistUI5AAE.txt
- Size 11KB
- SHA256 c306ae85a1375f2f9eaa8a2128663856a36ad0afbff54b659c10a3520cf7dc75
- MD5 36e92656f4d33aa0c3de8cdbd865d705
- SHA1 f7be8935541db4f71b0cc4763bd4b664cf792236
- SHA512 eef0a5fcc31f4654a5b4947525cfb0e2378a19d17ee9adce46bcc6a83b1a45d1d6787e65114903cbe7d9fa66b567441565e0071d1be1ff242c784d96ee393382
- SSDEEP 192:WWhQbpQbgStl+TQugnwnjqnwngMPunwnx+XO80BvX8Rv:JQbpQbgStl+TQugwWwgMPuwerxRv
- TLSH T19732B015AFE80456B8F39A4FECF35413AFB7B8416978E90E02F5235A05A654CF4A132F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\dd_vcredistUI5AC8.txt
- Size 11KB
- SHA256 077c772ebf5bf245f1606821c0dfa5ccfa213cb0473c089586d6b839318bcaba
- MD5 18f019b990dea1c590be1201b10ea695
- SHA1 10d742dfc2494c0e765966f20f673291f8348649
- SHA512 8207edf11d9d3732de3948c19f817331f3b73f7d0eb4b4be02ac7d5a949a19edf1523f64dd6cd701b285f95bea32dc1edc9f0ed8b2acfdc945fc17a14700acea
- SSDEEP 192:/XQFRzS+h4sem90WC5s07U7pXX9TviTFtIVocB5CZSNTourQ797Wbv+7xhZyKniL:GR0KlqZYYXhp/pLMuP7XC+0f
- TLSH T1DA32C31AABE50455B8F3DA4FEDF35813EFB6B8805979D50D02F5239A04A7508F4A232F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\jawshtml.html
- Size 13B
- SHA256 7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73
- MD5 b2a4bc176e9f29b0c439ef9a53a62a1a
- SHA1 1ae520cbbf7e14af867232784194366b3d1c3f34
- SHA512 e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\jusched.log
- Size 163KB
- SHA256 3122918f6f3df8bcf23664d7c8008f526f3bfeb9162515515061af51dcf0ed8e
- MD5 6d154231ed9137c839c33f0d20438958
- SHA1 28146e72e5abbd9059d884ce6d38d03617dc01bd
- SHA512 4140e9e3c149dc586e512a2ca8cc6182124ac0df9a3b30c773fd5be8e56dc55962ac2686c564f9e347f77fcf9943a8a0043588f5e5619513aa4a0887a0bf753a
- SSDEEP 3072:cY49v2v+ocz4EV05SwtXaby8ZhzUUe7LSALjhjxSXnhR:zJkX3
- TLSH T12AF320C2993E94BB39634FD7E3795D6485A2150F439E091831CF86EAF446C03869E8FE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\mapping.csv
- Size 120KB
- SHA256 2684d360ec473113d922a2738c5c6f6702975e6ac7ee4023258a12ed26c9fefe
- MD5 d3186aada63877a1fe1c2ed4b2e2b77d
- SHA1 f66d9307be6cbbb22941c724d2cf6954b41d7bb0
- SHA512 c94e8aa368a44f1df9f0318ca266f5a6a9140945d55a579dee2fd10aff3d4704a72a216718b35e44429012d68c2bb30a92d5179fbc9fb4b222456a017d8981c0
- SSDEEP 768:oauu63GP/3Go+73GEVF3GL2QkUQ1HqfEe0/+dg5iwFeCo6QOATLJ1R4pbfyQw+t0:gu63GP/3Go+73GEVF3GGUn
- TLSH T11DC35121D2F6619CF5F3AF941AB41AA91E73FC16AD2DED9C0250620D0466E61DE31F33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\msedge_installer.log
- Size 2KB
- SHA256 7790c2133c94fd0ea95e5afe58f386009ed92f87b9c726083760a9262ace2749
- MD5 db5da6ceaee85e333ef6a9085481f68d
- SHA1 3e11cc24003b453475253e46e317dac972878408
- SHA512 229918d6d9af8011397f1b24e4ad8239effd21d551ad770f446392b4237d3c9667897dd57f563686fa631a5439943109a7c9e003bfe6fdfa7e278e8431d23256
- TLSH T1FD51F055476286BF6BDDE57222823F6910A542FEC99112F035E880D8B841ADA363FCD2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\wctEA40.tmp
- Size 63KB
- SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
- MD5 e516a60bc980095e8d156b1a99ab5eee
- SHA1 238e243ffc12d4e012fd020c9822703109b987f6
- SHA512 9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58
- SSDEEP 384:poaSLGTSy3S0XuMU9mCzHS7vpvpJGV6Hu/i49Pji7iJI5TZCP56vS1xDR+dBUFvT:WryF7U9mCzHS7vu/xV2iP56vcDR+P0T
- TLSH T18A53DD9E2108B66FE215AD5A7EABA9861C31746E3842CFCDF1CDC26C5F40DC4334A5A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\wmsetup.log
- Size 693B
- SHA256 18d6de84c1651267fb3844932b0335360fc6108677fdfb72a3de66b78f72caea
- MD5 534363737ab34eec5d2e2186fd0b3c1e
- SHA1 b952e94b497bca90aee92f3a69f548f2996aa4c9
- SHA512 53db7c9053b970e3bfcdefda7e7fa5655836668422112f9f42133ac408c4971c5705f245204f376c1b84dfd391ac572d12408f2297e86a86bcf1fa5a3c182b86
- TLSH T1FD0147D70A0998B09ED01BA76ACCCE3973BAD3CF43A4E027A289D419440923DB33E05D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\{E4343229-119A-C66F-D851-4262261C6478}\~DF728ABB07718EC7C5.TMP
- Size 16KB
- SHA256 205d000aa762f3a96ac3ad4b25d791b5f7fc8efb9056b78f299f671a02b9fd21
- MD5 679672a5004e0af50529f33db5469699
- SHA1 427a4ec3281c9c4faeb47a22ffbe7ca3e928afb0
- SHA512 f8615c5e5cf768a94e06961c7c8bef99beb43e004a882a4e384f5dd56e047ca59b963a59971f78dcf4c35d1bb92d3a9bc7055bfa3a0d597635de1a9ce06a3476
- SSDEEP 3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
- TLSH T19B7202427234D665D54809368D41D5CC9776BD00DE14D14375DA775F0A314E04454652
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\HowToRestoreFiles.txt
- Size 1KB
- SHA256 7f881d95a7f615770c2b3c7e849aea0517df56b266110114e57b181518fce375
- MD5 874f8d5f3ed035a114bfbed8a0f2155b
- SHA1 6ec0483963a1b3a663130cf1f28211a72c000084
- SHA512 2a489abcba2daf0094840c1ff54ea9468d086d2f5abde95a0d5a3675d4622a3f4abf5aad82d38d16de4edd0b06e0e31a5fd6b6ce2f1b931536f3d6e0dd354410
- TLSH T1DC31B26933F95540B3B3AF195E7196608B7E3EA3AD3CEA1C0291100D08F5E54E8B1BA7
- MD5 SHA1 SHA512 TLSH