netsupport | 8d60ebbaea8a7b8be25cd7e41736eb6a4801d3aa0a53a0d7022d12951f5a473a

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 10:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.msi
Size 3.8MB
Sample260605-l3ntxsdt21
SHA256 8d60ebbaea8a7b8be25cd7e41736eb6a4801d3aa0a53a0d7022d12951f5a473a
MD5 7df01f91c4a8062843df49046648f4cf
SHA1 4dbe2fecb6fe2d3608d8ea486806a82cbfe3c351
SHA512 8f5d2331aa705b33664ff79fc3b493eba6931e8cc2f3d87358f1e49718186d00457955138b6a9f9a87a6f8fa8e08115cc77c79eabdf3724a135b7de76e32ab9b
SSDEEP 98304:tzK+68enjUoT5bHK06mOl3wTXKD2eZcNcQlcALN/:Ybno45bHK0CwbKD3c/h
TLSH
T1EA163365305BCB6AF5470B3E19821274070AED624776782F262B3F384D7B3A1877ADC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery netsupport persistence privilege_escalation ransomware rat

Malware Config

Signatures

Family: NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealth.lnk	7z.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealth.lnk	7z.exe

Executes dropped EXE 3 IoCs

pid	Process
1320	7z.exe
4044	7z.exe
2068	SecurityHealth.exe

Loads dropped DLL 7 IoCs

pid	Process
1320	7z.exe
4044	7z.exe
2068	SecurityHealth.exe
2068	SecurityHealth.exe
2068	SecurityHealth.exe
2068	SecurityHealth.exe
2068	SecurityHealth.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFA34A259B9CC09066.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{373CFEF4-63D6-4878-8E81-D0C321E87BA0}	msiexec.exe
File created	C:\Windows\Installer\e58b62e.msi	msiexec.exe
File created	C:\Windows\Installer\e58b62c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58b62c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0104C7096DE0CD7F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB6E7.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3AE6D046C833B92A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF266491380CF650E8.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2176	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityHealth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000643a9eb9192046c00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000643a9eb90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900643a9eb9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a643a9eb9000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d643a9eb9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2020	msiexec.exe
2020	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2176	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2176	msiexec.exe
Token: SeSecurityPrivilege	2020	msiexec.exe
Token: SeCreateTokenPrivilege	2176	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2176	msiexec.exe
Token: SeLockMemoryPrivilege	2176	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2176	msiexec.exe
Token: SeMachineAccountPrivilege	2176	msiexec.exe
Token: SeTcbPrivilege	2176	msiexec.exe
Token: SeSecurityPrivilege	2176	msiexec.exe
Token: SeTakeOwnershipPrivilege	2176	msiexec.exe
Token: SeLoadDriverPrivilege	2176	msiexec.exe
Token: SeSystemProfilePrivilege	2176	msiexec.exe
Token: SeSystemtimePrivilege	2176	msiexec.exe
Token: SeProfSingleProcessPrivilege	2176	msiexec.exe
Token: SeIncBasePriorityPrivilege	2176	msiexec.exe
Token: SeCreatePagefilePrivilege	2176	msiexec.exe
Token: SeCreatePermanentPrivilege	2176	msiexec.exe
Token: SeBackupPrivilege	2176	msiexec.exe
Token: SeRestorePrivilege	2176	msiexec.exe
Token: SeShutdownPrivilege	2176	msiexec.exe
Token: SeDebugPrivilege	2176	msiexec.exe
Token: SeAuditPrivilege	2176	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2176	msiexec.exe
Token: SeChangeNotifyPrivilege	2176	msiexec.exe
Token: SeRemoteShutdownPrivilege	2176	msiexec.exe
Token: SeUndockPrivilege	2176	msiexec.exe
Token: SeSyncAgentPrivilege	2176	msiexec.exe
Token: SeEnableDelegationPrivilege	2176	msiexec.exe
Token: SeManageVolumePrivilege	2176	msiexec.exe
Token: SeImpersonatePrivilege	2176	msiexec.exe
Token: SeCreateGlobalPrivilege	2176	msiexec.exe
Token: SeBackupPrivilege	5004	vssvc.exe
Token: SeRestorePrivilege	5004	vssvc.exe
Token: SeAuditPrivilege	5004	vssvc.exe
Token: SeBackupPrivilege	2020	msiexec.exe
Token: SeRestorePrivilege	2020	msiexec.exe
Token: SeRestorePrivilege	2020	msiexec.exe
Token: SeTakeOwnershipPrivilege	2020	msiexec.exe
Token: SeRestorePrivilege	2020	msiexec.exe
Token: SeTakeOwnershipPrivilege	2020	msiexec.exe
Token: SeRestorePrivilege	1320	7z.exe
Token: 35	1320	7z.exe
Token: SeSecurityPrivilege	1320	7z.exe
Token: SeSecurityPrivilege	1320	7z.exe
Token: SeRestorePrivilege	4044	7z.exe
Token: 35	4044	7z.exe
Token: SeSecurityPrivilege	4044	7z.exe
Token: SeSecurityPrivilege	4044	7z.exe
Token: SeRestorePrivilege	2020	msiexec.exe
Token: SeTakeOwnershipPrivilege	2020	msiexec.exe
Token: SeRestorePrivilege	2020	msiexec.exe
Token: SeTakeOwnershipPrivilege	2020	msiexec.exe
Token: SeRestorePrivilege	2020	msiexec.exe
Token: SeTakeOwnershipPrivilege	2020	msiexec.exe
Token: SeRestorePrivilege	2020	msiexec.exe
Token: SeTakeOwnershipPrivilege	2020	msiexec.exe
Token: SeRestorePrivilege	2020	msiexec.exe
Token: SeTakeOwnershipPrivilege	2020	msiexec.exe
Token: SeRestorePrivilege	2020	msiexec.exe
Token: SeTakeOwnershipPrivilege	2020	msiexec.exe
Token: SeRestorePrivilege	2020	msiexec.exe
Token: SeTakeOwnershipPrivilege	2020	msiexec.exe
Token: SeRestorePrivilege	2020	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2176	msiexec.exe
2176	msiexec.exe
2068	SecurityHealth.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 3040	2020	msiexec.exe	87
PID 2020 wrote to memory of 4492	2020	msiexec.exe	89
PID 4492 wrote to memory of 1320	4492	MsiExec.exe	90
PID 4492 wrote to memory of 4044	4492	MsiExec.exe	92
PID 4492 wrote to memory of 4032	4492	MsiExec.exe	97
PID 3032 wrote to memory of 2068	3032	explorer.exe	99

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\setup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2176

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3040
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 821B4ED077E6037E3D2C4EBA9C9A1BE8
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Users\Admin\AppData\Local\MerryFlorist\7z.exe
    "C:\Users\Admin\AppData\Local\MerryFlorist\7z.exe" x "C:\Users\Admin\AppData\Local\MerryFlorist\WebCacheV01.dat" -p040904b0 -aoa -y -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1320
- - C:\Users\Admin\AppData\Local\MerryFlorist\7z.exe
    "C:\Users\Admin\AppData\Local\MerryFlorist\7z.exe" x "C:\Users\Admin\AppData\Local\MerryFlorist\AppxMetadata.bin" -p77d2a1c8e04f -aoa -y -o"C:\ProgramData\MerryFlorist"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4044
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\ProgramData\MerryFlorist\SecurityHealth.exe"
    3⤵
    PID:4032

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Modifies registry class
PID:3276

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\ProgramData\MerryFlorist\SecurityHealth.exe
  "C:\ProgramData\MerryFlorist\SecurityHealth.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:2068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58b62d.rbs

Path C:\Config.Msi\e58b62d.rbs
Size 8KB
SHA256 78996d766ad44c24c4d5720c3333db41b3c25cc62932cf39e6013f36316e9113
MD5 3a0ec02f50691555685853cfc68e959c
SHA1 b460060cb328523b2cf678c9b87a76490efe6ae3
SHA512 ec3e7fa1437d3c112faf10abf88489ba21d4005bb842f8b827177cc2e97e2239b8ce3d512be850229327f13844c34b2473f0f0496cdfc1731faa8b15a14e2958
SSDEEP 96:NoX6hbQlfdf2CDx2A4UkZznCsThqs4UkZznC6jQH91ThqEHcFh+WiFMBaGACPpu+:NoXJVuCE42CIF2CzOHPp/
TLSH
T13B023142F351C9E3EC9D2335CB93272437B3D2AAD686334B858E81245F23B589F4A5D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HTCTL32.DLL

Path C:\ProgramData\MerryFlorist\HTCTL32.DLL
Size 316KB
SHA256 6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269
MD5 051cdb6ac8e168d178e35489b6da4c74
SHA1 38c171457d160f8a6f26baa668f5c302f6c29cd1
SHA512 602ab9999f7164a2d1704f712d8a622d69148eefe9a380c30bc8b310eadedf846ce6ae7940317437d5da59404d141dc2d1e0c3f954ca4ac7ae3497e56fcb4e36
SSDEEP 6144:WyspIr8g8imeKk9Fv8TamdF3xuHGAimnx30aaY5nFJl8NjzGrn0J/d3M1OGg:WyspIr8g8i191uzdwHGAimd0bY5FJl85
TLSH
T105646C21BD80C031F2966175C57EDBBA0D6DA430376860DBBBD909F96F686D3663830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSM.LIC

Path C:\ProgramData\MerryFlorist\NSM.LIC
Size 251B
SHA256 53b4a9603905e7838842694a90549362d9ec25b6d22e1c4f3d6c14e040c7a76c
MD5 2ca7ac695c6b75bc547caad20bc74fea
SHA1 bcfef09ce64cfa2085598cf897e362ff4f57dd6c
SHA512 6ac3b8b7ad351c44270e6192dac1edeb585d75abab2ad4800b3920c41bb71482e43a0dab2bb8a9f6df45088acb0c690c12a1eab3b759de0792d4ed93ce600ed2
TLSH
T18ED02BC981236237478201617BA0445E828891658218299CB59D126718B55341E8D06C
MD5 SHA1 SHA512 TLSH

Submit Download

PCICHEK.DLL

Path C:\ProgramData\MerryFlorist\PCICHEK.DLL
Size 14KB
SHA256 0cff893b1e7716d09fb74b7a0313b78a09f3f48c586d31fc5f830bd72ce8331f
MD5 3aabcd7c81425b3b9327a2bf643251c6
SHA1 ea841199baa7307280fc9e4688ac75e5624f2181
SHA512 97605b07be34948541462000345f1e8f9a9134d139448d4f331cefeeca6dad51c025fcab09d182b86e5a4a8e2f9412b3745ec86b514b0523497c821cb6b8c592
SSDEEP 192:uuYr6062b6Z1HVF6RRHXPPr+13fnYe+PjPIrI9FlP4r9ZCspE+TMlr78Vkf:uuYe72u6r+5nYPL7NheMr
TLSH
T1D562F7835BB41015EAE38FB15AF7C2565E36B7916FB4D1EF1190418A2E84FE02E2531B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCICL32.dll

Path C:\ProgramData\MerryFlorist\PCICL32.dll
Size 3.3MB
SHA256 b6d4ad0231941e0637485ac5833e0fdc75db35289b54e70f3858b70d36d04c80
MD5 e7b92529ea10176fe35ba73fa4edef74
SHA1 fc5b325d433cde797f6ad0d8b1305d6fb16d4e34
SHA512 fb3a70e87772c1fb386ad8def6c7bdf325b8d525355d4386102649eb2d61f09ce101fce37ccc1f44d5878e604e2e426d96618e836367ab460cae01f627833517
SSDEEP 49152:FwWtZSlgPoqxyszApD0Ew0J94KinCgqGBQTdTBOHa3clSToWZiwDA:FwWrSlgHyszApD090mCgqTUSPE9
TLSH
T19EF51832E5048872E1564079DC7D6AEC451A6DA00F1881EF798EF9AD2EF23D533B4F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityHealth.exe

Path C:\ProgramData\MerryFlorist\SecurityHealth.exe
Size 33KB
SHA256 275e5b085534f64313b50cbdcb08ecd59c57d21c96bb937f140ee92a3d27f792
MD5 5a24676210bd317520fe30d048c9a106
SHA1 067ddd3fdd5451c2f5bf43b4b316f2165c6c4470
SHA512 28118405fa8446fd9d8ac37bc5ba26a8696732fa7c19e41aef3da4d049d23b21da1cc0def0a2fb66e2e4fbb0c0147f042ef5492bb537aba7376ba46ebc8f7648
SSDEEP 192:JXvg84ZVe9LQTsZ98A2QakMnCaJbZToyowJL/8Qpkqs1I1jw+ebCfaFagU:FvwamdkjgZMYJLu1SmbCSRU
TLSH
T1FAF2D503A254A4A1D8954B30F4D3D2F2DE35FE01EF95468731E97EAB3F5B7A11B2110A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

falos.ini

Path C:\ProgramData\MerryFlorist\falos.ini
Size 706B
SHA256 244d2be703f5d60f7a763d754a11ec68577ffb0c8b04397a63d03ba9623dfc1a
MD5 a5ad5ce34d8d75b234edbc235097597d
SHA1 d17acb6f1f85353947b9785507fd1a7e83e2217b
SHA512 0472097ea8e2b31a168aa7c4760a7929e4e609cf5bdbbc1f42713a4d4c36d93cd18170bde5f88c3e17a4aa42e3c6c92bb1d5ab3d782c85d63069c3708524020d
TLSH
T1E801FE932647BD0E1AC7F284E6BC00942FD34880A65DBA316B545D4F6E32CA946FF8C8
MD5 SHA1 SHA512 TLSH

Submit Download

msvcr100.dll

Path C:\ProgramData\MerryFlorist\msvcr100.dll
Size 755KB
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
TLSH
T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcicapi.dll

Path C:\ProgramData\MerryFlorist\pcicapi.dll
Size 106KB
SHA256 2dfdc169dfc27462adc98dde39306de8d0526dcf4577a1a486c2eef447300689
MD5 67c53a770390e8c038060a1921c20da9
SHA1 49e63af91169c8ce7ef7de3d6a6fb9f8f739fa3a
SHA512 201e07dbccd83480d6c4d8562e6d0a9e4c52ed12895f0b91d875c2bbcc50b3b1802e11e5e829c948be302bf98ebde7fb2a99476065d1709b3bdbcd5d59a1612d
SSDEEP 1536:LnzOfAUs8aONOb2H4NECHnTXg05rQMb2bbaPrw6BkJElFBIboKKGQ1w:LnSfAB8cb2YN7pSy8AuElFBIboKKGSw
TLSH
T1EFB38D01B192C5B2F5CA497806CB6B774F3D76A17E2450D3AB60D9810E7A7B37B1E20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\MerryFlorist\7z.dll
Size 1.1MB
SHA256 b17c3e4058aacdcc36b18858d128d6b3058e0ea607a4dc59eb95b18b7c6acc7c
MD5 95c6515d88e9ea48a9b949a81c1dac4e
SHA1 c93eeb4241f69fea44c4d8ccdde03f3b40a6be3f
SHA512 d4474418a9290d89bff9ca58249e501e0d8f42a9153874c0dbb36f35eaabbb18a3e700fb6f2feb2eec7ceed3254ff1aec08752d09efad9d2c25aa6284471d1c6
SSDEEP 24576:Jx6t04DSc9S0B07sjsPEtd+F5zrtV53SePrnvgwPWrlahtNxn:JxBOp1B07sjsPEtd2znPrnIwuh0Nxn
TLSH
T164357D15F7F1C074CA8E45308A2CABF550F9E71ACA20A8C76780FF6E6F318D5D229959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\MerryFlorist\7z.exe
Size 296KB
SHA256 43907e54cf3d1258f695d1112759b5457576481072cc76a679b8477cfeb3db87
MD5 58712aacf6b0f8149c066bda3a034fc3
SHA1 cf2da87d52a6b08a3b9502b1f6082b8b76ba4d32
SHA512 f9df1dfdc3f706a5adfe2f38e91d8a3cb23dd46cd35b26c95bfe6ede7a731a536c4fa72304b86e699db56c669819fa4e132ab37da9561240ee29743edf5bcc7f
SSDEEP 6144:t//CluW8GaYMOZjlRRfCqjgs961nr6FX3xgws8wk+u:1/nL4Xa+P++fqbu
TLSH
T1E8547C127FF4C43BD6030232CF5DABD4A0FA97A94D20588327C40A5CEA759D6E369E6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppxMetadata.bin

Path C:\Users\Admin\AppData\Local\MerryFlorist\AppxMetadata.bin
Size 3.1MB
SHA256 5319eb53f3769e429eb4b746b64805876bf5cf928646e6f7731dfc62579fe16a
MD5 77cad873ed5465610aa6565e50474b66
SHA1 03e5df63f6db9c0567480a62f83c6f92e67b9a2d
SHA512 399fd40bbd14a54f505ad668a1493ce9cc6287cbe910a22aabac9969709235924f8c9d22de67b65801ede00fd7d1412b6237c4ed2ff92009498c49e25eb0f5a9
SSDEEP 49152:2fhLyKn6RS9MC4inJZgt+9b+x6lTZD+dho8yuxNK9mg8iwPjB8yEhfbNBPIGZ3Uy:2JFn6ninJyaTE0sK4nvEVbsc31DAC3j
TLSH
T126E533A1205BD59D39430F7F1A821370530BE37666B8352F262F2E3D4A672B4976ACCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebCacheV01.dat

Path C:\Users\Admin\AppData\Local\MerryFlorist\WebCacheV01.dat
Size 769B
SHA256 19dd62584aacb7cf9031b06f673b4e605408ba675925bcf783ad7ea689e04f8f
MD5 532be7f41267dd41d817f495ce8be02a
SHA1 44d9467ce2396cfd49f19c04c3c02c7f42a708ff
SHA512 334a49853582eea5561d50395f915c003d0366dbb374602965df5c6386cf18a8358a4b302859c65af51b2c3e895728b370a3bb2317dacfc79f268aaa070af0d3
TLSH
T1E101703E286370B9C17905EEA696A047AD62A6E2876A4B180110370B318024C86A9FE2
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealth.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealth.lnk
Size 907B
SHA256 252b002d47363afdd391ee783db161aacbe8e4d12da2d3259822920b669ecd07
MD5 7e37e7eee5048fc16da5c5053ee86db7
SHA1 908400bc91d6bef6a567ed5f102b6a646afe47a4
SHA512 fdefbd0d2cb1904d10550ba423446c576cac9b570a9729487df8292b57cb2b0b198477bf3d59bd74d5e214ab8fd1a01400491d11853d7bb9c65c038cfa3605f2
TLSH
T1D111B1154AE70729D772873D9DB663A28537FC16F5944F4E805E074848362001D88E2F
MD5 SHA1 SHA512 TLSH

Submit Download

e58b62c.msi

Path C:\Windows\Installer\e58b62c.msi
Size 3.8MB
SHA256 8d60ebbaea8a7b8be25cd7e41736eb6a4801d3aa0a53a0d7022d12951f5a473a
MD5 7df01f91c4a8062843df49046648f4cf
SHA1 4dbe2fecb6fe2d3608d8ea486806a82cbfe3c351
SHA512 8f5d2331aa705b33664ff79fc3b493eba6931e8cc2f3d87358f1e49718186d00457955138b6a9f9a87a6f8fa8e08115cc77c79eabdf3724a135b7de76e32ab9b
SSDEEP 98304:tzK+68enjUoT5bHK06mOl3wTXKD2eZcNcQlcALN/:Ybno45bHK0CwbKD3c/h
TLSH
T1EA163365305BCB6AF5470B3E19821274070AED624776782F262B3F384D7B3A1877ADC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 6987e1c4cc3f9aa1c4eaff923acd076ce14881362324d70645652033c757cedf
MD5 90a1feb6b4f4512e46148ef6cde3ffc9
SHA1 03f34fa41aba9969644a9c6a7a7c7187f8f9198e
SHA512 24937a3e572e80488c589825b3ddf930f18fbf7477c4073a8bfef66e1afc35c86657ff053772d8dc442d8769ac9006694195fcedb8a7d4fd50cdacb0ade26ed4
SSDEEP 24576:82gmSp1PdoO/vvTLaWxOBk3afqpaA4Fr22CN3JEBYK6YktF046AWrMr2x:O
TLSH
T1DE47C22436F92210E7F79E3CA8F06A234A3E7D5B9C15DE8D45451B4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4780eac1-b49a-48de-a0bb-25198b9ce39a}_OnDiskSnapshotProp

Path \??\Volume{b99e3a64-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4780eac1-b49a-48de-a0bb-25198b9ce39a}_OnDiskSnapshotProp
Size 6KB
SHA256 ea3e2276e1538f1584a339cc142d43c4af29994f1fe2e34835337e6409428949
MD5 deb6515f148460eb21ea8e52791d86ee
SHA1 596e2d8a205f89c214f69a16da40b26fe2568432
SHA512 e33b1b903442d9e20b25fade534fb47358a23a8f21e90b430246ef839d1c7c892cd74c0db9132ea75767a7eb5bc5b2ae9b5980dbe737c282ca64c0c0d4a32d2f
SSDEEP 96:FLgsFtyvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:isIb++ZVmN
TLSH
T1F9D188085AE54711E2B3AB7128F58557A877B911FF33CB8E0198238E6670A10F936F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download