netsupport | 103effef80a10ca75f5ea953064c97fa1439afb3152c8451ffb37bb9bc8b6699

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
update.msi
Size 10KB
Sample261030-afwepsvs2p
SHA256 103effef80a10ca75f5ea953064c97fa1439afb3152c8451ffb37bb9bc8b6699
MD5 030dee8ba94898ae56fca2f8c0305b11
SHA1 675b0e67005ee80e617ac821628cf4ca837a389a
SHA512 ef5deae67cd986107342f53657b9b2a654dd066cfc5e5a5eb0e0cec365018e60858c27dda7734659eb795210bac57830ef43b6c5401b32c6865796c321b3e4ed
SSDEEP 96:5yWVNmdQhGAL/FCwQlM5Wu+8zL5Ezd2zffr/StJKsSJtUBysIBxjbKSd95ApC9o2:xSAz4wvTzL5E2niz2UBBqcSNW0E8SA
TLSH
T15F22F689B9018A32D0416B314AA71B4957762C40CF9F12177BBDB35C9FBA4E072A93E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution netsupport installer persistence privilege_escalation ransomware rat

Malware Config

Signatures

Family: NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3272	powershell.exe
3272	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
13	1460	MsiExec.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3156	netsh.exe
4956	netsh.exe
4100	netsh.exe

Executes dropped EXE 12 IoCs

pid	Process
4984	OnEDrivESETup.exe
5004	OnEDrivESETup.tmp
2840	Twake.exe
2056	Twake.exe
1312	Twake.exe
5088	Twake.exe
5616	Twake.exe
1204	Twake.exe
4132	OHN_new_26101.exe
4604	client32.exe
700	client32.exe
4560	client32.exe

Loads dropped DLL 27 IoCs

pid	Process
2840	Twake.exe
2056	Twake.exe
1312	Twake.exe
2056	Twake.exe
2056	Twake.exe
2056	Twake.exe
2056	Twake.exe
5088	Twake.exe
5616	Twake.exe
1204	Twake.exe
5616	Twake.exe
5616	Twake.exe
5616	Twake.exe
5616	Twake.exe
4604	client32.exe
4604	client32.exe
4604	client32.exe
4604	client32.exe
4604	client32.exe
700	client32.exe
700	client32.exe
700	client32.exe
700	client32.exe
4560	client32.exe
4560	client32.exe
4560	client32.exe
4560	client32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Twake Desktop = "C:\\Users\\Admin\\AppData\\Local\\MegaPackQuickApper\\Twake.exe"	Twake.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Twake Desktop = "C:\\Users\\Admin\\AppData\\Local\\MegaPackQuickApper\\Twake.exe"	Twake.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
13	1460	MsiExec.exe
14	1460	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\NetSupport\NetSupport Manager\NSM.ini	OHN_new_26101.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicapi.dll	OHN_new_26101.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.ini	OHN_new_26101.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport Manager\client32u.ini	OHN_new_26101.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport Manager\PCICL32.DLL	OHN_new_26101.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport Manager\remcmdstub.exe	OHN_new_26101.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport Manager\AudioCapture.dll	OHN_new_26101.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe	OHN_new_26101.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport Manager\HTCTL32.DLL	OHN_new_26101.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport Manager\msvcr100.dll	OHN_new_26101.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport Manager\NSM.LIC	OHN_new_26101.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport Manager\TCCTL32.DLL	OHN_new_26101.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport Manager\nskbfltr.inf	OHN_new_26101.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport Manager\nsm_vpro.ini	OHN_new_26101.exe
File created	C:\Program Files (x86)\NetSupport\NetSupport Manager\PCICHEK.DLL	OHN_new_26101.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59f7a5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59f7a5.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD0A8A0FB3CC84176.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF65E75B96B27B1C49.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5AA2211DD6AD014D.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1296	msiexec.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4496	cmd.exe
2044	cmd.exe
3412	cmd.exe
2984	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Twake.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	client32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	client32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	client32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Twake.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Twake.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Twake.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Twake.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	client32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Twake.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Twake.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Twake.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OnEDrivESETup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OnEDrivESETup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4984-37-0x0000000000680000-0x0000000000769000-memory.dmp	innosetup
behavioral2/memory/4984-262-0x0000000000680000-0x0000000000769000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000072eafa9cea60e45e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380172eafa9c0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410172eafa9c000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e372eafa9c00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e672eafa9c00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-19 = "Ultimate Performance"	client32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-15 = "Balanced"	client32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-13 = "High performance"	client32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-11 = "Power saver"	client32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	13	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	14	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
700	client32.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
4604	client32.exe
4604	client32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1296	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1296	msiexec.exe
Token: SeSecurityPrivilege	5048	msiexec.exe
Token: SeCreateTokenPrivilege	1296	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1296	msiexec.exe
Token: SeLockMemoryPrivilege	1296	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1296	msiexec.exe
Token: SeMachineAccountPrivilege	1296	msiexec.exe
Token: SeTcbPrivilege	1296	msiexec.exe
Token: SeSecurityPrivilege	1296	msiexec.exe
Token: SeTakeOwnershipPrivilege	1296	msiexec.exe
Token: SeLoadDriverPrivilege	1296	msiexec.exe
Token: SeSystemProfilePrivilege	1296	msiexec.exe
Token: SeSystemtimePrivilege	1296	msiexec.exe
Token: SeProfSingleProcessPrivilege	1296	msiexec.exe
Token: SeIncBasePriorityPrivilege	1296	msiexec.exe
Token: SeCreatePagefilePrivilege	1296	msiexec.exe
Token: SeCreatePermanentPrivilege	1296	msiexec.exe
Token: SeBackupPrivilege	1296	msiexec.exe
Token: SeRestorePrivilege	1296	msiexec.exe
Token: SeShutdownPrivilege	1296	msiexec.exe
Token: SeDebugPrivilege	1296	msiexec.exe
Token: SeAuditPrivilege	1296	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1296	msiexec.exe
Token: SeChangeNotifyPrivilege	1296	msiexec.exe
Token: SeRemoteShutdownPrivilege	1296	msiexec.exe
Token: SeUndockPrivilege	1296	msiexec.exe
Token: SeSyncAgentPrivilege	1296	msiexec.exe
Token: SeEnableDelegationPrivilege	1296	msiexec.exe
Token: SeManageVolumePrivilege	1296	msiexec.exe
Token: SeImpersonatePrivilege	1296	msiexec.exe
Token: SeCreateGlobalPrivilege	1296	msiexec.exe
Token: SeBackupPrivilege	3956	vssvc.exe
Token: SeRestorePrivilege	3956	vssvc.exe
Token: SeAuditPrivilege	3956	vssvc.exe
Token: SeBackupPrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeRestorePrivilege	5048	msiexec.exe
Token: SeTakeOwnershipPrivilege	5048	msiexec.exe
Token: SeBackupPrivilege	3292	srtasks.exe
Token: SeRestorePrivilege	3292	srtasks.exe
Token: SeSecurityPrivilege	3292	srtasks.exe
Token: SeTakeOwnershipPrivilege	3292	srtasks.exe
Token: SeBackupPrivilege	3292	srtasks.exe
Token: SeRestorePrivilege	3292	srtasks.exe
Token: SeSecurityPrivilege	3292	srtasks.exe
Token: SeTakeOwnershipPrivilege	3292	srtasks.exe
Token: SeDebugPrivilege	3272	powershell.exe
Token: SeIncreaseQuotaPrivilege	3272	powershell.exe
Token: SeSecurityPrivilege	3272	powershell.exe
Token: SeTakeOwnershipPrivilege	3272	powershell.exe
Token: SeLoadDriverPrivilege	3272	powershell.exe
Token: SeSystemProfilePrivilege	3272	powershell.exe
Token: SeSystemtimePrivilege	3272	powershell.exe
Token: SeProfSingleProcessPrivilege	3272	powershell.exe
Token: SeIncBasePriorityPrivilege	3272	powershell.exe
Token: SeCreatePagefilePrivilege	3272	powershell.exe
Token: SeBackupPrivilege	3272	powershell.exe
Token: SeRestorePrivilege	3272	powershell.exe
Token: SeShutdownPrivilege	3272	powershell.exe
Token: SeDebugPrivilege	3272	powershell.exe
Token: SeSystemEnvironmentPrivilege	3272	powershell.exe
Token: SeRemoteShutdownPrivilege	3272	powershell.exe
Token: SeUndockPrivilege	3272	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1296	msiexec.exe
1296	msiexec.exe
700	client32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1296	msiexec.exe
5048	msiexec.exe
1460	MsiExec.exe
2256	explorer.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 3292	5048	msiexec.exe	96
PID 5048 wrote to memory of 1460	5048	msiexec.exe	98
PID 1460 wrote to memory of 3272	1460	MsiExec.exe	99
PID 1460 wrote to memory of 4868	1460	MsiExec.exe	102
PID 2256 wrote to memory of 4984	2256	explorer.exe	104
PID 4984 wrote to memory of 5004	4984	OnEDrivESETup.exe	105
PID 5004 wrote to memory of 2840	5004	OnEDrivESETup.tmp	106
PID 2840 wrote to memory of 2056	2840	Twake.exe	107
PID 2840 wrote to memory of 2056	2840	Twake.exe	107
PID 2840 wrote to memory of 1312	2840	Twake.exe	108
PID 2840 wrote to memory of 4496	2840	Twake.exe	111
PID 5088 wrote to memory of 5616	5088	Twake.exe	113
PID 5088 wrote to memory of 5616	5088	Twake.exe	113
PID 5088 wrote to memory of 1204	5088	Twake.exe	114
PID 4496 wrote to memory of 4132	4496	cmd.exe	115
PID 4132 wrote to memory of 2044	4132	OHN_new_26101.exe	117
PID 2044 wrote to memory of 3156	2044	cmd.exe	119
PID 4132 wrote to memory of 3412	4132	OHN_new_26101.exe	120
PID 4604 wrote to memory of 700	4604	client32.exe	122
PID 3412 wrote to memory of 4956	3412	cmd.exe	123
PID 4132 wrote to memory of 2984	4132	OHN_new_26101.exe	125
PID 2984 wrote to memory of 4100	2984	cmd.exe	127
PID 4132 wrote to memory of 4560	4132	OHN_new_26101.exe	128

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\update.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1296

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3292
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C0826917103AE6C4B1110FC63A25AB5B
  2⤵
  - Downloads MZ/PE file
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -com "ADd-MPPREFEreNCE -EXCLUsiOnPaTH 'C:\Users\Admin\AppData\Local\dEPLOyradB2DBA\' -ExcLUsiOnPROCess 'OnEDrivESETup.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3272
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\System32\explorer.exe" "C:\Users\Admin\AppData\Local\dEPLOyradB2DBA\OnEDrivESETup.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4868

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\dEPLOyradB2DBA\OnEDrivESETup.exe
  "C:\Users\Admin\AppData\Local\dEPLOyradB2DBA\OnEDrivESETup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Users\Admin\AppData\Local\Temp\is-9BFRVYLGTL.tmp\OnEDrivESETup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-9BFRVYLGTL.tmp\OnEDrivESETup.tmp" /SL5="$12019C,89951555,893952,C:\Users\Admin\AppData\Local\dEPLOyradB2DBA\OnEDrivESETup.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Users\Admin\AppData\Local\MegaPackQuickApper\Twake.exe
      "C:\Users\Admin\AppData\Local\MegaPackQuickApper\Twake.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\Users\Admin\AppData\Local\MegaPackQuickApper\Twake.exe
        
        "C:\Users\Admin\AppData\Local\MegaPackQuickApper\Twake.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Twake Desktop" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1828,i,2729177730912367623,2541799033369605482,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\MegaPackQuickApper\Twake.exe
        
        "C:\Users\Admin\AppData\Local\MegaPackQuickApper\Twake.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Twake Desktop" --field-trial-handle=2116,i,2729177730912367623,2541799033369605482,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:11
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        
        PID:1312
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\1793319072759\OHN_new_26101.exe""
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\1793319072759\OHN_new_26101.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1793319072759\OHN_new_26101.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="client32"
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule name="client32"
        8⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="client32" dir=in action=allow program="C:\Program Files (x86)\NetSupport\NetSupport Manager\\client32.exe" enable=yes
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3412
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="client32" dir=in action=allow program="C:\Program Files (x86)\NetSupport\NetSupport Manager\\client32.exe" enable=yes
        8⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="client32_out" dir=out action=allow program="C:\Program Files (x86)\NetSupport\NetSupport Manager\\client32.exe" enable=yes
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="client32_out" dir=out action=allow program="C:\Program Files (x86)\NetSupport\NetSupport Manager\\client32.exe" enable=yes
        8⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4100
        
        C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe
        
        "C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:4560

C:\Users\Admin\AppData\Local\MegaPackQuickApper\Twake.exe
C:\Users\Admin\AppData\Local\MegaPackQuickApper\Twake.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Local\MegaPackQuickApper\Twake.exe
  "C:\Users\Admin\AppData\Local\MegaPackQuickApper\Twake.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Twake Desktop" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2056,i,6443040949385556120,11007034980029884046,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5616
- C:\Users\Admin\AppData\Local\MegaPackQuickApper\Twake.exe
  "C:\Users\Admin\AppData\Local\MegaPackQuickApper\Twake.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Twake Desktop" --field-trial-handle=2416,i,6443040949385556120,11007034980029884046,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:11
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  PID:1204

C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe
"C:\Program Files (x86)\NetSupport\NetSupport Manager\\client32.exe" /* *
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe
  "C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe" * /VistaUI
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  PID:700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HTCTL32.DLL

Path C:\Program Files (x86)\NetSupport\NetSupport Manager\HTCTL32.DLL
Size 393KB
SHA256 08551f8c725f43cbc75c288758c62e98c4d3dcad55b1f0f0dca7381bd1cd9509
MD5 b7c9df7149c0bb74e03a2ecaf3b9d337
SHA1 fa3fe9641742a9f6bede1c5bd2d593fe82638e67
SHA512 73678ad03a9d0fa812ca44f6ff4654aea165b5be9f71dc6c028ffc3e32010c3d110fb3855fccfaf40850973eb2e8e3f3d487a97be1ff85d9b4c7921dfe2fc26b
SSDEEP 12288:3eqpI9fZlvKNnN95X963QfVWuiHvho+Gw+Yy5vGYoHjJPneV:3eG9N6iW2+0tmPneV
TLSH
T162847D20BA80C132F6DA6275C6BCDF761DBDB431272460CB57DA0DB91EA46D3A63434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSM.LIC

Path C:\Program Files (x86)\NetSupport\NetSupport Manager\NSM.LIC
Size 258B
SHA256 02a0558b2673647c0d3f2226e8d2db56b0cf78a90296b469d8edab1d9c03c57b
MD5 6844a2027b320a77dbf9c3c0cc494644
SHA1 f76b0055715a8b4f5a6d2cc4b7162ee6bd88e4d1
SHA512 9e2ae8f13f775fa195ca0f5fda270e916ada202e08735263a82ae7d4bb5d0f59cb0d188ebea1aa216bba9ae00511bf709707a60fc6529940c57da3fd9b2c89a9
TLSH
T1EBD0EBC98213103A039205E13FB0A46EA2CC8010C71C2810B8EC1D262A545280ACE05C
MD5 SHA1 SHA512 TLSH

Submit Download

PCICHEK.DLL

Path C:\Program Files (x86)\NetSupport\NetSupport Manager\PCICHEK.DLL
Size 18KB
SHA256 1691bcf9863823cc812f845522c6b8a786aac85771051dbc163982da9550af1e
MD5 74883b62b3976ae2795070efaa9cb683
SHA1 136fc24e5bda3be14026141b1a6f088d9a55ad21
SHA512 2e7d4d42ccc9f124011074a7fd98d10b2c2d5bf34ac407d60977be54d3e20fb64e470c0b9d39c37db60cd74b08f4f70cdaed3c5cb91cb2c31c690bc777f7b0fd
SSDEEP 192:L19wcbyJJRAjhZ/g6eVF6RRHjPrvF3vo7jftvJcwwXUjJsztvJcwwk87bjuibij:XwIyJwjhZ/+mrv4tVEUuztVKimij
TLSH
T1A4820AC62BA93112EAE34EB4A1E9D21A4D36F2D06B7480DF306A81451EC0BE07A7531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCICL32.dll

Path C:\Program Files (x86)\NetSupport\NetSupport Manager\PCICL32.dll
Size 3.7MB
SHA256 26ced83b93e8379957e7d240ba7acefb000c9ad992e41c2a1efaf9d634d4d98a
MD5 a0c69b3d13b8037268353bcf4e9c7d10
SHA1 2b4a0d696ab418d6a6bef253e214afbd07090415
SHA512 3f59c6dc7616c1de37bb28a5040e598d8283d01ede2c5190db55a645f1c0dade895f146c54aacb688c531b3a587203a29aeca2dbdc0a9a1fa11a6d2af05bdcfb
SSDEEP 49152:AhX6N/O3C8dxzwD4lV8S0dltkTLavcOSENZM:Mt3C8vwDsVR0dlnSwM
TLSH
T1D2060731E584C871E1660079DC7DAADC061B6DB04F2981DF298EB95D2EF23C426F4E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client32.exe

Path C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe
Size 118KB
SHA256 6e9d2c12abd5d8a7aff5806b431be95c747bcf4e03474fea14286b068fc79a09
MD5 6ab3cb9161259f2f9a8841b81c88d63d
SHA1 eed83ace832f0eee38f5b3e4e75d508bd24fd93e
SHA512 e2ea7b18e1f0dcb0feb1fe85e776f46f8117a4026b1aa17f3106c39d040a5da7f743d1e3af6fce3fc9f43f73f56c9b1f8d19ec4b08ff121813cb25d8abef505d
SSDEEP 768:EEVZl6FhWr80/FK32bhu7+TV+wT2bhuCRyTV+wbGo:EG0hGNK32hu7bwT2huGvwSo
TLSH
T17DC3B34F4299A073EA42DA7DC8859B010C64BDC9B9F458FB505EF63E3E3178E2B6405A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client32u.ini

Path C:\Program Files (x86)\NetSupport\NetSupport Manager\client32u.ini
Size 734B
SHA256 72548814fd6e7efe9cdc6fe02422f6a592e7b9ef13822b8ae56efd0525f26715
MD5 48bde9e21748bfae7ea4198947ffdac8
SHA1 9c196b0155ca455008b97e3f05ac6b057b052374
SHA512 1db458ba853c05857c04941aa2b2ddb8efc8675522f2c2d31604cf3fbcf0ef6380e87c48d466476cbfedfe053ee49f8af6ac13f5de1d935bd49ea94a0eaa0617
TLSH
T1ED011022134BBE5D180FF2C1F5B404801FD34541E16EBA30D6486C0E8F326BD0AEF864
MD5 SHA1 SHA512 TLSH

Submit Download

msvcr100.dll

Path C:\Program Files (x86)\NetSupport\NetSupport Manager\msvcr100.dll
Size 755KB
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
TLSH
T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcicapi.dll

Path C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicapi.dll
Size 34KB
SHA256 d856d76fe4c3ef09573ac41d9dda93abc194666a5d593f59614ea9dca676ba2f
MD5 069857ce1335a97ac18a63f3c9e60fd7
SHA1 44da10785f1ec93292bd4fc9d769e64774e9e17b
SHA512 4bf866ae8d61d5219c6a1c80f26c2d146269cf223909f0bb1373ed6a1f0abd068fb5974941ccac6c1c757607a4d692f4b5ccf56947de4a5fbf7d1d002207a71b
SSDEEP 768:WDxJCw72OkRIStu7EQzsTDLoHin+oIZ03tV+tVqiIh+:WDxYK2JtW/zsTDlvIZ03P+Pgh+
TLSH
T19BF26D82BB589053F5E20DB9B1E9DA275C3D76B01BA580C7B1A7818E5ED03F23539317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\MegaPackQuickApper\ffmpeg.dll
Size 2.6MB
SHA256 56c53e5517bd9fd84bedafa172bdc20244e59f6ffde6a0b6d0f37d30bcaf184e
MD5 d11a523a286b90e08e004f7a684f7e2b
SHA1 ec690b63a05de7e61b2f48ab1dfe6e56a5ce5deb
SHA512 d42a337f5a891771e4284ca25b0abf07113c75af37885386b029d19d56549a5684964658fdb5a71a4ad9dfefda8f277ae4214ec660182d3c710cf368c14e7ea2
SSDEEP 49152:+1nRu1gjn93AXtsX7I8g4AScbz6Ox+pen6yfmb+ST1PqRrYdz:+Jsf83Sn6Ox+tP5dz
TLSH
T19DC5AE13F6D540DDD02AC0748B9F9623F63038468B24A6EF16909A243F6BFD42E7E765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\MegaPackQuickApper\libEGL.dll
Size 480KB
SHA256 1bb09a77dbcf790f5e13d7d91cd3852b80cce1731450f0be79ddb2cde9a40702
MD5 e9965f87aa6c53a94ff06c019a18c991
SHA1 94c3f020062a16a75dfde0fa5c73abc7388d8dfb
SHA512 56dc5d681ecd59373964545f987cca813edc030c5288b7c9901e789f8ae9000a7b4fc1aa47c56c9a436fecb5288cd4505d1b54d876281b8abe9ca4288b833bac
SSDEEP 6144:Rmi12qlTgeUDsnkcM2nDl83BgENhYCqNWfY24Mr:Rmk2qxgeUDsNnDcgENhYRNWfUE
TLSH
T1B1A48D15B7D444A8E02BD134CA574642EA76B4920F65FBDF02A493392F7BBF85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\MegaPackQuickApper\libGLESv2.dll
Size 7.7MB
SHA256 0b61ec41e8fc31c6e16937721d5b662a9ba4e375a5f6ab1f22555430929a61fa
MD5 d511c803c03c9e5d5cb60a309f725f97
SHA1 a5457a260a2e4de695710a195b08d05fb09823b0
SHA512 4616e2f75510282508c53c3dc2a4d629c4ce4f0f720f110eb4d8c455bf4ee61c0b7cf64a29a5b5affdf9413a94c012960b2d4193799bda6402a288073834d397
SSDEEP 98304:/PqhbsPD8TDyGDsTnI5mvmKGtS17QXC3O1:/P4m8TDyluKGugmO1
TLSH
T1C0868B03F69680D9C04DD2B5975B9227FA35B8840B34B6CF265423253F77BE0AB7AB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\MegaPackQuickApper\vk_swiftshader.dll
Size 5.2MB
SHA256 939f9a2f9114dddc544de007a0267f443dd78202798fb57c11fcb1ea0bfd2fd7
MD5 402c9b4f0ee4a6df1e646dda9b21488d
SHA1 f073e8336aae4db3882107f982359824b3428e66
SHA512 e985309b813fbcc91f09b360c2b58658008f4b083986e74440f0f752ca1a99490964a6a9625c72ceee721fde1a5ed7787e1c4626e9b6c580520f3bd98ef69694
SSDEEP 49152:WgQpJ5yZBtfCp00oSO8hCsDsbJQk/tJ4q0nLhII1ytiT45z+WEjNHsRLf7OFJOM5:+n5yZBXLxkf5FJIaywX
TLSH
T146463903B2858099F05DD1B9474BA623F632F8801B72B6DF52A41F192E77FE06B39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\MegaPackQuickApper\vulkan-1.dll
Size 948KB
SHA256 6e94fefa6bff142e17e4dbbf9619d30e504ad9d6b6636c9da1fb635657a9c03d
MD5 6c501b6986deb1349bea0860b4ded823
SHA1 4abc5b1980aa9276c6e6e4288808653424b91fc8
SHA512 427c42c87c336e765f149c2a62dc8843bb2c6d33ae6af97e55f42612b829e2132c46d340288ba2dd15dbc83c4ecf8dbcbab0082fdf31ef154cfeaf3214955625
SSDEEP 24576:9awxZ1onv5Sp+D9R6StDWb36Z5W1DYsHq6g3P0zAk7Mhz:4SSApY90IDWb36Z5W1DYsHq6g3P0zAkc
TLSH
T1E4255C23AA94456AD476D034D9828603CAB178911726B9CF03B81708BF6FFF4777DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OHN_new_26101.exe

Path C:\Users\Admin\AppData\Local\Temp\1793319072759\OHN_new_26101.exe
Size 5.8MB
SHA256 d41a9f7d2cc79d4b2e722e4c8bdd097da25498acb297eda7a9d96aaa536753d5
MD5 843e33858659064b9dda19d611c4ac2d
SHA1 75d47c3445a95faa391cced293a0fb98c27a76a3
SHA512 529205212053ddb4302341b4d0cdbc4d369f2b3353d3cf99d6fa059ad6d7cc888a8f833e77b52bde8cedb01046617bd6d992c0686b2e94dd5cb5697204bbba9b
SSDEEP 98304:pVRsn1INbig+r7jZZYd9n2Z6a86wsXaS8JEObRuD2fTfwn5gDnqZShcyQcIA52bO:uJ3g92oHUqde2f7G8qZVl42R
TLSH
T1B35633467B727FE8C43280769207FE0E66667D940328D9F72B936B6E3C799D04937124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Update.lnk

Path C:\Users\Admin\AppData\Local\Temp\Update.lnk
Size 922B
SHA256 69d1594974eaf6e5a92eb6bbc8a6a78319867dc2d45023ea7f69193684d5afb6
MD5 0d27248240f36e2c3ceb0572467d2182
SHA1 ae57588cbc28214f5ee1b3c9cbec78911baa98bc
SHA512 9a9c0935d824258a684f84cab275b206431a02a53b37e9ce6ad53184238653837028b98296bf8c91993e118d69903a18ba8e8c445d4dea60239271aea0862b44
TLSH
T1B3117D055AE2132CE7A2D63225F52321E93B7C02F3958F0D0046474E2032A102E9CF6F
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_m4t03szk.33s.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m4t03szk.33s.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

OnEDrivESETup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-9BFRVYLGTL.tmp\OnEDrivESETup.tmp
Size 4.2MB
SHA256 b431058957a2101ce982c08a4a59b701170939b36ee990b2b2f91e6ca39c5b24
MD5 6c1196fee56336b84724e5dfed8d0439
SHA1 f2ac70bab2d22867a127a48e76b5fbdc9226e3eb
SHA512 983d71f5471fa74b1076fecd22a2daec0df0497a6d4533e8526fbd0c189843595e7397e4097351998d12ac15ca01e45f35f4cad3cb63ade2081e2912d82a8afd
SSDEEP 98304:5YU5hnuOajWwMPdCpepI3GrwrA+Js333Pj:7xuHjWfZIzej
TLSH
T1BD268F03F388753EE4571A3A583FA280983F7A213915CD4B6BFC295C8F396416D2A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5611a4d9-a348-493b-8693-4178f5440a7f.tmp

Path C:\Users\Admin\AppData\Roaming\Twake Desktop\5611a4d9-a348-493b-8693-4178f5440a7f.tmp
Size 434B
SHA256 bc309f5fd66a8438fd6be01e53304321740709a11ebd7b39bd1bb47e0bb67ae5
MD5 c09245baecc0e67435e1fd4b4b4a7a4a
SHA1 59789a6ebcefb5e8e3c0bbfebd9ba0402b913955
SHA512 e15bf938cc48f07a1a7c7ddafc4441d2ea17b409c315791e081ed34733545bfeb9dbeaa1c532b6b144e884372a5afe8e74add0be32cbbf6c1035ed78960c5b6c
TLSH
T1C2E0AB34ACA269F53B625AF4B322F3121D31022B9B842B683B6F551192EB8B09116F75
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Twake Desktop\Local State
Size 434B
SHA256 17242716803b150ade9aabb72abafdba559e8f5832c4add0b50562d54eb1e068
MD5 a78363dbab517b9716057ddec63efac9
SHA1 278079dc38d3afd0ab46fef4328327a783cd6776
SHA512 3bd7daa453d27303d0662f6b58defafeb31c2cb1182f8fe71741f454105fa2d10ce4b23da99334a81c4d6ec22a001a5d100fc67265077aa9521721ea2b7ef78a
TLSH
T109E08A3109F19D877F3288D2421065414F2014734B5816D06FEFCE0F52FBB505310C31
MD5 SHA1 SHA512 TLSH

Submit Download

daemon.log

Path C:\Users\Admin\AppData\Roaming\daemon.log
Size 8B
SHA256 1f174ec83ab19e39efa1492efc777e8a920ee055b69536c616a9f8492c797244
MD5 581e10f1f983d13ee3b96f324d839946
SHA1 8041012e2b69c02faaf990d133a20565ef693fd7
SHA512 f7ce286c58d6410278e730e1de25bf30dedd50b9f6c98e8f5101361af611646d452cae0ac6c0d0f641af129085d0a346bd96356d47101a7b744c8668b11cf39f
MD5 SHA1 SHA512

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 d38d9fff96c0c197e5669e56142f9a25d80c2af164419a91ab09c4c65b987b1f
MD5 3e2d99054addcab90b2530aca2764653
SHA1 b6f6e6f935037cce0af33e487565f6e31f698386
SHA512 527170d108b7c734bbfc39f97941465b1aafd66338ee3b24a4d6732b96102e12b8a8db771a8cd93f0e8af81f0544f7905ae0c2e351f713dead657b85a76de634
SSDEEP 24576:QFo3DMPVdoO/vvTL/ywuOC1Avb+EFbp90DIM9zw24LA6JZP+MohGenkfauU:EHU
TLSH
T17657E22436F92210E7F79E3CA8F06A234D3A7D5B9C15DE8D45851B4E0822F71E872F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{f059f36f-e1e3-48e0-a96d-27d189e5ec7e}_OnDiskSnapshotProp

Path \??\Volume{9cfaea72-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{f059f36f-e1e3-48e0-a96d-27d189e5ec7e}_OnDiskSnapshotProp
Size 6KB
SHA256 7ccd47ab8c1035c6e4eb7f28483e86bd52013954e0abe0f92edb7d5733cca249
MD5 0594f277567ae0311eb0f8ff5f438ea0
SHA1 bbefbec72db6dd5c89980c0b5ec9dbb56446616d
SHA512 797ed1d2c3d6b05c8a0cf101f3ceed70044b15c83e453ab20b400abbba0f7511b7f44e77bbcb228be8b7e30009a3e40a02295b120a9a8006b0cf33766d40745a
SSDEEP 96:FyJlsqIvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:0VEb++uVm
TLSH
T1F3D1A90C5AE54711E2B3AB3128F18557A877B811EF33CB8E0198238E6670A10F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3272-19-0x0000000006DD0000-0x0000000006E06000-memory.dmp

Download

memory/3272-18-0x0000000005E30000-0x0000000005E7C000-memory.dmp

Download

memory/3272-9-0x00000000028F0000-0x0000000002926000-memory.dmp

Download

memory/3272-10-0x00000000052D0000-0x000000000591A000-memory.dmp

Download

memory/3272-28-0x00000000073C0000-0x0000000007456000-memory.dmp

Download

memory/3272-27-0x00000000071C0000-0x00000000071CA000-memory.dmp

Download

memory/3272-26-0x0000000007150000-0x000000000716A000-memory.dmp

Download

memory/3272-25-0x0000000007790000-0x0000000007E0C000-memory.dmp

Download

memory/3272-24-0x0000000007010000-0x00000000070B3000-memory.dmp

Download

memory/3272-23-0x0000000006410000-0x0000000006430000-memory.dmp

Download

memory/3272-20-0x000000006ECF0000-0x000000006ED3C000-memory.dmp

Download

memory/3272-11-0x0000000005110000-0x0000000005132000-memory.dmp

Download

memory/3272-17-0x0000000005DF0000-0x0000000005E0E000-memory.dmp

Download

memory/3272-16-0x0000000005920000-0x0000000005C7B000-memory.dmp

Download

memory/3272-13-0x0000000005250000-0x00000000052B6000-memory.dmp

Download

memory/3272-12-0x00000000051E0000-0x0000000005246000-memory.dmp

Download

memory/4132-610-0x000002493B290000-0x000002493B33E000-memory.dmp

Download

memory/4984-37-0x0000000000680000-0x0000000000769000-memory.dmp

Download

memory/4984-262-0x0000000000680000-0x0000000000769000-memory.dmp

Download

memory/5004-579-0x0000000000090000-0x00000000004DB000-memory.dmp

Download

memory/5004-263-0x0000000000090000-0x00000000004DB000-memory.dmp

Download

memory/5048-5-0x000001FF3E900000-0x000001FF3F2A4000-memory.dmp

Download