Overview

overview

10

Static

static

10

Documents 5.zip

windows10-2004-x64

1

Documents 5.zip

windows11-ltsc_2024-x64

1

DOS - Wind...gs.zip

windows10-2004-x64

1

DOS - Wind...gs.zip

windows11-ltsc_2024-x64

8

Dos - Wind...ll.zip

windows10-2004-x64

1

Dos - Wind...ll.zip

windows11-ltsc_2024-x64

1

WindowsPow...ts.ps1

windows10-2004-x64

6

WindowsPow...ts.ps1

windows11-ltsc_2024-x64

6

WindowsPow...ts.ps1

windows10-2004-x64

6

WindowsPow...ts.ps1

windows11-ltsc_2024-x64

6

WindowsPow...ps1xml

windows10-2004-x64

7

WindowsPow...ps1xml

windows11-ltsc_2024-x64

8

WindowsPow...on.ps1

windows10-2004-x64

6

WindowsPow...on.ps1

windows11-ltsc_2024-x64

8

WindowsPow...l..ps1

windows10-2004-x64

6

WindowsPow...l..ps1

windows11-ltsc_2024-x64

8

WindowsPow...ag.ps1

windows10-2004-x64

6

WindowsPow...ag.ps1

windows11-ltsc_2024-x64

8

WindowsPow...ag.ps1

windows10-2004-x64

6

WindowsPow...ag.ps1

windows11-ltsc_2024-x64

6

WindowsPow...ag.ps1

windows10-2004-x64

6

WindowsPow...ag.ps1

windows11-ltsc_2024-x64

6

WindowsPow...ag.ps1

windows10-2004-x64

6

WindowsPow...ag.ps1

windows11-ltsc_2024-x64

6

WindowsPow...nt.ps1

windows10-2004-x64

6

WindowsPow...nt.ps1

windows11-ltsc_2024-x64

6

WindowsPow...at.xml

windows10-2004-x64

3

WindowsPow...at.xml

windows11-ltsc_2024-x64

8

WindowsPow...t.psd1

windows10-2004-x64

1

WindowsPow...t.psd1

windows11-ltsc_2024-x64

1

WindowsPow...ICENSE

windows10-2004-x64

3

WindowsPow...ICENSE

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    Documents 5.zip
  • Size 240.9MB
  • Sample260930-alaeesserb
  • SHA256 04db39659104b1a6b6a96f7ae7d65d977d34b14cbfa4372de843e757590b901f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
revoked_codesignransomwarestealerkeyloggersnakekeyloggeravaddon

Malware Config

Extracted

  • avaddon

Ransom Note
  • Sep 15 02:47:10 ASUS/192.168.1.250 THOR: Notice: MODULE: Init MESSAGE: Some modules and features are not available in Lite version and will be disabled SCANID: S-4txoEDTou1s Sep 15 02:47:10 ASUS/192.168.1.250 THOR: Notice: MODULE: Startup MESSAGE: This THOR Lite license permits non-commercial use only. It is strictly prohibited to sell THOR Lite or sell services that include the use of THOR Lite. For details, see the EULA in the ./docs folder. For a special license that covers these cases, allows Sigma scanning and suppresses this message, please contact our sales via https://www.nextron-systems.com/get-started/ SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Version: 10.7.32 SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Build: 1cabaee8cbc5 (2026-09-09 10:00:28) SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Run on system: ASUS SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Running as user: ASUS\micro SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Netbios Domain: ASUS SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: User has admin rights: yes SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Working Directory: C:\thor-lite-windows_10.7.29 SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Scan started SCANID: S-4txoEDTou1s START_TIME: Mon Sep 14 20:47:16 2026 HOSTNAME: ASUS Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Effective argument list: [--allhds --alldrives --follow-symlinks --max-nested-objects 100000 --intense --nocpulimit --norescontrol --force-max-file-size --allfiles --c2-in-memory --full-proc-integrity --resume --vtkey 126e0... --vtmode full --vtscore 30 --vtaccepteula --vtwaitforquota] SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Platform: Windows 11 Home SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Platform DeepEval SCANID: S-4txoEDTou1s NAME: Windows 11 Home TYPE: Multiprocessor Free VERSION: 6.3 PROC: Intel64 Family 6 Model 122 Stepping 8 ARCH: AMD64 INSTALLED_ON: Thu Apr 23 01:54:08 2026 BUILD_NUMBER: 26200 Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Language: en-CA, Zone: MDT SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: System Uptime: 0.27 days SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: CPU Count: 2 SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Memory in Megabyte: 3918 SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Signature Database: 1.260911.111518 SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Successfully compiled 0 false positive filters SCANID: S-4txoEDTou1s TYPE: log filter Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing report file to: ASUS_thor_2026-09-14_2047.txt SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing csv report file to: ASUS_files_md5s.csv SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: No json report file will be written SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing html report file to: ASUS_thor_2026-09-14_2047.html SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Syslog Export: off SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: IP Address 1: 192.168.1.250 SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: ScanID: S-4txoEDTou1s SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: System is not a domain controller SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Intense Scan Mode SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Max. file size to be scanned is 209.7 MB, use --max_file_size to increase the limit SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Selected modules: AtJobs, Autoruns, DNSCache, EnvCheck, EtwWatcher, Eventlog, Events, Filescan, Firewall, Hosts, HotfixCheck, LSASessions, LoggedIn, MFT, Mutex, NetworkSessions, NetworkShares, Pipes, ProcessCheck, RegistryChecks, Rootkit, SHIMCache, ScheduledTasks, ServiceCheck, Timestomp, UserDir, Users, WMIStartup SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Deselected modules: Artifact-Collector, DeepDive, Dropzone, Thunderstorm SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Selected features: Amcache, Archive, ArchiveScan, AtJobs, Auditlog, AuthorizedKeys, Bifrost2, BulkScan, C2, CheckString, CronParser, DoublePulsar, DumpScan, ETL, EVTX, Eml, EnrichFileInfo, ExeDecompress, FilenameIOCs, Filescan, GroupsXML, KeywordIOCs, Lnk, LogScan, Logger, MagicHeader, OLE, ParseCobaltStrike, Prefetch, ProcessConnections, ProcessHandles, ProcessIntegrity, ProgressTracker, RecycleBin, RegistryHive, SHIMCache, Sigma, SignalHandler, Stix, TeamViewer, ThorDB, VirusTotal, VulnerabilityCheck, WER, WMIPersistence, WebdirScan, WorkerProgressTracker, Yara SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Deselected features: Action, AuditTrail, AuditTrailWriter, Bifrost, CPULimit, Rescontrol SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: System Type: Workstation SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: License file found SCANID: S-4txoEDTou1s LICENSE: 8cbc51cde68eeb54202cdcb836ff5680_5a3bb052dcf94229a61dbffb25755169.lic OWNER: [email protected] TYPE: Lite STARTS: 2026/03/18 EXPIRES: 2026/09/18 SCANNER: THOR Lite VALID: true Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Firewall due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module HotfixCheck due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module RegistryChecks due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module EtwWatcher due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Eventlog due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Users due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Hosts due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module UserDir due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module EnvCheck due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module LSASessions due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module WMIStartup due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module SHIMCache due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module DNSCache due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module NetworkSessions due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module MFT due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Rootkit due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module NetworkShares due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module LoggedIn due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Mutex due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Pipes due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module ScheduledTasks due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module ServiceCheck due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Timestomp due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module AtJobs due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Events due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature VulnerabilityCheck due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature AtJobs due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature AuthorizedKeys due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Lnk due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature OLE due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Sigma due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature SignalHandler due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature CronParser due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Eml due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WebdirScan due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WMIPersistence due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature MagicHeader due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature ProgressTracker due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Logger due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Prefetch due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature RegistryHive due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature VirusTotal due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WorkerProgressTracker due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Auditlog due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Stix due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature TeamViewer due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Amcache due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Bifrost2 due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature BulkScan due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature EVTX due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature ExeDecompress due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature GroupsXML due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature RecycleBin due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature DoublePulsar due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature SHIMCache due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WER due to Lite version SCANID: S-4txoEDTou1s Sep 15 02:47:16 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-all.yas as 'default' type SCANID: S-4txoEDTou1s Sep 15 02:47:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-deepscan-selectors.yasx as 'meta' type SCANID: S-4txoEDTou1s Sep 15 02:47:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-keywords.yas as 'keyword' type SCANID: S-4txoEDTou1s Sep 15 02:47:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-log-sigs.yas as 'log' type SCANID: S-4txoEDTou1s Sep 15 02:47:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-meta.yas as 'meta' type SCANID: S-4txoEDTou1s Sep 15 02:47:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-peids.yas as 'default' type SCANID: S-4txoEDTou1s Sep 15 02:47:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-process-memory-sigs.yas as 'process' type SCANID: S-4txoEDTou1s Sep 15 02:47:22 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-registry.yas as 'registry' type SCANID: S-4txoEDTou1s Sep 15 02:47:22 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact32_and_resources_dropper_v1_45_to_v4_x.yara as 'default' and 'custom' type SCANID: S-4txoEDTou1s Sep 15 02:47:22 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact32svc_exe_v1_49_to_v4_x.yara as 'default' and 'custom' type SCANID: S-4txoEDTou1s Sep 15 02:47:22 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact64_v1_49_to_v4_x.yara as 'default' and 'custom' type SCANID: S-4txoEDTou1s Sep 15 02:47:22 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_beacon_dll_all_versions_memenabled.yara as 'default' and 'custom' type SCANID: S-4txoEDTou1s Sep 15 02:47:22 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_bind64_bin_v2_5_through_v4_x.yara as 'default' and 'custom' type SCANID
URLs

  • https://www.nextron-systems.com/get-started/

Extracted

  • avaddon

Ransom Note
  • Sep 16 09:08:47 ASUS/192.168.1.250 THOR: Notice: MODULE: Init MESSAGE: Some modules and features are not available in Lite version and will be disabled SCANID: S-acir1xbb1io Sep 16 09:08:47 ASUS/192.168.1.250 THOR: Notice: MODULE: Startup MESSAGE: This THOR Lite license permits non-commercial use only. It is strictly prohibited to sell THOR Lite or sell services that include the use of THOR Lite. For details, see the EULA in the ./docs folder. For a special license that covers these cases, allows Sigma scanning and suppresses this message, please contact our sales via https://www.nextron-systems.com/get-started/ SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Version: 10.7.32 SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Build: 1cabaee8cbc5 (2026-09-09 10:00:28) SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Run on system: ASUS SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Running as user: ASUS\micro SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Netbios Domain: ASUS SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: User has admin rights: yes SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Working Directory: C:\thor-lite-windows_10.7.29 SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Scan started SCANID: S-acir1xbb1io START_TIME: Wed Sep 16 03:08:52 2026 HOSTNAME: ASUS Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Effective argument list: [--allhds --alldrives --follow-symlinks --max-nested-objects 100000 --intense --nocpulimit --norescontrol --force-max-file-size --allfiles --c2-in-memory --full-proc-integrity --resume --vtkey 126e0... --vtmode full --vtscore 30 --vtaccepteula --vtwaitforquota] SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Platform: Windows 11 Home SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Platform DeepEval SCANID: S-acir1xbb1io NAME: Windows 11 Home TYPE: Multiprocessor Free VERSION: 6.3 PROC: Intel64 Family 6 Model 122 Stepping 8 ARCH: AMD64 INSTALLED_ON: Thu Apr 23 01:54:08 2026 BUILD_NUMBER: 26200 Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Language: en-CA, Zone: MDT SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: System Uptime: 0.01 days SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: CPU Count: 2 SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Memory in Megabyte: 3918 SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Signature Database: 1.260911.111518 SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Successfully compiled 0 false positive filters SCANID: S-acir1xbb1io TYPE: log filter Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing report file to: ASUS_thor_2026-09-16_0308.txt SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing csv report file to: ASUS_files_md5s.csv SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: No json report file will be written SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing html report file to: ASUS_thor_2026-09-16_0308.html SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Syslog Export: off SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: IP Address 1: 192.168.1.250 SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: ScanID: S-acir1xbb1io SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: System is not a domain controller SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Intense Scan Mode SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Max. file size to be scanned is 209.7 MB, use --max_file_size to increase the limit SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Selected modules: AtJobs, Autoruns, DNSCache, EnvCheck, EtwWatcher, Eventlog, Events, Filescan, Firewall, Hosts, HotfixCheck, LSASessions, LoggedIn, MFT, Mutex, NetworkSessions, NetworkShares, Pipes, ProcessCheck, RegistryChecks, Rootkit, SHIMCache, ScheduledTasks, ServiceCheck, Timestomp, UserDir, Users, WMIStartup SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Deselected modules: Artifact-Collector, DeepDive, Dropzone, Thunderstorm SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Selected features: Amcache, Archive, ArchiveScan, AtJobs, Auditlog, AuthorizedKeys, Bifrost2, BulkScan, C2, CheckString, CronParser, DoublePulsar, DumpScan, ETL, EVTX, Eml, EnrichFileInfo, ExeDecompress, FilenameIOCs, Filescan, GroupsXML, KeywordIOCs, Lnk, LogScan, Logger, MagicHeader, OLE, ParseCobaltStrike, Prefetch, ProcessConnections, ProcessHandles, ProcessIntegrity, ProgressTracker, RecycleBin, RegistryHive, SHIMCache, Sigma, SignalHandler, Stix, TeamViewer, ThorDB, VirusTotal, VulnerabilityCheck, WER, WMIPersistence, WebdirScan, WorkerProgressTracker, Yara SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Deselected features: Action, AuditTrail, AuditTrailWriter, Bifrost, CPULimit, Rescontrol SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: System Type: Workstation SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: License file found SCANID: S-acir1xbb1io LICENSE: C:\thor-lite-windows_10.7.29\8cbc51cde68eeb54202cdcb836ff5680_5a3bb052dcf94229a61dbffb25755169.lic OWNER: [email protected] TYPE: Lite STARTS: 2026/03/18 EXPIRES: 2026/09/18 SCANNER: THOR Lite VALID: true Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Hosts due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module NetworkShares due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module SHIMCache due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Events due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Pipes due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Rootkit due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Timestomp due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module EtwWatcher due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Firewall due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module NetworkSessions due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module AtJobs due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module DNSCache due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Mutex due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Users due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module EnvCheck due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module HotfixCheck due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module LSASessions due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module LoggedIn due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module MFT due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module RegistryChecks due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Eventlog due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module ServiceCheck due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module UserDir due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module WMIStartup due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module ScheduledTasks due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature ProgressTracker due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Bifrost2 due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature CronParser due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature ExeDecompress due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Logger due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature SHIMCache due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Sigma due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature TeamViewer due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature VulnerabilityCheck due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WebdirScan due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WorkerProgressTracker due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature SignalHandler due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Amcache due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature AuthorizedKeys due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature EVTX due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature OLE due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature RecycleBin due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Eml due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Prefetch due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WER due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature GroupsXML due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Lnk due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature AtJobs due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature DoublePulsar due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature VirusTotal due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Auditlog due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature BulkScan due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature MagicHeader due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature RegistryHive due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Stix due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WMIPersistence due to Lite version SCANID: S-acir1xbb1io Sep 16 09:08:52 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-all.yas as 'default' type SCANID: S-acir1xbb1io Sep 16 09:08:57 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-deepscan-selectors.yasx as 'meta' type SCANID: S-acir1xbb1io Sep 16 09:08:57 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-keywords.yas as 'keyword' type SCANID: S-acir1xbb1io Sep 16 09:08:57 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-log-sigs.yas as 'log' type SCANID: S-acir1xbb1io Sep 16 09:08:58 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-meta.yas as 'meta' type SCANID: S-acir1xbb1io Sep 16 09:08:58 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-peids.yas as 'default' type SCANID: S-acir1xbb1io Sep 16 09:08:58 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-process-memory-sigs.yas as 'process' type SCANID: S-acir1xbb1io Sep 16 09:08:59 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-registry.yas as 'registry' type SCANID: S-acir1xbb1io Sep 16 09:08:59 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact32_and_resources_dropper_v1_45_to_v4_x.yara as 'default' and 'custom' type SCANID: S-acir1xbb1io Sep 16 09:08:59 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact32svc_exe_v1_49_to_v4_x.yara as 'default' and 'custom' type SCANID: S-acir1xbb1io Sep 16 09:08:59 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact64_v1_49_to_v4_x.yara as 'default' and 'custom' type SCANID: S-acir1xbb1io Sep 16 09:08:59 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_beacon_dll_all_versions_memenabled.yara as 'default' and 'custom' type SCANID: S-acir1xbb1io Sep 16 09:08:59 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_bind64_bin_v2_5_through_v4_x.yara as 'defa
URLs

  • https://www.nextron-systems.com/get-started/

Extracted

  • avaddon

Ransom Note
  • Sep 18 08:08:15 ASUS/192.168.1.250 THOR: Notice: MODULE: Init MESSAGE: Some modules and features are not available in Lite version and will be disabled SCANID: S-fDcCOfEOshg Sep 18 08:08:15 ASUS/192.168.1.250 THOR: Notice: MODULE: Startup MESSAGE: This THOR Lite license permits non-commercial use only. It is strictly prohibited to sell THOR Lite or sell services that include the use of THOR Lite. For details, see the EULA in the ./docs folder. For a special license that covers these cases, allows Sigma scanning and suppresses this message, please contact our sales via https://www.nextron-systems.com/get-started/ SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Version: 10.7.32 SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Build: 1cabaee8cbc5 (2026-09-09 10:00:28) SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Run on system: ASUS SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Running as user: ASUS\micro SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Netbios Domain: ASUS SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: User has admin rights: yes SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Working Directory: C:\thor-lite-windows_10.7.29 SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Scan started SCANID: S-fDcCOfEOshg START_TIME: Fri Sep 18 02:08:20 2026 HOSTNAME: ASUS Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Effective argument list: [--allhds --alldrives --follow-symlinks --max-nested-objects 100000 --intense --nocpulimit --norescontrol --force-max-file-size --allfiles --c2-in-memory --full-proc-integrity --resume --vtkey 126e0... --vtmode full --vtscore 30 --vtaccepteula --vtwaitforquota] SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Platform: Windows 11 Home SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Platform DeepEval SCANID: S-fDcCOfEOshg NAME: Windows 11 Home TYPE: Multiprocessor Free VERSION: 6.3 PROC: Intel64 Family 6 Model 122 Stepping 8 ARCH: AMD64 INSTALLED_ON: Thu Apr 23 01:54:08 2026 BUILD_NUMBER: 26200 Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Language: en-CA, Zone: MDT SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: System Uptime: 1.97 days SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: CPU Count: 2 SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Memory in Megabyte: 3918 SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Signature Database: 1.260911.111518 SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Successfully compiled 0 false positive filters SCANID: S-fDcCOfEOshg TYPE: log filter Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing report file to: ASUS_thor_2026-09-18_0208.txt SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing csv report file to: ASUS_files_md5s.csv SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: No json report file will be written SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing html report file to: ASUS_thor_2026-09-18_0208.html SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Syslog Export: off SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: IP Address 1: 192.168.1.250 SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: ScanID: S-fDcCOfEOshg SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: System is not a domain controller SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Intense Scan Mode SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Max. file size to be scanned is 209.7 MB, use --max_file_size to increase the limit SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Selected modules: AtJobs, Autoruns, DNSCache, EnvCheck, EtwWatcher, Eventlog, Events, Filescan, Firewall, Hosts, HotfixCheck, LSASessions, LoggedIn, MFT, Mutex, NetworkSessions, NetworkShares, Pipes, ProcessCheck, RegistryChecks, Rootkit, SHIMCache, ScheduledTasks, ServiceCheck, Timestomp, UserDir, Users, WMIStartup SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Deselected modules: Artifact-Collector, DeepDive, Dropzone, Thunderstorm SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Selected features: Amcache, Archive, ArchiveScan, AtJobs, Auditlog, AuthorizedKeys, Bifrost2, BulkScan, C2, CheckString, CronParser, DoublePulsar, DumpScan, ETL, EVTX, Eml, EnrichFileInfo, ExeDecompress, FilenameIOCs, Filescan, GroupsXML, KeywordIOCs, Lnk, LogScan, Logger, MagicHeader, OLE, ParseCobaltStrike, Prefetch, ProcessConnections, ProcessHandles, ProcessIntegrity, ProgressTracker, RecycleBin, RegistryHive, SHIMCache, Sigma, SignalHandler, Stix, TeamViewer, ThorDB, VirusTotal, VulnerabilityCheck, WER, WMIPersistence, WebdirScan, WorkerProgressTracker, Yara SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Deselected features: Action, AuditTrail, AuditTrailWriter, Bifrost, CPULimit, Rescontrol SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: System Type: Workstation SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: License file found SCANID: S-fDcCOfEOshg LICENSE: C:\thor-lite-windows_10.7.29\8cbc51cde68eeb54202cdcb836ff5680_5a3bb052dcf94229a61dbffb25755169.lic OWNER: [email protected] TYPE: Lite STARTS: 2026/03/18 EXPIRES: 2026/09/18 SCANNER: THOR Lite VALID: true Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module NetworkShares due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module HotfixCheck due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Pipes due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Hosts due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Users due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module LSASessions due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Firewall due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module ScheduledTasks due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module WMIStartup due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module EnvCheck due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module NetworkSessions due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module RegistryChecks due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module SHIMCache due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Timestomp due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Events due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module EtwWatcher due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Eventlog due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module MFT due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Rootkit due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module ServiceCheck due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module DNSCache due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Mutex due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module UserDir due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module AtJobs due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module LoggedIn due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature VirusTotal due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WMIPersistence due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature AuthorizedKeys due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature BulkScan due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature RecycleBin due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Sigma due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Auditlog due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Prefetch due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature VulnerabilityCheck due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Lnk due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature OLE due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WorkerProgressTracker due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WER due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature CronParser due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature ExeDecompress due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature GroupsXML due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature MagicHeader due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature ProgressTracker due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature SHIMCache due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature SignalHandler due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature DoublePulsar due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Logger due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WebdirScan due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Stix due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature TeamViewer due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature AtJobs due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature EVTX due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Eml due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature RegistryHive due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Amcache due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Bifrost2 due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-all.yas as 'default' type SCANID: S-fDcCOfEOshg Sep 18 08:08:26 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-deepscan-selectors.yasx as 'meta' type SCANID: S-fDcCOfEOshg Sep 18 08:08:26 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-keywords.yas as 'keyword' type SCANID: S-fDcCOfEOshg Sep 18 08:08:26 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-log-sigs.yas as 'log' type SCANID: S-fDcCOfEOshg Sep 18 08:08:26 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-meta.yas as 'meta' type SCANID: S-fDcCOfEOshg Sep 18 08:08:26 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-peids.yas as 'default' type SCANID: S-fDcCOfEOshg Sep 18 08:08:26 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-process-memory-sigs.yas as 'process' type SCANID: S-fDcCOfEOshg Sep 18 08:08:27 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-registry.yas as 'registry' type SCANID: S-fDcCOfEOshg Sep 18 08:08:27 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact32_and_resources_dropper_v1_45_to_v4_x.yara as 'default' and 'custom' type SCANID: S-fDcCOfEOshg Sep 18 08:08:27 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact32svc_exe_v1_49_to_v4_x.yara as 'default' and 'custom' type SCANID: S-fDcCOfEOshg Sep 18 08:08:28 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact64_v1_49_to_v4_x.yara as 'default' and 'custom' type SCANID: S-fDcCOfEOshg Sep 18 08:08:28 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_beacon_dll_all_versions_memenabled.yara as 'default' and 'custom' type SCANID: S-fDcCOfEOshg Sep 18 08:08:28 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_bind64_bin_v2_5_through_v4_x.yara as 'defa
URLs

  • https://www.nextron-systems.com/get-started/

Extracted

  • avaddon

Ransom Note
  • Sep 15 23:49:17 ASUS/192.168.1.250 THOR: Notice: MODULE: Init MESSAGE: Some modules and features are not available in Lite version and will be disabled SCANID: S-xu1tfadk3bg Sep 15 23:49:17 ASUS/192.168.1.250 THOR: Notice: MODULE: Startup MESSAGE: This THOR Lite license permits non-commercial use only. It is strictly prohibited to sell THOR Lite or sell services that include the use of THOR Lite. For details, see the EULA in the ./docs folder. For a special license that covers these cases, allows Sigma scanning and suppresses this message, please contact our sales via https://www.nextron-systems.com/get-started/ SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Version: 10.7.32 SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Build: 1cabaee8cbc5 (2026-09-09 10:00:28) SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Run on system: ASUS SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Running as user: ASUS\micro SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Netbios Domain: ASUS SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: User has admin rights: yes SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Working Directory: C:\thor-lite-windows_10.7.29 SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Scan started SCANID: S-xu1tfadk3bg START_TIME: Tue Sep 15 17:49:22 2026 HOSTNAME: ASUS Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Effective argument list: [--resume] SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Platform: Windows 11 Home SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Platform DeepEval SCANID: S-xu1tfadk3bg NAME: Windows 11 Home TYPE: Multiprocessor Free VERSION: 6.3 PROC: Intel64 Family 6 Model 122 Stepping 8 ARCH: AMD64 INSTALLED_ON: Thu Apr 23 01:54:08 2026 BUILD_NUMBER: 26200 Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Language: en-CA, Zone: MDT SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: System Uptime: 0.05 days SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: CPU Count: 2 SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Memory in Megabyte: 3918 SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Signature Database: 1.260911.111518 SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Successfully compiled 0 false positive filters SCANID: S-xu1tfadk3bg TYPE: log filter Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing report file to: ASUS_thor_2026-09-15_1749.txt SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing csv report file to: ASUS_files_md5s.csv SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: No json report file will be written SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing html report file to: ASUS_thor_2026-09-15_1749.html SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Syslog Export: off SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: IP Address 1: 192.168.1.250 SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: ScanID: S-xu1tfadk3bg SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: System is not a domain controller SCANID: S-xu1tfadk3bg Sep 15 23:49:22 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Max. file size to be scanned is 31.5 MB, use --max_file_size to increase the limit SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Selected modules: AtJobs, Autoruns, DNSCache, EnvCheck, EtwWatcher, Eventlog, Events, Filescan, Firewall, Hosts, HotfixCheck, LSASessions, LoggedIn, Mutex, NetworkSessions, NetworkShares, Pipes, ProcessCheck, RegistryChecks, Rootkit, SHIMCache, ScheduledTasks, ServiceCheck, Timestomp, UserDir, Users, WMIStartup SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Deselected modules: Artifact-Collector, DeepDive, Dropzone, MFT, Thunderstorm SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Selected features: Amcache, Archive, ArchiveScan, AtJobs, Auditlog, AuthorizedKeys, Bifrost2, BulkScan, C2, CPULimit, CheckString, CronParser, DoublePulsar, ETL, EVTX, Eml, EnrichFileInfo, ExeDecompress, FilenameIOCs, Filescan, GroupsXML, KeywordIOCs, Lnk, LogScan, Logger, MagicHeader, OLE, ParseCobaltStrike, Prefetch, ProcessConnections, ProcessHandles, ProgressTracker, RecycleBin, RegistryHive, Rescontrol, SHIMCache, Sigma, SignalHandler, Stix, TeamViewer, ThorDB, VirusTotal, VulnerabilityCheck, WER, WMIPersistence, WebdirScan, WorkerProgressTracker, Yara SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Deselected features: Action, AuditTrail, AuditTrailWriter, Bifrost, DumpScan, ProcessIntegrity SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: System Type: Workstation SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: License file found SCANID: S-xu1tfadk3bg LICENSE: 8cbc51cde68eeb54202cdcb836ff5680_5a3bb052dcf94229a61dbffb25755169.lic OWNER: [email protected] TYPE: Lite STARTS: 2026/03/18 EXPIRES: 2026/09/18 SCANNER: THOR Lite VALID: true Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module RegistryChecks due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module UserDir due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Eventlog due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module LoggedIn due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module NetworkShares due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Events due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Rootkit due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Timestomp due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module LSASessions due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Pipes due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module SHIMCache due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Users due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module NetworkSessions due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Hosts due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module HotfixCheck due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module WMIStartup due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module AtJobs due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Firewall due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module ScheduledTasks due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Mutex due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module ServiceCheck due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module DNSCache due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module EnvCheck due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module EtwWatcher due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature ExeDecompress due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature DoublePulsar due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature ProgressTracker due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature SHIMCache due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature GroupsXML due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature RegistryHive due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature VirusTotal due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WebdirScan due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Sigma due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature VulnerabilityCheck due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature AtJobs due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature OLE due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WorkerProgressTracker due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Logger due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Stix due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WER due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WMIPersistence due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature BulkScan due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Prefetch due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Lnk due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature RecycleBin due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature SignalHandler due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature TeamViewer due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Amcache due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature CronParser due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature EVTX due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Eml due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature MagicHeader due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Auditlog due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature AuthorizedKeys due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Bifrost2 due to Lite version SCANID: S-xu1tfadk3bg Sep 15 23:49:23 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-all.yas as 'default' type SCANID: S-xu1tfadk3bg Sep 15 23:49:31 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-deepscan-selectors.yasx as 'meta' type SCANID: S-xu1tfadk3bg Sep 15 23:49:31 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-keywords.yas as 'keyword' type SCANID: S-xu1tfadk3bg Sep 15 23:49:31 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-log-sigs.yas as 'log' type SCANID: S-xu1tfadk3bg Sep 15 23:49:31 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-meta.yas as 'meta' type SCANID: S-xu1tfadk3bg Sep 15 23:49:31 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-peids.yas as 'default' type SCANID: S-xu1tfadk3bg Sep 15 23:49:31 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-process-memory-sigs.yas as 'process' type SCANID: S-xu1tfadk3bg Sep 15 23:49:33 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-registry.yas as 'registry' type SCANID: S-xu1tfadk3bg Sep 15 23:49:33 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact32_and_resources_dropper_v1_45_to_v4_x.yara as 'default' and 'custom' type SCANID: S-xu1tfadk3bg Sep 15 23:49:33 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact32svc_exe_v1_49_to_v4_x.yara as 'default' and 'custom' type SCANID: S-xu1tfadk3bg Sep 15 23:49:33 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact64_v1_49_to_v4_x.yara as 'default' and 'custom' type SCANID: S-xu1tfadk3bg Sep 15 23:49:33 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_beacon_dll_all_versions_memenabled.yara as 'default' and 'custom' type SCANID: S-xu1tfadk3bg Sep 15 23:49:34 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_bind64_bin_v2_5_through_v4_x.yara as 'default' and 'custom' type SCANID: S-xu1tfadk3bg Sep 15 23:49:34 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_bind_bin_v2_5_through_v4_x.yara as 'default' and 'custom' type SCANID: S-xu1tfadk3bg Sep 15 23:49:34 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_browserpivot_bin_v1_48_to_v3_14_and_sleeve_browserpivot_dll_v4_0_to_v4_x.yara as 'default' and 'custom' type SCANID: S-xu1tfadk3bg Sep 15 23:49:35 ASUS/192.168.1.25
URLs

  • https://www.nextron-systems.com/get-started/

Signatures

  • Family: Avaddon

    Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.

    ransomwareavaddon
  • Family: Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Revoked Certificate in Chain 1 IoCs

    One or more certificates in the signing chain have been revoked, indicating potential compromise.

    revoked_codesign
  • Unsigned PE 16 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • Documents 5.zip
    .zip 240.9MB
  • DOS - Windows Logs Admin Events and Pics of things.zip
    .zip 743KB
  • DNS Probe Possible on page I didn't look up.png
    .png 23KB
  • Edge Updater.png
    .png 82KB
  • Err Name not resolved.png
    .png 90KB
  • Err Network Change.png
    .png 84KB
  • Self Cert 1.png
    .png 100KB
  • Self Cert 2.png
    .png 107KB
  • Self Cert Dunno wut but in Exploit Protect Overide.png
    .png 150KB
  • Typical Stage 1 Internet out everything fucky.png
    .png 260KB
  • Windows Logs - Administrative Events.xml
    12KB
  • Dos - WindowsPowerShell.zip
    .zip 637KB
  • WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Diagnostics/Comprehensive/Comprehensive.Tests.ps1
    759B
  • WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Diagnostics/Simple/Simple.Tests.ps1
    .ps1 384B
  • WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Microsoft.PowerShell.Operation.Validation.Format.ps1xml
    3KB
  • WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Microsoft.PowerShell.Operation.Validation.psd1
    1KB
  • WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Microsoft.PowerShell.Operation.Validation.psm1
    .ps1 12KB
  • WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/OperationValidationResources.psd1
    347B
  • WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Microsoft.PowerShell.Operation.Validation.Tests.ps1
    4KB
  • WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Modules/Example1.Diagnostics/Diagnostics/Simple/Example1.Diagnostics.Tests.ps1
    241B
  • WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Modules/Example2.Diagnostics/1.0.1/Diagnostics/Simple/Example2.Diagnostics.Tests.ps1
    241B
  • WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Modules/Example2.Diagnostics/1.0.1/Example2.Diagnostics.psd1
    579B
  • WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Modules/Example3.Diagnostics/1.1.1/Diagnostics/Simple/Example3A.Diagnostics.Tests.ps1
    241B
  • WindowsPowerShell/Modules/Microsoft.PowerShell.Operation.Validation/1.0.1/Test/Modules/Example3.Diagnostics/2.0.1/Diagnostics/Simple/Example3B.Diagnostics.Tests.ps1
    241B
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/DSCResources/MSFT_PackageManagement/MSFT_PackageManagement.psm1
    .ps1 13KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/DSCResources/MSFT_PackageManagement/MSFT_PackageManagement.schema.mof
    1KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/DSCResources/MSFT_PackageManagement/en-US/MSFT_PackageManagement.schema.mfl
    1KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/DSCResources/MSFT_PackageManagement/en-US/MSFT_PackageManagement.strings.psd1
    1KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/DSCResources/MSFT_PackageManagementSource/MSFT_PackageManagementSource.psm1
    .ps1 23KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/DSCResources/MSFT_PackageManagementSource/MSFT_PackageManagementSource.schema.mof
    960B
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/DSCResources/MSFT_PackageManagementSource/en-US/MSFT_PackageManagementSource.schema.mfl
    1KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/DSCResources/MSFT_PackageManagementSource/en-US/MSFT_PackageManagementSource.strings.psd1
    3KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/DSCResources/PackageManagementDscUtilities.psm1
    .ps1 9KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/DSCResources/en-US/PackageManagementDscUtilities.strings.psd1
    1KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/Microsoft.PackageManagement.ArchiverProviders.dll
    .dll 69KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/Microsoft.PackageManagement.CoreProviders.dll
    .dll 58KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/Microsoft.PackageManagement.MetaProvider.PowerShell.dll
    .dll 66KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/Microsoft.PackageManagement.MsiProvider.dll
    .dll 230KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/Microsoft.PackageManagement.MsuProvider.dll
    .dll 14KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/Microsoft.PackageManagement.dll
    .dll 247KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/Microsoft.PowerShell.PackageManagement.dll
    .dll 160KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/PackageManagement.format.ps1xml
    .xml 16KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/PackageManagement.psd1
    2KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/PackageProviderFunctions.psm1
    .ps1 10KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/en/Microsoft.PackageManagement.ArchiverProviders.resources.dll
    .dll 4KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/en/Microsoft.PackageManagement.CoreProviders.resources.dll
    .dll 6KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/en/Microsoft.PackageManagement.MetaProvider.PowerShell.resources.dll
    .dll 6KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/en/Microsoft.PackageManagement.MsiProvider.resources.dll
    .dll 4KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/en/Microsoft.PackageManagement.MsuProvider.resources.dll
    .dll 4KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/en/Microsoft.PackageManagement.resources.dll
    .dll 12KB
  • WindowsPowerShell/Modules/PackageManagement/1.0.0.1/en/Microsoft.PowerShell.PackageManagement.resources.dll
    .dll 17KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Build.bat
    744B
  • WindowsPowerShell/Modules/Pester/3.4.0/CHANGELOG.md
    .ps1 14KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Examples/Calculator/Add-Numbers.Tests.ps1
    606B
  • WindowsPowerShell/Modules/Pester/3.4.0/Examples/Calculator/Add-Numbers.ps1
    55B
  • WindowsPowerShell/Modules/Pester/3.4.0/Examples/Validator/Validator.Tests.ps1
    .ps1 822B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/Be.Tests.ps1
    3KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/Be.ps1
    .ps1 4KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/BeGreaterThan.Tests.ps1
    511B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/BeGreaterThan.ps1
    374B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/BeLessThan.Tests.ps1
    494B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/BeLessThan.ps1
    365B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/BeLike.Tests.ps1
    489B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/BeLike.ps1
    389B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/BeLikeExactly.Tests.ps1
    508B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/BeLikeExactly.ps1
    413B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/BeNullOrEmpty.Tests.ps1
    474B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/BeNullOrEmpty.ps1
    .ps1 579B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/BeOfType.Tests.ps1
    691B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/BeOfType.ps1
    1KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/Contain.Tests.ps1
    1004B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/Contain.ps1
    454B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/ContainExactly.Tests.ps1
    865B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/ContainExactly.ps1
    490B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/Exist.Tests.ps1
    .ps1 999B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/Exist.ps1
    289B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/Match.Tests.ps1
    587B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/Match.ps1
    387B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/MatchExactly.Tests.ps1
    503B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/MatchExactly.ps1
    425B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/PesterThrow.Tests.ps1
    4KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/PesterThrow.ps1
    .ps1 2KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/Set-TestInconclusive.ps1
    .ps1 1013B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/Should.Tests.ps1
    .ps1 5KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/Should.ps1
    .ps1 3KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Assertions/Test-Assertion.ps1
    281B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/BreakAndContinue.Tests.ps1
    457B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Context.Tests.ps1
    .ps1 758B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Context.ps1
    .ps1 2KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Coverage.Tests.ps1
    .ps1 11KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Coverage.ps1
    .ps1 17KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Describe.Tests.ps1
    .ps1 761B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Describe.ps1
    .ps1 3KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/GlobalMock-A.Tests.ps1
    761B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/GlobalMock-B.Tests.ps1
    732B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/In.Tests.ps1
    554B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/In.ps1
    .ps1 821B
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/InModuleScope.Tests.ps1
    1KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/InModuleScope.ps1
    .ps1 3KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/It.Tests.ps1
    .ps1 9KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/It.ps1
    .ps1 11KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Mock.Tests.ps1
    .ps1 58KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/Mock.ps1
    .ps1 47KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/New-Fixture.Tests.ps1
    3KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/New-Fixture.ps1
    .ps1 3KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/PesterState.Tests.ps1
    .ps1 14KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/PesterState.ps1
    .ps1 18KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/SetupTeardown.Tests.ps1
    .ps1 5KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/SetupTeardown.ps1
    .ps1 13KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/TestDrive.Tests.ps1
    .ps1 4KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/TestDrive.ps1
    .ps1 3KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/TestResults.Tests.ps1
    .ps1 26KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/TestResults.ps1
    .ps1 16KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Functions/TestsRunningInCleanRunspace.Tests.ps1
    .ps1 6KB
  • WindowsPowerShell/Modules/Pester/3.4.0/LICENSE
    611B
  • WindowsPowerShell/Modules/Pester/3.4.0/Pester.Tests.ps1
    .ps1 10KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Pester.nuspec
    .xml 1KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Pester.psd1
    4KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Pester.psm1
    .ps1 26KB
  • WindowsPowerShell/Modules/Pester/3.4.0/README.md
    .ps1 5KB
  • WindowsPowerShell/Modules/Pester/3.4.0/Snippets/Context.snippets.ps1xml
    801B
  • WindowsPowerShell/Modules/Pester/3.4.0/Snippets/Describe.snippets.ps1xml
    805B
  • WindowsPowerShell/Modules/Pester/3.4.0/Snippets/It.snippets.ps1xml
    703B
  • WindowsPowerShell/Modules/Pester/3.4.0/Snippets/ShouldBe.snippets.ps1xml
    805B
  • WindowsPowerShell/Modules/Pester/3.4.0/Snippets/ShouldBeGreaterThan.snippets.ps1xml
    842B
  • WindowsPowerShell/Modules/Pester/3.4.0/Snippets/ShouldBeLessThan.snippets.ps1xml
    833B
  • WindowsPowerShell/Modules/Pester/3.4.0/Snippets/ShouldBeNullOrEmpty.snippets.ps1xml
    840B
  • WindowsPowerShell/Modules/Pester/3.4.0/Snippets/ShouldContain.snippets.ps1xml
    820B
  • WindowsPowerShell/Modules/Pester/3.4.0/Snippets/ShouldExist.snippets.ps1xml
    814B
  • WindowsPowerShell/Modules/Pester/3.4.0/Snippets/ShouldMatch.snippets.ps1xml
    814B
  • WindowsPowerShell/Modules/Pester/3.4.0/Snippets/ShouldNotBe.snippets.ps1xml
    814B
  • WindowsPowerShell/Modules/Pester/3.4.0/Snippets/ShouldNotBeNullOrEmpty.snippets.ps1xml
    852B
  • WindowsPowerShell/Modules/Pester/3.4.0/Snippets/ShouldNotContain.snippets.ps1xml
    833B
  • WindowsPowerShell/Modules/Pester/3.4.0/Snippets/ShouldNotExist.snippets.ps1xml
    827B
  • WindowsPowerShell/Modules/Pester/3.4.0/Snippets/ShouldNotMatch.snippets.ps1xml
    827B
  • WindowsPowerShell/Modules/Pester/3.4.0/Snippets/ShouldNotThrow.snippets.ps1xml
    831B
  • WindowsPowerShell/Modules/Pester/3.4.0/Snippets/ShouldThrow.snippets.ps1xml
    818B
  • WindowsPowerShell/Modules/Pester/3.4.0/bin/Pester.bat
    925B
  • WindowsPowerShell/Modules/Pester/3.4.0/build.psake.ps1
    1KB
  • WindowsPowerShell/Modules/Pester/3.4.0/chocolateyInstall.ps1
    .ps1 4KB
  • WindowsPowerShell/Modules/Pester/3.4.0/en-US/about_BeforeEach_AfterEach.help.txt
    3KB
  • WindowsPowerShell/Modules/Pester/3.4.0/en-US/about_Mocking.help.txt
    .ps1 6KB
  • WindowsPowerShell/Modules/Pester/3.4.0/en-US/about_Pester.help.txt
    .ps1 4KB
  • WindowsPowerShell/Modules/Pester/3.4.0/en-US/about_TestDrive.help.txt
    .ps1 1KB
  • WindowsPowerShell/Modules/Pester/3.4.0/en-US/about_should.help.txt
    .ps1 5KB
  • WindowsPowerShell/Modules/Pester/3.4.0/nunit_schema_2.5.xsd
    .xml 5KB
  • WindowsPowerShell/Modules/PowerShellGet/1.0.0.1/PSGet.Format.ps1xml
    .xml 8KB
  • WindowsPowerShell/Modules/PowerShellGet/1.0.0.1/PSGet.Resource.psd1
    78KB
  • WindowsPowerShell/Modules/PowerShellGet/1.0.0.1/PSModule.psm1
    .ps1 571KB
  • WindowsPowerShell/Modules/PowerShellGet/1.0.0.1/PowerShellGet.psd1
    2KB
  • WindowsPowerShell/Modules/PowerShellGet/1.0.0.1/en-US/PSGet.Resource.psd1
    74KB
  • Extracted_Certificates.exe
    .exe 67.6MB
  • ITSM.msi
    .msi 94.2MB
  • SCANID S-4txoEDTou1s - thor_2026-09-14_2047.txt
    136.1MB
  • SCANID S-acir1xbb1io - thor_2026-09-16_0308.txt
    156.1MB
  • SCANID S-fDcCOfEOshg - thor_2026-09-18_0208.txt
    7.4MB
  • SCANID S-xu1tfadk3bg - thor_2026-09-15_1749.txt
    45.1MB
  • ces_x64.msi
    .msi 101.7MB
  • pop-support_1665955296.exe
    .exe 155KB

Documents 5.zip

  • SHA256 04db39659104b1a6b6a96f7ae7d65d977d34b14cbfa4372de843e757590b901f
  • MD5 SHA1 SHA512 SSDEEP TLSH