netsupport | ad9f5068b17e4fa00b58a2aaf0d71b8a1530476d619b39607463f4c704397a35

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stage1.hta
Size 8KB
Sample260929-jdmt8athnd
SHA256 ad9f5068b17e4fa00b58a2aaf0d71b8a1530476d619b39607463f4c704397a35
MD5 85fbf8364d669729e0629c83304d2cb9
SHA1 bf5102ff43067a7e1224cf3759f337524e95ffb7
SHA512 6d73d6e3c788065f34dfb100c66297c3b9969887b73a05cfe1fd91c9c6820625b73d7526a3a21e5fa8ebf7dcb07f4c73845868fce08f40a3b80853b74e8e7594
SSDEEP 96:8H2Uwf1426A0rk9j+UYLA/0cu1zS10uZIZ/ZUR3t1qoZSZfZQZbZuZlZOZ+ZkZWB:8W2AIk9j+UYLA/pOGER
TLSH
T1D30275AB4104C5BEE43526C9156F5C1ED4A5D3222873DAF1908CC88FE0A9DF9B47E2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution netsupport persistence rat

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://download.youlovemybiba.com/assets/pkg/package.tar.gz

Signatures

Family: NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4580	mshta.exe
7	4580	mshta.exe
8	4580	mshta.exe
9	4580	mshta.exe
10	4580	mshta.exe
12	2404	powershell.exe
19	4580	mshta.exe

Executes dropped EXE 1 IoCs

pid	Process
5052	updaterdriveon.exe

Loads dropped DLL 6 IoCs

pid	Process
5052	updaterdriveon.exe
5052	updaterdriveon.exe
5052	updaterdriveon.exe
5052	updaterdriveon.exe
5052	updaterdriveon.exe
5052	updaterdriveon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\EdgeUpdateService = "cmd /c start /min /D \"C:\\Users\\Admin\\AppData\\Local\\DriverWebUpdate\" \"C:\\Users\\Admin\\AppData\\Local\\DriverWebUpdate\\updaterdriveon.exe\""	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeSpellCheck = "wscript.exe \"\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\EdgeUpdate\\runtime\\watchdog.vbs\"\""	mshta.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1324	tasklist.exe
428	tasklist.exe
1824	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3288	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2404	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4880	cmd.exe
5376	cmd.exe
5928	cmd.exe
1360	cmd.exe
4924	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	updaterdriveon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	updaterdriveon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mshta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mshta.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updaterdriveon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1164	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2404	powershell.exe
2404	powershell.exe
2404	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeSecurityPrivilege	5052	updaterdriveon.exe
Token: SeDebugPrivilege	428	tasklist.exe
Token: SeDebugPrivilege	1824	tasklist.exe
Token: SeDebugPrivilege	1324	tasklist.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5052	updaterdriveon.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 2404	4580	mshta.exe	90
PID 2404 wrote to memory of 480	2404	powershell.exe	92
PID 2404 wrote to memory of 5052	2404	powershell.exe	93
PID 4580 wrote to memory of 5928	4580	mshta.exe	94
PID 5928 wrote to memory of 1164	5928	cmd.exe	96
PID 1680 wrote to memory of 5168	1680	cmd.exe	99
PID 4580 wrote to memory of 1360	4580	mshta.exe	100
PID 1360 wrote to memory of 3288	1360	cmd.exe	103
PID 3288 wrote to memory of 4924	3288	wscript.exe	104
PID 4924 wrote to memory of 428	4924	cmd.exe	106
PID 4924 wrote to memory of 2900	4924	cmd.exe	107
PID 3288 wrote to memory of 4880	3288	wscript.exe	112
PID 4880 wrote to memory of 1824	4880	cmd.exe	114
PID 4880 wrote to memory of 1576	4880	cmd.exe	115
PID 3288 wrote to memory of 5376	3288	wscript.exe	116
PID 5376 wrote to memory of 1324	5376	cmd.exe	118
PID 5376 wrote to memory of 2872	5376	cmd.exe	119

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\stage1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Badlisted process makes network request
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\dl_5sij9w.ps1"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\SysWOW64\tar.exe
    "C:\Windows\system32\tar.exe" -xzf C:\Users\Admin\AppData\Local\Temp\pkg_5sij9w.tar.gz -C C:\Users\Admin\AppData\Local\DriverWebUpdate
    3⤵
    PID:480
- - C:\Users\Admin\AppData\Local\DriverWebUpdate\updaterdriveon.exe
    "C:\Users\Admin\AppData\Local\DriverWebUpdate\updaterdriveon.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:5052
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /Create /TN MicrosoftEdgeUpdate_6a8d5edb /TR "wscript.exe \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\runtime\\launcher.vbs\"" /SC MINUTE /MO 7 /F
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN MicrosoftEdgeUpdate_6a8d5edb /TR "wscript.exe \"C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\runtime\\launcher.vbs\"" /SC MINUTE /MO 7 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1164
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /min wscript.exe ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\runtime\watchdog.vbs""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\runtime\watchdog.vbs""
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3288
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\runtime\handler.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4924
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq updaterdriveon.exe"
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:428
    - - C:\Windows\SysWOW64\find.exe
        
        find "updaterdriveon.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2900
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\runtime\handler.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4880
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq updaterdriveon.exe"
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1824
    - - C:\Windows\SysWOW64\find.exe
        
        find "updaterdriveon.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1576
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\runtime\handler.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5376
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq updaterdriveon.exe"
        5⤵
        Discovers running processes
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1324
    - - C:\Windows\SysWOW64\find.exe
        
        find "updaterdriveon.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2872

C:\Windows\system32\cmd.exe
"cmd /c start /min /D "C:\Users\Admin\AppData\Local\DriverWebUpdate" "C:\Users\Admin\AppData\Local\DriverWebUpdate\updaterdriveon.exe""
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5168

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:2632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HTCTL32.DLL

Path C:\Users\Admin\AppData\Local\DriverWebUpdate\HTCTL32.DLL
Size 320KB
SHA256 edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796
MD5 2d3b207c8a48148296156e5725426c7f
SHA1 ad464eb7cf5c19c8a443ab5b590440b32dbc618f
SHA512 55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c
SSDEEP 6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg
TLSH
T150646C21BD80C031F2966075C5BDDBBA0D6DB470376860DBBBD909B96F686D3663830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR100.dll

Path C:\Users\Admin\AppData\Local\DriverWebUpdate\MSVCR100.dll
Size 755KB
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
TLSH
T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSM.LIC

Path C:\Users\Admin\AppData\Local\DriverWebUpdate\NSM.LIC
Size 257B
SHA256 ad0d05305fdeb3736c1e8d49c3a6746073d27b4703eb6de6589bdc4aa72d7b54
MD5 390c964070626a64888d385c514f568e
SHA1 a556209655dcb5e939fd404f57d199f2bb6da9b3
SHA512 f089c59a24f33410cf98fba7ea0dd2ca0fd997efc9a03e5355cde3c1a1f4a78b13cebd387099b9de824bffea01c489d8f0e90df56f89973007dabb6afdde607f
TLSH
T1EAD02B8AA1225037078102617EA495AF81C5A1188758B954B5A816255CA56301B9D0AC
MD5 SHA1 SHA512 TLSH

Submit Download

NSM.ini

Path C:\Users\Admin\AppData\Local\DriverWebUpdate\NSM.ini
Size 6KB
SHA256 60fe386112ad51f40a1ee9e1b15eca802ced174d7055341c491dee06780b3f92
MD5 88b1dab8f4fd1ae879685995c90bd902
SHA1 3d23fb4036dc17fa4bee27e3e2a56ff49beed59d
SHA512 4ea2c20991189fe1d6d5c700603c038406303cca594577ddcbc16ab9a7915cb4d4aa9e53093747db164f068a7ba0f568424bc8cb7682f1a3fb17e4c9ec01f047
SSDEEP 96:B6pfGAtXOdwpEKyhuSY92fihuUhENXh8o3IFhucOi49VLO9kNVnkOeafhuK7cwo4:BnwpwYFuy6/njroYbe3j1vlS
TLSH
T123D1FD82234B43B154763755DBF6B8F5CB25095E46B36421B2AE4C4E13BA836C38B0FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCICL32.dll

Path C:\Users\Admin\AppData\Local\DriverWebUpdate\PCICL32.dll
Size 3.6MB
SHA256 63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8
MD5 00587238d16012152c2e951a087f2cc9
SHA1 c4e27a43075ce993ff6bb033360af386b2fc58ff
SHA512 637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226
SSDEEP 49152:cTXNZ+0ci2aYNT8wstdAukudJ1xTvIZamclSp+73mPu:cTXNo0cpKwstTJIkS43mm
TLSH
T125060831E544CC72E156407ADC7DAADD41162DA00F1886EF398EB9692FF23C422F9E5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TCCTL32.DLL

Path C:\Users\Admin\AppData\Local\DriverWebUpdate\TCCTL32.DLL
Size 387KB
SHA256 6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea
MD5 eab603d12705752e3d268d86dff74ed4
SHA1 01873977c871d3346d795cf7e3888685de9f0b16
SHA512 77de0d9c93ccba967db70b280a85a770b3d8bea3b707b1abb037b2826b48898fec87924e1a6cce218c43478e5209e9eb9781051b4c3b450bea3cd27dbd32c7f3
SSDEEP 12288:OpwbUb48Ju0LIFZB4Qaza4yFaMHAZtJ4Yew2j/bJa+neNQ:epq7BaGIn4BbLneNQ
TLSH
T118849E20BA40C13AF1D61075C6BCDFBA7DADB470176851CB6BD509BA4F582E2E63834B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client32.ini

Path C:\Users\Admin\AppData\Local\DriverWebUpdate\client32.ini
Size 535B
SHA256 c911c67af72a312348eb212e99eac49018ecd7a88f971ac66ac03ba202421b6d
MD5 05fcb2244172bd2e42aaa3c5c4cc5279
SHA1 883b642faa4fb19630f5c62ad4a96496a4a2b72b
SHA512 f09ffd8ab7e7fd997966a04a2e2f3f25a05b226460aec3ee91e6d7940a125e9e083928c14393a2d55b6310381597cb8c3d33e0d51c060c0255c40fa365bd1b3f
TLSH
T13AF08B21260BED6E019AB2D6B6B401C12FD34010E18938219704694F6F31C2684EEC98
MD5 SHA1 SHA512 TLSH

Submit Download

nskbfltr.inf

Path C:\Users\Admin\AppData\Local\DriverWebUpdate\nskbfltr.inf
Size 328B
SHA256 d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368
MD5 26e28c01461f7e65c402bdf09923d435
SHA1 1d9b5cfcc30436112a7e31d5e4624f52e845c573
SHA512 c30ec66fecb0a41e91a31804be3a8b6047fc3789306adc106c723b3e5b166127766670c7da38d77d3694d99a8cddb26bc266ee21dba60a148cdf4d6ee10d27d7
TLSH
T147E0260E4C8292345B93769A631349A293B40060D8B60A4034EB4A35314F08F028A1BF
MD5 SHA1 SHA512 TLSH

Submit Download

pcicapi.dll

Path C:\Users\Admin\AppData\Local\DriverWebUpdate\pcicapi.dll
Size 32KB
SHA256 9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917
MD5 dcde2248d19c778a41aa165866dd52d0
SHA1 7ec84be84fe23f0b0093b647538737e1f19ebb03
SHA512 c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166
SSDEEP 768:FFvNhAyi5hHA448qZkSn+EgT8To1iTYiu:FCyoHA448qSSzgI2GQ
TLSH
T14EE27EC59A88A493F9C94C7571EEEB375C3976F0675400D3B2A682B91AD83F2347821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcichek.dll

Path C:\Users\Admin\AppData\Local\DriverWebUpdate\pcichek.dll
Size 18KB
SHA256 313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a
MD5 a0b9388c5f18e27266a31f8c5765b263
SHA1 906f7e94f841d464d4da144f7c858fa2160e36db
SHA512 6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd
SSDEEP 192:1ANeiOT8Z2b6SoVF6RRHaPrpF3o47jtd3hfwHjvud3hfwx7bjuh:1ANt+E2exrpxTSDuTuih
TLSH
T15D821BD21F696503EBE24E7161EADA165D36B6D0AB74C0EF307581452EC0BE03E6931F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remcmdstub.exe

Path C:\Users\Admin\AppData\Local\DriverWebUpdate\remcmdstub.exe
Size 75KB
SHA256 6558b3307215c4b73fc96dc552213427fb9b28c0cb282fe6c38324f1e68e87d6
MD5 1768c9971cea4cc10c7dd45a5f8f022a
SHA1 3d199bee412cbac0a6d2c4c9fd5509ad12a667e7
SHA512 f83bf23abce316cb1b91a0ac89c1a709a58a7ec49c8493140ad7dc7a629e8f75032057889e42be3091cf351760348380634f660c47a3897f69e398849ca46780
SSDEEP 1536:SfafvTuNOwphKuyUHTqYXHhrXH4LLIywmoEee/wjHnee/ssjHai:kafLSpAFUzt0LLIywYehjHeyjH
TLSH
T1D6738E163A65C033EA424D3464F8D6635E7EB96349F9908BBB58077D1FA03C06F6873A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updaterdriveon.exe

Path C:\Users\Admin\AppData\Local\DriverWebUpdate\updaterdriveon.exe
Size 117KB
SHA256 06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268
MD5 ee75b57b9300aab96530503bfae8a2f2
SHA1 98dd757e1c1fa8b5605bda892aa0b82ebefa1f07
SHA512 660259bb0fd317c7fb76505da8cbc477e146615fec10e02779cd4f527aeb00caed833af72f90b128bb62f10326209125e809712d9acb41017e503126e5f85673
SSDEEP 768:zfVZl6FhWr80/SqUr2pe/3NPHDHf/ckvKoGr2pe/kCHDHf/ckPG:z70hGaq0ee/3hjHTIee/djHC
TLSH
T1ECC3B34F469DE173EA42E97CC4819B050DA4BEC9B8B458FB005EF63E3E3178E2B5415A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

handler.bat

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\runtime\handler.bat
Size 1KB
SHA256 c880ea99f37ac65a6e9c30ff4630f51a52e8555b09fbdd543c2f9d99c2c21897
MD5 eff1d19097b5a3814228a6789dfecc34
SHA1 1c4f8f2b4eb592145e21bd51a5b30f0fc768be19
SHA512 49269988677f37761a7c687d82c56838bc9b6434ef51ff572da132275718a1b9d3e4351611436576ec75c9f4716a8670d56fcf263149c1e2b1b3c3d2e42ff067
TLSH
T1973181AB85C0CDF2E57919CC32070C4662A5512684AB2F7045DB48ABF196DFC558F6CE
MD5 SHA1 SHA512 TLSH

Submit Download

watchdog.vbs

Path C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\runtime\watchdog.vbs
Size 210B
SHA256 4890b10902c7d2003d43a3f03b1a392798ac420fe5b30954a21bc767cb9ef657
MD5 c67eeaa7f925ade16991e4db7802e863
SHA1 1095c6df8fc12b90e15743af7f04390bca2e6fd6
SHA512 2ca66412cf0935f393509f863a14597fad2e899fc0fbc3196fa0afe0ab15f44c03ccd5410d3008fcb3bdbc349db0b7ab4c84c9cac9d60435e401ff3d7aeffe4a
TLSH
T1A6D0228C7848C4E4A636A5CE1436502C8AB4A6EB08C3DD100D00DA1E2260E700B1C40B
MD5 SHA1 SHA512 TLSH

Submit Download

dl_5sij9w.ps1

Path C:\Users\Admin\AppData\Local\Temp\dl_5sij9w.ps1
Size 781B
SHA256 e2c3e475b4d624870aa1a80d68a121b6982c93d1f69f2a1120ce99277d7f75ff
MD5 a59a42d863963dc93a9df1ebb44246d5
SHA1 f161899354bb82369ecedbb0cab863e043bbc51a
SHA512 8bc585c804e859680fcbfc018592f2f7b21b71ad3074c6dce1753a33fd753d1e3068dc953f849f86a611c56cefd93948ca45936adbcecc998afa1cf960da665e
TLSH
T19201F14781CECBBE8C19405B5A7B1B9DC49114153B133F20A361CB0DB78146DE8C7697
MD5 SHA1 SHA512 TLSH

Submit Download

pkg_5sij9w.tar.gz

Path C:\Users\Admin\AppData\Local\Temp\pkg_5sij9w.tar.gz
Size 2.1MB
SHA256 2ba87d50c09a6b3c420a114584d20502ce0fe2a8bb90fcd8f9064d21beb6f654
MD5 3281038ba727a91ad9818ba0f73ba634
SHA1 cdb888815c6782348df2386d30e53e348996c023
SHA512 ba736d60afa7884d5a4159ffbcc133488f1aea4e1a306d90b9a5d31e1e8b851034829926d86d611d722e19e66f9353ff4eeaf83ef7637c8bd3983ed3790ef1aa
SSDEEP 49152:txvD6wVNVERdIShmION+EmufvLAXaTer5SwhBN82:DDzuRrON+QCaTeowt82
TLSH
T160A533A40EF2642DF3FA1173D32EED8857EA89925DD1C02EBC7DF05D05072BAA64509B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2404-23-0x0000000006550000-0x000000000656E000-memory.dmp

Download

memory/2404-44-0x00000000087D0000-0x0000000008D8A000-memory.dmp

Download

memory/2404-43-0x0000000007A40000-0x0000000007A62000-memory.dmp

Download

memory/2404-42-0x0000000007AA0000-0x0000000007B36000-memory.dmp

Download

memory/2404-27-0x0000000006A90000-0x0000000006AAA000-memory.dmp

Download

memory/2404-26-0x0000000007B90000-0x000000000820C000-memory.dmp

Download

memory/2404-24-0x0000000006590000-0x00000000065DC000-memory.dmp

Download

memory/2404-13-0x0000000070BF2000-0x0000000070BF3000-memory.dmp

Download

memory/2404-22-0x0000000006100000-0x000000000645B000-memory.dmp

Download

memory/2404-61-0x0000000070BE0000-0x000000007139C000-memory.dmp

Download

memory/2404-19-0x0000000005FD0000-0x0000000006036000-memory.dmp

Download

memory/2404-18-0x0000000005910000-0x0000000005976000-memory.dmp

Download

memory/2404-17-0x0000000005870000-0x0000000005892000-memory.dmp

Download

memory/2404-16-0x0000000005980000-0x0000000005FCA000-memory.dmp

Download

memory/2404-15-0x0000000070BE0000-0x000000007139C000-memory.dmp

Download

memory/2404-14-0x0000000003050000-0x0000000003086000-memory.dmp

Download