netsupport | 363b8670d3f063e41a1d47786653b355ab48a451001db54d6e3227ec252b6b3d

Analysis

max time kernel
298s
max time network
233s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d586a839-c071-set-4012-95c4-ab-3474f21afc61.ps1
Size 4.8MB
Sample260704-e469bsa17y
SHA256 363b8670d3f063e41a1d47786653b355ab48a451001db54d6e3227ec252b6b3d
MD5 8cced03b5304c2f2f9731c60fda3fde9
SHA1 c674ea0eef45ab85925dc74eda25b95eb224e057
SHA512 6c8464315dbd79da57e4a3ad774876441e4f5f01abe2a5b7251f7a1dd3b7360ef33fd5fd7e0c77af7d4e33c70784c50c37efb585544ed7435baf1ae7d2789856
SSDEEP 12288:eNFAk0rzFrDUCb9uCWrB5zy363vhNzLUzanqYZQ7zrQv5G38ycIlbIzWZwbZkcKD:edY19OTAOXejl7FUUEXVDNgEnPnDQdE0
TLSH
T1163693C97AC457F09929ABEC824774DD0794613E6FBB184C02E148BE3D1AE1766E0CBD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery execution netsupport persistence ransomware rat spyware

Malware Config

Signatures

Family: NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Badlisted process makes network request 26 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	5852	PowerShell.exe
7	5852	PowerShell.exe
8	5852	PowerShell.exe
9	5852	PowerShell.exe
10	5852	PowerShell.exe
11	5852	PowerShell.exe
12	5852	PowerShell.exe
13	5852	PowerShell.exe
14	5852	PowerShell.exe
15	5852	PowerShell.exe
16	5852	PowerShell.exe
17	5852	PowerShell.exe
18	5852	PowerShell.exe
19	5852	PowerShell.exe
20	5852	PowerShell.exe
21	5852	PowerShell.exe
22	5852	PowerShell.exe
23	5852	PowerShell.exe
24	5852	PowerShell.exe
25	5852	PowerShell.exe
26	5852	PowerShell.exe
27	5852	PowerShell.exe
28	5852	PowerShell.exe
29	5852	PowerShell.exe
30	5852	PowerShell.exe
31	5852	PowerShell.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
5548	angel.exe

Loads dropped DLL 6 IoCs

pid	Process
5548	angel.exe
5548	angel.exe
5548	angel.exe
5548	angel.exe
5548	angel.exe
5548	angel.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5852	PowerShell.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	angel.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{25B45502-8D2A-4551-A18D-572195D02383}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{ADF9AEA9-80F4-4C24-9268-C081C89FD375}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5852	PowerShell.exe
5852	PowerShell.exe
5612	explorer.exe
5612	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5852	PowerShell.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeShutdownPrivilege	5612	explorer.exe
Token: SeCreatePagefilePrivilege	5612	explorer.exe
Token: SeSecurityPrivilege	5548	angel.exe
Token: SeIncreaseQuotaPrivilege	5852	PowerShell.exe
Token: SeSecurityPrivilege	5852	PowerShell.exe
Token: SeTakeOwnershipPrivilege	5852	PowerShell.exe
Token: SeLoadDriverPrivilege	5852	PowerShell.exe
Token: SeSystemProfilePrivilege	5852	PowerShell.exe
Token: SeSystemtimePrivilege	5852	PowerShell.exe
Token: SeProfSingleProcessPrivilege	5852	PowerShell.exe
Token: SeIncBasePriorityPrivilege	5852	PowerShell.exe
Token: SeCreatePagefilePrivilege	5852	PowerShell.exe
Token: SeBackupPrivilege	5852	PowerShell.exe
Token: SeRestorePrivilege	5852	PowerShell.exe
Token: SeShutdownPrivilege	5852	PowerShell.exe
Token: SeDebugPrivilege	5852	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	5852	PowerShell.exe
Token: SeRemoteShutdownPrivilege	5852	PowerShell.exe
Token: SeUndockPrivilege	5852	PowerShell.exe
Token: SeManageVolumePrivilege	5852	PowerShell.exe
Token: 33	5852	PowerShell.exe
Token: 34	5852	PowerShell.exe
Token: 35	5852	PowerShell.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
5384	sihost.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5548	angel.exe

Suspicious use of SendNotifyMessage 45 IoCs

pid	Process
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe
5612	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1000	StartMenuExperienceHost.exe
5484	SearchHost.exe
5612	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5384 wrote to memory of 5612	5384	sihost.exe	93
PID 5852 wrote to memory of 5548	5852	PowerShell.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\d586a839-c071-set-4012-95c4-ab-3474f21afc61.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Users\Admin\AppData\Roaming\Google\Sync\CloudAgent\d0c8573e58934d5d\angel.exe
  "C:\Users\Admin\AppData\Roaming\Google\Sync\CloudAgent\d0c8573e58934d5d\angel.exe" "C:\Users\Admin\AppData\Roaming\Google\Sync\CloudAgent\d0c8573e58934d5d\"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5548

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5384
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5612

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5484

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

HTCTL32.DLL

Path C:\Users\Admin\AppData\Roaming\Google\Sync\CloudAgent\d0c8573e58934d5d\HTCTL32.DLL
Size 320KB
SHA256 edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796
MD5 2d3b207c8a48148296156e5725426c7f
SHA1 ad464eb7cf5c19c8a443ab5b590440b32dbc618f
SHA512 55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c
SSDEEP 6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg
TLSH
T150646C21BD80C031F2966075C5BDDBBA0D6DB470376860DBBBD909B96F686D3663830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR100.dll

Path C:\Users\Admin\AppData\Roaming\Google\Sync\CloudAgent\d0c8573e58934d5d\MSVCR100.dll
Size 755KB
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
TLSH
T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSM.LIC

Path C:\Users\Admin\AppData\Roaming\Google\Sync\CloudAgent\d0c8573e58934d5d\NSM.LIC
Size 253B
SHA256 83a6feb6304effcd258129e5d46f484e4c34c1cce1ea0c32a94a89283ccd24f9
MD5 14ca8f4ee0dd828ecfd0c566dce00f06
SHA1 cd7d6a571d58ff9bd6a411f98a205c43b9a34da2
SHA512 2cd6d6e632cba37724a1db4f771d1ebb938dee44fa096dc4dd8d62322436d3d0ac216f8ddf79f20dd3e41ad1741e6c3dbfaf649ed09e36d91233b4a95a1faf02
TLSH
T190D02BC9A123902B43D141667BA184AE82D8909887242D44B5EC22266AA55205B8D05C
MD5 SHA1 SHA512 TLSH

Submit Download

PCICL32.dll

Path C:\Users\Admin\AppData\Roaming\Google\Sync\CloudAgent\d0c8573e58934d5d\PCICL32.dll
Size 3.5MB
SHA256 bd53de502b1e42fb825e3098d90b94eac74dd4b310acf815890952a6912acdde
MD5 f1f5be34b3fed664a40941bc70c0574e
SHA1 e0bdf139dc3a5dd3513cb53451f65bfb70f09b53
SHA512 7afd4e4ed162f3fba02506ca06b018a48fe998a8e3b0c20cb5d4cf2c44abf93de6ac9d8dc9f30d8531453c521e10a22aca39a929673ede2bc016bda7f78da25a
SSDEEP 49152:NOHDe5Yr6tYA4S+DjdwfwBTNZaZbkc9SENTIg:NOHDe5YrvS+tBUtSap
TLSH
T10AF50770EA448C75E1930476ED6DAADC412A6E750F2906CF3A8CB5091AF63D131F8F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

angel.exe

Path C:\Users\Admin\AppData\Roaming\Google\Sync\CloudAgent\d0c8573e58934d5d\angel.exe
Size 117KB
SHA256 8000ffd1f8b32b4b85be9c3e730874865d949f9359c9a91c4386f4ff32deb180
MD5 5f35710f5128ddf6eb2c89e724b83d11
SHA1 94e8d9a259ddff360e0ea5b03580f672c66712c4
SHA512 768e384346b83372e4e04dd6030c3404258d40ee63ea50dacdfea7e4746d65a3316fc572febe1995619c128e3bd08441c4b58de8a25b388b6e003552d949af09
SSDEEP 768:hEVZl6FhWr80/FK0r2bhuvtAKzCKZikGr2bhu2RPAKzCKZikZ:hG0hGNKU2huv+vv2huyYva
TLSH
T166C3C50F4699E173EA42E97DC8849B010C64BEC9B5F458FB105EF63E3E3178E2B6415A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client32.ini

Path C:\Users\Admin\AppData\Roaming\Google\Sync\CloudAgent\d0c8573e58934d5d\client32.ini
Size 1KB
SHA256 9f4730605c4457e387856bf2272a71ae7f8178ebb07ba40d05c4451adfc7cd0d
MD5 dd8e993085259d0a7ebb31ac84324ef9
SHA1 c8050b7a810f2b75f0a0fb743f49b7093105a3b4
SHA512 c028ef1c0d3d16af07a6e801015e405dd9870af921c562c83b2332778ac78a53c2ace87abbdf67bdb9b6b3bc6d97ccd6ed5fde41d6f70d4debd509d01b4d87af
TLSH
T1F7111222664EBD1D1937E291727841903FD60489E01D39209B584D6FFF3A8BE85EFCD9
MD5 SHA1 SHA512 TLSH

Submit Download

pcicapi.dll

Path C:\Users\Admin\AppData\Roaming\Google\Sync\CloudAgent\d0c8573e58934d5d\pcicapi.dll
Size 32KB
SHA256 9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917
MD5 dcde2248d19c778a41aa165866dd52d0
SHA1 7ec84be84fe23f0b0093b647538737e1f19ebb03
SHA512 c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166
SSDEEP 768:FFvNhAyi5hHA448qZkSn+EgT8To1iTYiu:FCyoHA448qSSzgI2GQ
TLSH
T14EE27EC59A88A493F9C94C7571EEEB375C3976F0675400D3B2A682B91AD83F2347821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcichek.dll

Path C:\Users\Admin\AppData\Roaming\Google\Sync\CloudAgent\d0c8573e58934d5d\pcichek.dll
Size 18KB
SHA256 313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a
MD5 a0b9388c5f18e27266a31f8c5765b263
SHA1 906f7e94f841d464d4da144f7c858fa2160e36db
SHA512 6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd
SSDEEP 192:1ANeiOT8Z2b6SoVF6RRHaPrpF3o47jtd3hfwHjvud3hfwx7bjuh:1ANt+E2exrpxTSDuTuih
TLSH
T15D821BD21F696503EBE24E7161EADA165D36B6D0AB74C0EF307581452EC0BE03E6931F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5484-72-0x000001E903BA0000-0x000001E903BC0000-memory.dmp

Download

memory/5484-61-0x000001E903E10000-0x000001E903F10000-memory.dmp

Download

memory/5484-98-0x000001E9045E0000-0x000001E904600000-memory.dmp

Download

memory/5484-59-0x000001E903940000-0x000001E903960000-memory.dmp

Download

memory/5484-55-0x000001E9001E0000-0x000001E9002E0000-memory.dmp

Download

memory/5852-28-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-14-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-18-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-19-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-20-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-21-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-22-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-23-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-24-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-26-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-27-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-25-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-0-0x00007FFF18D3F000-0x00007FFF18D40000-memory.dmp

Download

memory/5852-29-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-30-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-31-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-32-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-16-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-15-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-17-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-13-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-12-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-11-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-221-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-223-0x00000213FAF10000-0x00000213FAF1A000-memory.dmp

Download

memory/5852-224-0x00000213FB660000-0x00000213FB672000-memory.dmp

Download

memory/5852-10-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-9-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-247-0x00000213FAF20000-0x00000213FAF3E000-memory.dmp

Download

memory/5852-248-0x00000213FB7D0000-0x00000213FB882000-memory.dmp

Download

memory/5852-249-0x00000213FB000000-0x00000213FB00A000-memory.dmp

Download

memory/5852-8-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-6-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-7-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-5-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-4-0x00000213FB190000-0x00000213FB1B2000-memory.dmp

Download

memory/5852-1-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download

memory/5852-262-0x00000213FB890000-0x00000213FB8AE000-memory.dmp

Download

memory/5852-264-0x00007FFF18BB0000-0x00007FFF19554000-memory.dmp

Download