avaddon | 04db39659104b1a6b6a96f7ae7d65d977d34b14cbfa4372de843e757590b901f

Sharing

Copy URL Twitter E-mail

General

Target
Documents 5.zip
Size 240.9MB
Sample260930-alaeesserb
SHA256 04db39659104b1a6b6a96f7ae7d65d977d34b14cbfa4372de843e757590b901f
MD5 4d3d48b4fd5b87fdb7fd65440bc1bd04
SHA1 aeb79ebe4b28f1c974de7cb5d2861964edea7a7a
SHA512 b91e90f90a212666d0a0d59e3b03972677f4e4718a2906dc475cd64fa59a31082f3aa629adb6877dc489e0f31c06bedfbc88dd1e1314baf8431c5149a6d27ecf
SSDEEP 6291456:O7upBsS2tncOvokLQzJMc7tArmGvXZYi61SUWiWIl5Wyo:OKpBsDt1QEQz+EG6Gvqieji
TLSH
T150C8339E192C1F83E86E9E52C224623B27F5B1E64F69FC26FB110A7704177948C76C36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

avaddon

Ransom Note

Sep 15 02:47:10 ASUS/192.168.1.250 THOR: Notice: MODULE: Init MESSAGE: Some modules and features are not available in Lite version and will be disabled SCANID: S-4txoEDTou1s Sep 15 02:47:10 ASUS/192.168.1.250 THOR: Notice: MODULE: Startup MESSAGE: This THOR Lite license permits non-commercial use only. It is strictly prohibited to sell THOR Lite or sell services that include the use of THOR Lite. For details, see the EULA in the ./docs folder. For a special license that covers these cases, allows Sigma scanning and suppresses this message, please contact our sales via https://www.nextron-systems.com/get-started/ SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Version: 10.7.32 SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Build: 1cabaee8cbc5 (2026-09-09 10:00:28) SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Run on system: ASUS SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Running as user: ASUS\micro SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Netbios Domain: ASUS SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: User has admin rights: yes SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Working Directory: C:\thor-lite-windows_10.7.29 SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Scan started SCANID: S-4txoEDTou1s START_TIME: Mon Sep 14 20:47:16 2026 HOSTNAME: ASUS Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Effective argument list: [--allhds --alldrives --follow-symlinks --max-nested-objects 100000 --intense --nocpulimit --norescontrol --force-max-file-size --allfiles --c2-in-memory --full-proc-integrity --resume --vtkey 126e0... --vtmode full --vtscore 30 --vtaccepteula --vtwaitforquota] SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Platform: Windows 11 Home SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Platform DeepEval SCANID: S-4txoEDTou1s NAME: Windows 11 Home TYPE: Multiprocessor Free VERSION: 6.3 PROC: Intel64 Family 6 Model 122 Stepping 8 ARCH: AMD64 INSTALLED_ON: Thu Apr 23 01:54:08 2026 BUILD_NUMBER: 26200 Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Language: en-CA, Zone: MDT SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: System Uptime: 0.27 days SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: CPU Count: 2 SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Memory in Megabyte: 3918 SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Signature Database: 1.260911.111518 SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Successfully compiled 0 false positive filters SCANID: S-4txoEDTou1s TYPE: log filter Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing report file to: ASUS_thor_2026-09-14_2047.txt SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing csv report file to: ASUS_files_md5s.csv SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: No json report file will be written SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing html report file to: ASUS_thor_2026-09-14_2047.html SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Syslog Export: off SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: IP Address 1: 192.168.1.250 SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: ScanID: S-4txoEDTou1s SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: System is not a domain controller SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Intense Scan Mode SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Max. file size to be scanned is 209.7 MB, use --max_file_size to increase the limit SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Selected modules: AtJobs, Autoruns, DNSCache, EnvCheck, EtwWatcher, Eventlog, Events, Filescan, Firewall, Hosts, HotfixCheck, LSASessions, LoggedIn, MFT, Mutex, NetworkSessions, NetworkShares, Pipes, ProcessCheck, RegistryChecks, Rootkit, SHIMCache, ScheduledTasks, ServiceCheck, Timestomp, UserDir, Users, WMIStartup SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Deselected modules: Artifact-Collector, DeepDive, Dropzone, Thunderstorm SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Selected features: Amcache, Archive, ArchiveScan, AtJobs, Auditlog, AuthorizedKeys, Bifrost2, BulkScan, C2, CheckString, CronParser, DoublePulsar, DumpScan, ETL, EVTX, Eml, EnrichFileInfo, ExeDecompress, FilenameIOCs, Filescan, GroupsXML, KeywordIOCs, Lnk, LogScan, Logger, MagicHeader, OLE, ParseCobaltStrike, Prefetch, ProcessConnections, ProcessHandles, ProcessIntegrity, ProgressTracker, RecycleBin, RegistryHive, SHIMCache, Sigma, SignalHandler, Stix, TeamViewer, ThorDB, VirusTotal, VulnerabilityCheck, WER, WMIPersistence, WebdirScan, WorkerProgressTracker, Yara SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Deselected features: Action, AuditTrail, AuditTrailWriter, Bifrost, CPULimit, Rescontrol SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: System Type: Workstation SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: License file found SCANID: S-4txoEDTou1s LICENSE: 8cbc51cde68eeb54202cdcb836ff5680_5a3bb052dcf94229a61dbffb25755169.lic OWNER: [email protected] TYPE: Lite STARTS: 2026/03/18 EXPIRES: 2026/09/18 SCANNER: THOR Lite VALID: true Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Firewall due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module HotfixCheck due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module RegistryChecks due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module EtwWatcher due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Eventlog due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Users due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Hosts due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module UserDir due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module EnvCheck due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module LSASessions due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module WMIStartup due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module SHIMCache due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module DNSCache due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module NetworkSessions due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module MFT due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Rootkit due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module NetworkShares due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module LoggedIn due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Mutex due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Pipes due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module ScheduledTasks due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module ServiceCheck due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Timestomp due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module AtJobs due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Events due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature VulnerabilityCheck due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature AtJobs due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature AuthorizedKeys due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Lnk due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature OLE due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Sigma due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature SignalHandler due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature CronParser due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Eml due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WebdirScan due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WMIPersistence due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature MagicHeader due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature ProgressTracker due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Logger due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Prefetch due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature RegistryHive due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature VirusTotal due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WorkerProgressTracker due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Auditlog due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Stix due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature TeamViewer due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Amcache due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Bifrost2 due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature BulkScan due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature EVTX due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature ExeDecompress due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature GroupsXML due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature RecycleBin due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature DoublePulsar due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature SHIMCache due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WER due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-all.yas as 'default' type SCANID: S-4txoEDTou1s Sep 15 02:47:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-deepscan-selectors.yasx as 'meta' type SCANID: S-4txoEDTou1s Sep 15 02:47:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-keywords.yas as 'keyword' type SCANID: S-4txoEDTou1s Sep 15 02:47:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-log-sigs.yas as 'log' type SCANID: S-4txoEDTou1s Sep 15 02:47:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-meta.yas as 'meta' type SCANID: S-4txoEDTou1s Sep 15 02:47:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-peids.yas as 'default' type SCANID: S-4txoEDTou1s Sep 15 02:47:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-process-memory-sigs.yas as 'process' type SCANID: S-4txoEDTou1s Sep 15 02:47:22 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-registry.yas as 'registry' type SCANID: S-4txoEDTou1s Sep 15 02:47:22 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact32_and_resources_dropper_v1_45_to_v4_x.yara as 'default' and 'custom' type SCANID: S-4txoEDTou1s Sep 15 02:47:22 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact32svc_exe_v1_49_to_v4_x.yara as 'default' and 'custom' type SCANID: S-4txoEDTou1s Sep 15 02:47:22 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact64_v1_49_to_v4_x.yara as 'default' and 'custom' type SCANID: S-4txoEDTou1s Sep 15 02:47:22 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_beacon_dll_all_versions_memenabled.yara as 'default' and 'custom' type SCANID: S-4txoEDTou1s Sep 15 02:47:22 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_bind64_bin_v2_5_through_v4_x.yara as 'default' and 'custom' type SCANID

Emails

[email protected]

URLs

https://www.nextron-systems.com/get-started/

Extracted

avaddon

Ransom Note

Sep 16 09:08:47 ASUS/192.168.1.250 THOR: Notice: MODULE: Init MESSAGE: Some modules and features are not available in Lite version and will be disabled SCANID: S-acir1xbb1io Sep 16 09:08:47 ASUS/192.168.1.250 THOR: Notice: MODULE: Startup MESSAGE: This THOR Lite license permits non-commercial use only. It is strictly prohibited to sell THOR Lite or sell services that include the use of THOR Lite. For details, see the EULA in the ./docs folder. For a special license that covers these cases, allows Sigma scanning and suppresses this message, please contact our sales via https://www.nextron-systems.com/get-started/ SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Version: 10.7.32 SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Build: 1cabaee8cbc5 (2026-09-09 10:00:28) SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Run on system: ASUS SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Running as user: ASUS\micro SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Netbios Domain: ASUS SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: User has admin rights: yes SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Working Directory: C:\thor-lite-windows_10.7.29 SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Scan started SCANID: S-acir1xbb1io START_TIME: Wed Sep 16 03:08:52 2026 HOSTNAME: ASUS Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Effective argument list: [--allhds --alldrives --follow-symlinks --max-nested-objects 100000 --intense --nocpulimit --norescontrol --force-max-file-size --allfiles --c2-in-memory --full-proc-integrity --resume --vtkey 126e0... --vtmode full --vtscore 30 --vtaccepteula --vtwaitforquota] SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Platform: Windows 11 Home SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Platform DeepEval SCANID: S-acir1xbb1io NAME: Windows 11 Home TYPE: Multiprocessor Free VERSION: 6.3 PROC: Intel64 Family 6 Model 122 Stepping 8 ARCH: AMD64 INSTALLED_ON: Thu Apr 23 01:54:08 2026 BUILD_NUMBER: 26200 Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Language: en-CA, Zone: MDT SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: System Uptime: 0.01 days SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: CPU Count: 2 SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Memory in Megabyte: 3918 SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Signature Database: 1.260911.111518 SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Successfully compiled 0 false positive filters SCANID: S-acir1xbb1io TYPE: log filter Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing report file to: ASUS_thor_2026-09-16_0308.txt SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing csv report file to: ASUS_files_md5s.csv SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: No json report file will be written SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing html report file to: ASUS_thor_2026-09-16_0308.html SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Syslog Export: off SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: IP Address 1: 192.168.1.250 SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: ScanID: S-acir1xbb1io SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: System is not a domain controller SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Intense Scan Mode SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Max. file size to be scanned is 209.7 MB, use --max_file_size to increase the limit SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Selected modules: AtJobs, Autoruns, DNSCache, EnvCheck, EtwWatcher, Eventlog, Events, Filescan, Firewall, Hosts, HotfixCheck, LSASessions, LoggedIn, MFT, Mutex, NetworkSessions, NetworkShares, Pipes, ProcessCheck, RegistryChecks, Rootkit, SHIMCache, ScheduledTasks, ServiceCheck, Timestomp, UserDir, Users, WMIStartup SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Deselected modules: Artifact-Collector, DeepDive, Dropzone, Thunderstorm SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Selected features: Amcache, Archive, ArchiveScan, AtJobs, Auditlog, AuthorizedKeys, Bifrost2, BulkScan, C2, CheckString, CronParser, DoublePulsar, DumpScan, ETL, EVTX, Eml, EnrichFileInfo, ExeDecompress, FilenameIOCs, Filescan, GroupsXML, KeywordIOCs, Lnk, LogScan, Logger, MagicHeader, OLE, ParseCobaltStrike, Prefetch, ProcessConnections, ProcessHandles, ProcessIntegrity, ProgressTracker, RecycleBin, RegistryHive, SHIMCache, Sigma, SignalHandler, Stix, TeamViewer, ThorDB, VirusTotal, VulnerabilityCheck, WER, WMIPersistence, WebdirScan, WorkerProgressTracker, Yara SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Deselected features: Action, AuditTrail, AuditTrailWriter, Bifrost, CPULimit, Rescontrol SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: System Type: Workstation SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: License file found SCANID: S-acir1xbb1io LICENSE: C:\thor-lite-windows_10.7.29\8cbc51cde68eeb54202cdcb836ff5680_5a3bb052dcf94229a61dbffb25755169.lic OWNER: [email protected] TYPE: Lite STARTS: 2026/03/18 EXPIRES: 2026/09/18 SCANNER: THOR Lite VALID: true Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Hosts due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module NetworkShares due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module SHIMCache due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Events due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Pipes due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Rootkit due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Timestomp due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module EtwWatcher due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Firewall due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module NetworkSessions due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module AtJobs due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module DNSCache due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Mutex due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Users due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module EnvCheck due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module HotfixCheck due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module LSASessions due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module LoggedIn due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module MFT due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module RegistryChecks due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Eventlog due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module ServiceCheck due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module UserDir due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module WMIStartup due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module ScheduledTasks due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature ProgressTracker due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Bifrost2 due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature CronParser due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature ExeDecompress due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Logger due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature SHIMCache due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Sigma due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature TeamViewer due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature VulnerabilityCheck due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WebdirScan due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WorkerProgressTracker due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature SignalHandler due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Amcache due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature AuthorizedKeys due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature EVTX due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature OLE due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature RecycleBin due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Eml due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Prefetch due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WER due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature GroupsXML due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Lnk due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature AtJobs due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature DoublePulsar due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature VirusTotal due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Auditlog due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature BulkScan due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature MagicHeader due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature RegistryHive due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Stix due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WMIPersistence due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-all.yas as 'default' type SCANID: S-acir1xbb1io Sep 16 09:08:57 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-deepscan-selectors.yasx as 'meta' type SCANID: S-acir1xbb1io Sep 16 09:08:57 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-keywords.yas as 'keyword' type SCANID: S-acir1xbb1io Sep 16 09:08:57 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-log-sigs.yas as 'log' type SCANID: S-acir1xbb1io Sep 16 09:08:58 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-meta.yas as 'meta' type SCANID: S-acir1xbb1io Sep 16 09:08:58 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-peids.yas as 'default' type SCANID: S-acir1xbb1io Sep 16 09:08:58 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-process-memory-sigs.yas as 'process' type SCANID: S-acir1xbb1io Sep 16 09:08:59 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-registry.yas as 'registry' type SCANID: S-acir1xbb1io Sep 16 09:08:59 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact32_and_resources_dropper_v1_45_to_v4_x.yara as 'default' and 'custom' type SCANID: S-acir1xbb1io Sep 16 09:08:59 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact32svc_exe_v1_49_to_v4_x.yara as 'default' and 'custom' type SCANID: S-acir1xbb1io Sep 16 09:08:59 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact64_v1_49_to_v4_x.yara as 'default' and 'custom' type SCANID: S-acir1xbb1io Sep 16 09:08:59 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_beacon_dll_all_versions_memenabled.yara as 'default' and 'custom' type SCANID: S-acir1xbb1io Sep 16 09:08:59 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_bind64_bin_v2_5_through_v4_x.yara as 'defa

Emails

[email protected]

URLs

https://www.nextron-systems.com/get-started/

Extracted

avaddon

Ransom Note

Sep 18 08:08:15 ASUS/192.168.1.250 THOR: Notice: MODULE: Init MESSAGE: Some modules and features are not available in Lite version and will be disabled SCANID: S-fDcCOfEOshg Sep 18 08:08:15 ASUS/192.168.1.250 THOR: Notice: MODULE: Startup MESSAGE: This THOR Lite license permits non-commercial use only. It is strictly prohibited to sell THOR Lite or sell services that include the use of THOR Lite. For details, see the EULA in the ./docs folder. For a special license that covers these cases, allows Sigma scanning and suppresses this message, please contact our sales via https://www.nextron-systems.com/get-started/ SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Version: 10.7.32 SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Build: 1cabaee8cbc5 (2026-09-09 10:00:28) SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Run on system: ASUS SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Running as user: ASUS\micro SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Netbios Domain: ASUS SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: User has admin rights: yes SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Working Directory: C:\thor-lite-windows_10.7.29 SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Scan started SCANID: S-fDcCOfEOshg START_TIME: Fri Sep 18 02:08:20 2026 HOSTNAME: ASUS Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Effective argument list: [--allhds --alldrives --follow-symlinks --max-nested-objects 100000 --intense --nocpulimit --norescontrol --force-max-file-size --allfiles --c2-in-memory --full-proc-integrity --resume --vtkey 126e0... --vtmode full --vtscore 30 --vtaccepteula --vtwaitforquota] SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Platform: Windows 11 Home SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Platform DeepEval SCANID: S-fDcCOfEOshg NAME: Windows 11 Home TYPE: Multiprocessor Free VERSION: 6.3 PROC: Intel64 Family 6 Model 122 Stepping 8 ARCH: AMD64 INSTALLED_ON: Thu Apr 23 01:54:08 2026 BUILD_NUMBER: 26200 Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Language: en-CA, Zone: MDT SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: System Uptime: 1.97 days SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: CPU Count: 2 SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Memory in Megabyte: 3918 SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Signature Database: 1.260911.111518 SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Successfully compiled 0 false positive filters SCANID: S-fDcCOfEOshg TYPE: log filter Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing report file to: ASUS_thor_2026-09-18_0208.txt SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing csv report file to: ASUS_files_md5s.csv SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: No json report file will be written SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing html report file to: ASUS_thor_2026-09-18_0208.html SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Syslog Export: off SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: IP Address 1: 192.168.1.250 SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: ScanID: S-fDcCOfEOshg SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: System is not a domain controller SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Intense Scan Mode SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Max. file size to be scanned is 209.7 MB, use --max_file_size to increase the limit SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Selected modules: AtJobs, Autoruns, DNSCache, EnvCheck, EtwWatcher, Eventlog, Events, Filescan, Firewall, Hosts, HotfixCheck, LSASessions, LoggedIn, MFT, Mutex, NetworkSessions, NetworkShares, Pipes, ProcessCheck, RegistryChecks, Rootkit, SHIMCache, ScheduledTasks, ServiceCheck, Timestomp, UserDir, Users, WMIStartup SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Deselected modules: Artifact-Collector, DeepDive, Dropzone, Thunderstorm SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Selected features: Amcache, Archive, ArchiveScan, AtJobs, Auditlog, AuthorizedKeys, Bifrost2, BulkScan, C2, CheckString, CronParser, DoublePulsar, DumpScan, ETL, EVTX, Eml, EnrichFileInfo, ExeDecompress, FilenameIOCs, Filescan, GroupsXML, KeywordIOCs, Lnk, LogScan, Logger, MagicHeader, OLE, ParseCobaltStrike, Prefetch, ProcessConnections, ProcessHandles, ProcessIntegrity, ProgressTracker, RecycleBin, RegistryHive, SHIMCache, Sigma, SignalHandler, Stix, TeamViewer, ThorDB, VirusTotal, VulnerabilityCheck, WER, WMIPersistence, WebdirScan, WorkerProgressTracker, Yara SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Deselected features: Action, AuditTrail, AuditTrailWriter, Bifrost, CPULimit, Rescontrol SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: System Type: Workstation SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: License file found SCANID: S-fDcCOfEOshg LICENSE: C:\thor-lite-windows_10.7.29\8cbc51cde68eeb54202cdcb836ff5680_5a3bb052dcf94229a61dbffb25755169.lic OWNER: [email protected] TYPE: Lite STARTS: 2026/03/18 EXPIRES: 2026/09/18 SCANNER: THOR Lite VALID: true Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module NetworkShares due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module HotfixCheck due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Pipes due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Hosts due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Users due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module LSASessions due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Firewall due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module ScheduledTasks due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module WMIStartup due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module EnvCheck due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module NetworkSessions due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module RegistryChecks due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module SHIMCache due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Timestomp due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Events due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module EtwWatcher due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Eventlog due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module MFT due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Rootkit due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module ServiceCheck due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module DNSCache due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Mutex due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module UserDir due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module AtJobs due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module LoggedIn due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature VirusTotal due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WMIPersistence due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature AuthorizedKeys due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature BulkScan due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature RecycleBin due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Sigma due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Auditlog due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Prefetch due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature VulnerabilityCheck due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Lnk due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature OLE due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WorkerProgressTracker due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WER due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature CronParser due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature ExeDecompress due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature GroupsXML due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature MagicHeader due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature ProgressTracker due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature SHIMCache due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature SignalHandler due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature DoublePulsar due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Logger due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WebdirScan due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Stix due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature TeamViewer due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature AtJobs due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature EVTX due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Eml due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature RegistryHive due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Amcache due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Bifrost2 due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-all.yas as 'default' type SCANID: S-fDcCOfEOshg Sep 18 08:08:26 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-deepscan-selectors.yasx as 'meta' type SCANID: S-fDcCOfEOshg Sep 18 08:08:26 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-keywords.yas as 'keyword' type SCANID: S-fDcCOfEOshg Sep 18 08:08:26 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-log-sigs.yas as 'log' type SCANID: S-fDcCOfEOshg Sep 18 08:08:26 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-meta.yas as 'meta' type SCANID: S-fDcCOfEOshg Sep 18 08:08:26 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-peids.yas as 'default' type SCANID: S-fDcCOfEOshg Sep 18 08:08:26 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-process-memory-sigs.yas as 'process' type SCANID: S-fDcCOfEOshg Sep 18 08:08:27 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-registry.yas as 'registry' type SCANID: S-fDcCOfEOshg Sep 18 08:08:27 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact32_and_resources_dropper_v1_45_to_v4_x.yara as 'default' and 'custom' type SCANID: S-fDcCOfEOshg Sep 18 08:08:27 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact32svc_exe_v1_49_to_v4_x.yara as 'default' and 'custom' type SCANID: S-fDcCOfEOshg Sep 18 08:08:28 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact64_v1_49_to_v4_x.yara as 'default' and 'custom' type SCANID: S-fDcCOfEOshg Sep 18 08:08:28 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_beacon_dll_all_versions_memenabled.yara as 'default' and 'custom' type SCANID: S-fDcCOfEOshg Sep 18 08:08:28 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_bind64_bin_v2_5_through_v4_x.yara as 'defa

Emails

[email protected]

URLs

https://www.nextron-systems.com/get-started/

Extracted

avaddon

Ransom Note

Sep 15 23:49:17 ASUS/192.168.1.250 THOR: Notice: MODULE: Init MESSAGE: Some modules and features are not available in Lite version and will be disabled SCANID: S-xu1tfadk3bg Sep 15 23:49:17 ASUS/192.168.1.250 THOR: Notice: MODULE: Startup MESSAGE: This THOR Lite license permits non-commercial use only. It is strictly prohibited to sell THOR Lite or sell services that include the use of THOR Lite. For details, see the EULA in the ./docs folder. For a special license that covers these cases, allows Sigma scanning and suppresses this message, please contact our sales via https://www.nextron-systems.com/get-started/ SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Version: 10.7.32 SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Build: 1cabaee8cbc5 (2026-09-09 10:00:28) SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Run on system: ASUS SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Running as user: ASUS\micro SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Netbios Domain: ASUS SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: User has admin rights: yes SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Working Directory: C:\thor-lite-windows_10.7.29 SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Scan started SCANID: S-xu1tfadk3bg START_TIME: Tue Sep 15 17:49:22 2026 HOSTNAME: ASUS Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Effective argument list: [--resume] SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Platform: Windows 11 Home SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Platform DeepEval SCANID: S-xu1tfadk3bg NAME: Windows 11 Home TYPE: Multiprocessor Free VERSION: 6.3 PROC: Intel64 Family 6 Model 122 Stepping 8 ARCH: AMD64 INSTALLED_ON: Thu Apr 23 01:54:08 2026 BUILD_NUMBER: 26200 Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Language: en-CA, Zone: MDT SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: System Uptime: 0.05 days SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: CPU Count: 2 SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Memory in Megabyte: 3918 SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Signature Database: 1.260911.111518 SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Successfully compiled 0 false positive filters SCANID: S-xu1tfadk3bg TYPE: log filter Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing report file to: ASUS_thor_2026-09-15_1749.txt SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing csv report file to: ASUS_files_md5s.csv SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: No json report file will be written SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing html report file to: ASUS_thor_2026-09-15_1749.html SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Syslog Export: off SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: IP Address 1: 192.168.1.250 SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: ScanID: S-xu1tfadk3bg SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: System is not a domain controller SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Max. file size to be scanned is 31.5 MB, use --max_file_size to increase the limit SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Selected modules: AtJobs, Autoruns, DNSCache, EnvCheck, EtwWatcher, Eventlog, Events, Filescan, Firewall, Hosts, HotfixCheck, LSASessions, LoggedIn, Mutex, NetworkSessions, NetworkShares, Pipes, ProcessCheck, RegistryChecks, Rootkit, SHIMCache, ScheduledTasks, ServiceCheck, Timestomp, UserDir, Users, WMIStartup SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Deselected modules: Artifact-Collector, DeepDive, Dropzone, MFT, Thunderstorm SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Selected features: Amcache, Archive, ArchiveScan, AtJobs, Auditlog, AuthorizedKeys, Bifrost2, BulkScan, C2, CPULimit, CheckString, CronParser, DoublePulsar, ETL, EVTX, Eml, EnrichFileInfo, ExeDecompress, FilenameIOCs, Filescan, GroupsXML, KeywordIOCs, Lnk, LogScan, Logger, MagicHeader, OLE, ParseCobaltStrike, Prefetch, ProcessConnections, ProcessHandles, ProgressTracker, RecycleBin, RegistryHive, Rescontrol, SHIMCache, Sigma, SignalHandler, Stix, TeamViewer, ThorDB, VirusTotal, VulnerabilityCheck, WER, WMIPersistence, WebdirScan, WorkerProgressTracker, Yara SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Deselected features: Action, AuditTrail, AuditTrailWriter, Bifrost, DumpScan, ProcessIntegrity SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: System Type: Workstation SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: License file found SCANID: S-xu1tfadk3bg LICENSE: 8cbc51cde68eeb54202cdcb836ff5680_5a3bb052dcf94229a61dbffb25755169.lic OWNER: [email protected] TYPE: Lite STARTS: 2026/03/18 EXPIRES: 2026/09/18 SCANNER: THOR Lite VALID: true Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module RegistryChecks due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module UserDir due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Eventlog due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module LoggedIn due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module NetworkShares due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Events due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Rootkit due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Timestomp due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module LSASessions due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Pipes due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module SHIMCache due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Users due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module NetworkSessions due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Hosts due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module HotfixCheck due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module WMIStartup due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module AtJobs due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Firewall due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module ScheduledTasks due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Mutex due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module ServiceCheck due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module DNSCache due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module EnvCheck due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module EtwWatcher due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature ExeDecompress due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature DoublePulsar due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature ProgressTracker due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature SHIMCache due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature GroupsXML due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature RegistryHive due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature VirusTotal due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WebdirScan due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Sigma due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature VulnerabilityCheck due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature AtJobs due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature OLE due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WorkerProgressTracker due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Logger due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Stix due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WER due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WMIPersistence due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature BulkScan due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Prefetch due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Lnk due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature RecycleBin due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature SignalHandler due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature TeamViewer due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Amcache due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature CronParser due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature EVTX due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Eml due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature MagicHeader due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Auditlog due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature AuthorizedKeys due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Bifrost2 due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-all.yas as 'default' type SCANID: S-xu1tfadk3bg Sep 15 23:49:31 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-deepscan-selectors.yasx as 'meta' type SCANID: S-xu1tfadk3bg Sep 15 23:49:31 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-keywords.yas as 'keyword' type SCANID: S-xu1tfadk3bg Sep 15 23:49:31 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-log-sigs.yas as 'log' type SCANID: S-xu1tfadk3bg Sep 15 23:49:31 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-meta.yas as 'meta' type SCANID: S-xu1tfadk3bg Sep 15 23:49:31 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-peids.yas as 'default' type SCANID: S-xu1tfadk3bg Sep 15 23:49:31 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-process-memory-sigs.yas as 'process' type SCANID: S-xu1tfadk3bg Sep 15 23:49:33 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-registry.yas as 'registry' type SCANID: S-xu1tfadk3bg Sep 15 23:49:33 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact32_and_resources_dropper_v1_45_to_v4_x.yara as 'default' and 'custom' type SCANID: S-xu1tfadk3bg Sep 15 23:49:33 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact32svc_exe_v1_49_to_v4_x.yara as 'default' and 'custom' type SCANID: S-xu1tfadk3bg Sep 15 23:49:33 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact64_v1_49_to_v4_x.yara as 'default' and 'custom' type SCANID: S-xu1tfadk3bg Sep 15 23:49:33 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_beacon_dll_all_versions_memenabled.yara as 'default' and 'custom' type SCANID: S-xu1tfadk3bg Sep 15 23:49:34 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_bind64_bin_v2_5_through_v4_x.yara as 'default' and 'custom' type SCANID: S-xu1tfadk3bg Sep 15 23:49:34 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_bind_bin_v2_5_through_v4_x.yara as 'default' and 'custom' type SCANID: S-xu1tfadk3bg Sep 15 23:49:34 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_browserpivot_bin_v1_48_to_v3_14_and_sleeve_browserpivot_dll_v4_0_to_v4_x.yara as 'default' and 'custom' type SCANID: S-xu1tfadk3bg Sep 15 23:49:35 ASUS/192.168.1.25

Emails

[email protected]

URLs

https://www.nextron-systems.com/get-started/

Targets

- Target
  Documents 5.zip
- Size 240.9MB
- SHA256 04db39659104b1a6b6a96f7ae7d65d977d34b14cbfa4372de843e757590b901f
- MD5 4d3d48b4fd5b87fdb7fd65440bc1bd04
- SHA1 aeb79ebe4b28f1c974de7cb5d2861964edea7a7a
- SHA512 b91e90f90a212666d0a0d59e3b03972677f4e4718a2906dc475cd64fa59a31082f3aa629adb6877dc489e0f31c06bedfbc88dd1e1314baf8431c5149a6d27ecf
- SSDEEP 6291456:O7upBsS2tncOvokLQzJMc7tArmGvXZYi61SUWiWIl5Wyo:OKpBsDt1QEQz+EG6Gvqieji
- TLSH
  T150C8339E192C1F83E86E9E52C224623B27F5B1E64F69FC26FB110A7704177948C76C36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  DOS - Windows Logs Admin Events and Pics of things.zip
- Size 743KB
- SHA256 a31f8b1db900695d0f185effe0b87942e1d07977959e9faff5d05d5c5d720717
- MD5 ae24d24bd83e67c8906d3ad05622fe4e
- SHA1 f0bb2f92f6105b92c4b6770d22c1bb9d2624cf1f
- SHA512 db45e28c2a5fb3e5be4d11eb3455c22909a3446e16e87815a4f49fbb8f1c14402ef49bc61f0d8e1200f4acf02a8f6330cb2997fbcd9a1aeca5629b53e572b1b9
- SSDEEP 12288:c9NQb7BFnHIa1Nrs2DLDINAzoDl9Bc9Fx2HR5A9fA9kSkJEHcJ+OS6:bnHIavDfINAzs7+Txg3AxAivJEu+OS6
- TLSH
  T1EEF4231BF5B904A8B079455E5173AEEC93FD8CAF9F4A30724E0C9092294391E57EE7B0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Dos - WindowsPowerShell.zip
- Size 637KB
- SHA256 e75ff18ee5c7226e225aa9959df439f1488df8cd3d43f5471361ed0426700832
- MD5 07d37fc575e373f878ae3c7cca2bfc25
- SHA1 a2fc89aba12f8739184d44d0fffbe6323d9654eb
- SHA512 36dc7349d052cd474818a6ae3149eda469d829cf2e4d9a0e55252468cdf9e9704d5293b8b4f73b4a25b07f8c8dd8eeab2ed18bbb1ff7d76958b51eb555562339
- SSDEEP 12288:p+tdEY/BtfYSn+LaTe6I+VrYtsyPZn7Dc7vsZEZ7zDVzSEpSH8TRNdgS35ZOnx:Mtdp/bAc+kzIrt1nnc7vsInhIH8TPdgt
- TLSH
  T188D4F134A3380753CD5BFF3F540A4A61C8ED932580C99BA73A4C99E99C53663668B1CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Diagnostics/Comprehensive/Comprehensive.Tests.ps1
- Size 759B
- SHA256 1edbabd2ab521a579cf66ae26657bb4c0aa19e37ca5728bca794f54aa6e6fd18
- MD5 37037611b8d8035a889ff01694e0b5fe
- SHA1 36266741b98e8efc5d68761d722bbad75824dc1a
- SHA512 a05c8b47429cb7ecc7f79a9ac11474d2b182e9a53fd49d49509a657acb959e7770e877eef3873f2a6dd33ae732bf0ada27e0d2eb16f1233a2b255f47ef3d0477
- TLSH
  T11F01F21C65E8551E647F6BB7F40B904CFDB749736451A408368D96CC4F32C5D8693EC4
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Diagnostics/Simple/Simple.Tests.ps1
- Size 384B
- SHA256 20b58ed17ede1b1d679ded4b23400fb2468455ccf927b6fc88ae0955589e92b3
- MD5 bd5f7018096ec0b8e4b92af92d98cbaf
- SHA1 089db48ee781bd035f0bd6d59d0422c0d969eb8b
- SHA512 66cb22fed91c0a674c6be826dbc61ef2fac41eafecc653e2b1734abf4bc96ce4b0f35639a5ee477fad9804ba1d64e25e96ad2d8cfd89aa025db5f466e1eaf33d
- TLSH
  T199E0C04729EA052C87D92316FC932844F43246F75094B404B7FC08484F38FE8C651F58
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Microsoft.PowerShell.Operation.Validation.Format.ps1xml
- Size 3KB
- SHA256 31b1df552890e3765464c601e402c30c58ba96020794635bc550f2736d325f4a
- MD5 15d1ba4aff790ecc1ca05df9a662672b
- SHA1 8d5bb275586ff0ba3971a8c60076f936b89627b9
- SHA512 5923aafc04260db7ba3d91db7c8c0d3fcbb1cc2a611e1a1dcc9c61ffb176645383b28d3f591986442a462966cd9b15156fcde9a635a6fef23aa23009beae1834
- TLSH
  T14251295E52F02BF00DB24875E2DCA953CE65915B1C6682A4BACC075B1FF1C72A873936
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution ransomware adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Microsoft.PowerShell.Operation.Validation.psm1
- Size 12KB
- SHA256 1c834785aaae074189b7310207ef2aeaf99397d56249892840e20d14b49d8193
- MD5 e963db110505e5ed5e7c23123409ff38
- SHA1 422ae6a9d6bdb0c09a10d7e4220fa0e070395135
- SHA512 047a6e60cd14c1022b90ea80a3bbaecf630a3b8cdb61cff34aaf014a3147b4e22a883abf7c3b4f81d41f9204f3fb59eedb238f5bc900b23e447efac84748ca46
- SSDEEP 384:PdFRM3gk/GVedRIOtqtIYpX1WJ2rJ23qChHj32O6pTE:PdAgtIYpXYJ2rJ2aW
- TLSH
  T18B4272146686826689BB2B79FD638411FD39405F11681A14FDEC9AC13F72E30EA77F84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Microsoft.PowerShell.Operation.Validation.Tests.ps1
- Size 4KB
- SHA256 1c469a57bf49a7995f211c035f244d1fa538424cf2937006b85f20d46cc4a0d8
- MD5 030135152a7966a4323acd4f065bb925
- SHA1 a1c3eeef3992e9f5b0b0c3a1057902b98f1c141b
- SHA512 f92e905d95e4adac298d755bbe884cc61ab97208dcddc2a74aa18b57bcbc4aba4de1c91037ecc6ac8f2ea59993a11a82169b6928ec6b10d913d2c0d2c0153309
- SSDEEP 96:7YrzsszsyzsaKzsBHmL46kygP4JLBgLOzsf9zsdhQnnJo9zsQSAzsMvxzsDc:88z5aBHg46kyE4JLB6Nf2dmnnS2QKgig
- TLSH
  T186A1CF6873E802169C3B63B9F427A414E8F9D6B734085C11728CA7D82F36D69D693FC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Modules/Example1.Diagnostics/Diagnostics/Simple/Example1.Diagnostics.Tests.ps1
- Size 241B
- SHA256 85ec948f272eec9bbd24030105548d87b3f697002416ac4692e389d315cdd534
- MD5 af30dcc5efd4c2cfd486789fc8d103d2
- SHA1 b2c04a08e7050c36ab3962fc6fadb0bae501a484
- SHA512 a1003e5f707892f6f24f6b6bdd9d5f5ef2e340866a8d1d8faea4b5b2d32ae19305a3a29ec5c4fa7dd996b9feaf72887a595d7c37be17782a5bf062688aaf6aff
- TLSH
  T17FD0235153FD0A0B203013A5D44B5C34FC9347722471D903B93CBD543F3568E8050505
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Modules/Example2.Diagnostics/1.0.1/Diagnostics/Simple/Example2.Diagnostics.Tests.ps1
- Size 241B
- SHA256 85ec948f272eec9bbd24030105548d87b3f697002416ac4692e389d315cdd534
- MD5 af30dcc5efd4c2cfd486789fc8d103d2
- SHA1 b2c04a08e7050c36ab3962fc6fadb0bae501a484
- SHA512 a1003e5f707892f6f24f6b6bdd9d5f5ef2e340866a8d1d8faea4b5b2d32ae19305a3a29ec5c4fa7dd996b9feaf72887a595d7c37be17782a5bf062688aaf6aff
- TLSH
  T17FD0235153FD0A0B203013A5D44B5C34FC9347722471D903B93CBD543F3568E8050505
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Modules/Example3.Diagnostics/1.1.1/Diagnostics/Simple/Example3A.Diagnostics.Tests.ps1
- Size 241B
- SHA256 85ec948f272eec9bbd24030105548d87b3f697002416ac4692e389d315cdd534
- MD5 af30dcc5efd4c2cfd486789fc8d103d2
- SHA1 b2c04a08e7050c36ab3962fc6fadb0bae501a484
- SHA512 a1003e5f707892f6f24f6b6bdd9d5f5ef2e340866a8d1d8faea4b5b2d32ae19305a3a29ec5c4fa7dd996b9feaf72887a595d7c37be17782a5bf062688aaf6aff
- TLSH
  T17FD0235153FD0A0B203013A5D44B5C34FC9347722471D903B93CBD543F3568E8050505
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Modules/Example3.Diagnostics/2.0.1/Diagnostics/Simple/Example3B.Diagnostics.Tests.ps1
- Size 241B
- SHA256 85ec948f272eec9bbd24030105548d87b3f697002416ac4692e389d315cdd534
- MD5 af30dcc5efd4c2cfd486789fc8d103d2
- SHA1 b2c04a08e7050c36ab3962fc6fadb0bae501a484
- SHA512 a1003e5f707892f6f24f6b6bdd9d5f5ef2e340866a8d1d8faea4b5b2d32ae19305a3a29ec5c4fa7dd996b9feaf72887a595d7c37be17782a5bf062688aaf6aff
- TLSH
  T17FD0235153FD0A0B203013A5D44B5C34FC9347722471D903B93CBD543F3568E8050505
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  WindowsPowerShell/Modules/PackageManagement/1.0.0.1/DSCResources/MSFT_PackageManagement/MSFT_PackageManagement.psm1
- Size 13KB
- SHA256 bc0dabafd4a88903a8bd3cb092a4f27b8e3c13c3ce9be2070a3de1b204aade29
- MD5 4073882f5e10d9ed469c77ec1fabdfc1
- SHA1 5065ce8ec9268e02ca43ab37257ac1e7118e9eed
- SHA512 47ae50abe66712ea9495abe59d47694191edc7507eaf8cbacfb0034301a6bb01fefc9c5c5bd913667aafd0f698006126d0b04d661232fd98da2a2a567cf69c2a
- SSDEEP 192:vdTLrRdatR9eyqEZkZfZ7zmW2t9dTLrRdatR9e5VCQBodTLrRdatR9eCVCQBhkZA:fuEZfZMDTYQTAZfZHe
- TLSH
  T195521C2BAB81437517B207697C59A055C76C10BB7C3B0180F8ED81949F3BE68EB27E5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  WindowsPowerShell/Modules/PackageManagement/1.0.0.1/PackageManagement.format.ps1xml
- Size 16KB
- SHA256 122cd3d423250d65656aa955fc6ca168851a2a47c9892d6caa80469d32ad6c79
- MD5 99d084395aeb387a45205810db66b2e2
- SHA1 3bd9ad27577feb89f4d0493d51cfcc5cf989fcb7
- SHA512 5033aca6e32d561978590dde33d843e72b702c27104a935ba6775577631d62b619abd325a354894c994743768ab592ddebd3fdac890d9389b06426fc589e17e4
- SSDEEP 96:NDF47dHFfvosjcWjc5QLHjcbjcQQ55RjcyyjcyFQpgjcyHjcyMQLItjcyKjcymU5:vqdHupc0MZQZWbSf
- TLSH
  T1BF72740B63C476C20636C959AAAC6669CE25B15B1C2F7AB1F7DC930B1FB1D064233937
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  WindowsPowerShell/Modules/PackageManagement/1.0.0.1/PackageManagement.psd1
- Size 2KB
- SHA256 11e9ea86300e4cdb102d4fe15df389de7a256320e8a7cc6eccb7461a05dc2dfa
- MD5 f6f8fb50315acdc59c8899ba6d4b3fea
- SHA1 d6175afedf0d253632cd22539cf8da7ce5ef9085
- SHA512 c7d9086f88ce018065ebebad16308c6ac3a421bb500e9a6a7ce83123110c255456d8d44fad813dd94af77ffaf099deb6ec6f78bffa5b77ee3ac4bd6a61484a89
- TLSH
  T19541463E758E13236A7A4F8F3A2D884AE12D77A7345A46C1396E81640FB754783E70B4
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral29 behavioral30
- Target
  WindowsPowerShell/Modules/Pester/3.4.0/LICENSE
- Size 611B
- SHA256 e5502d101d67fb5a9fb70afdb0adff1bc7ef4b38b703631ab425f6d43da35f2c
- MD5 fdc69a81557defea97149cd0e8ef317d
- SHA1 052fdb4289a19016fbc34eeea668d32de1f9d667
- SHA512 27953b943333dc145542e01e8817e5ece1423430a4118eced787afed0ec44f1e6a9dca87776db1e4ae430354ff5be2b030c4c6bb4cf83616f4c30e0fcc5f9180
- TLSH
  T17BF0787D3A85277327E085CB7E0B948FE349D66A214AA349385982980B3D29A55F82F0
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Checks computer location settings

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32