nanocore | 751f66bf226c6773d41ee1b16788dc509d64af36206785fd9edb39eaf6028982

Analysis

max time kernel
150s
max time network
159s
platform
windows10_x64
resource
win10v20210408
submitted
14-09-2021 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

751f66bf226c6773d41ee1b16788dc509d64af36206785fd9edb39eaf6028982.exe
Size

1.9MB
MD5

82cb908a68275e3bc35158b546323631
SHA1

4ffe5f66cfc667df8a3acce200199b2a5419a281
SHA256

751f66bf226c6773d41ee1b16788dc509d64af36206785fd9edb39eaf6028982
SHA512

ada9b9053e0cf8ea3d2f5a581366792c2c90a2009c53319f0bb435b915d586beab4d4ae46ed6b51284dc0973cf69418a1c2ab2c2b90cab86afc8e35989dc4729

Score

10^/10

nanocore njrat hacked evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Hacked

gtawins.ddns.net:1177

Mutex

3ce17b94d100323a220dbf54788571e1

Attributes

reg_key
3ce17b94d100323a220dbf54788571e1
splitter
|'|'|

Extracted

Family

nanocore

Version

1.2.2.0

gtawins.ddns.net:2001

Mutex

91e727ee-d078-4218-882c-3f74b732d29c

Attributes

activate_away_mode
true
backup_connection_host
gtawins.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2018-03-24T23:10:56.497932536Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
2001
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
91e727ee-d078-4218-882c-3f74b732d29c
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
gtawins.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
5000
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 5 IoCs

Processes:

svchost.exeDllhost.exe2Cheat Loader.exe2CFUpdater.exe2Cheat Loader.exe

pid process

368 svchost.exe
1116 Dllhost.exe
1320 2Cheat Loader.exe
4136 2CFUpdater.exe
4340 2Cheat Loader.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

pid	process
368	svchost.exe
1116	Dllhost.exe
1320	2Cheat Loader.exe
4136	2CFUpdater.exe
4340	2Cheat Loader.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2Cheat Loader.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	2Cheat Loader.exe

Drops startup file 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3ce17b94d100323a220dbf54788571e1.exe	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3ce17b94d100323a220dbf54788571e1.exe	svchost.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Dllhost.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Subsystem = "C:\\Program Files (x86)\\UPNP Subsystem\\upnpss.exe"	Dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\3ce17b94d100323a220dbf54788571e1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .."	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3ce17b94d100323a220dbf54788571e1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\" .."	svchost.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Dllhost.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Dllhost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Dllhost.exe

Drops file in Program Files directory 2 IoCs

Processes:

Dllhost.exe

description	ioc	process
File created	C:\Program Files (x86)\UPNP Subsystem\upnpss.exe	Dllhost.exe
File opened for modification	C:\Program Files (x86)\UPNP Subsystem\upnpss.exe	Dllhost.exe

Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{2BF8BE25-0C92-40C1-BAA4-5C193E422727}"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 1d24df8b702cd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000b717adf39ff39066f1bb0328084fc0b9afd1fbd4c395e5d97c65832f48a20889dfe70c97242334605f4d5222e75e9f04341a420d867697b05683	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 319b355143a9d701	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 85b2d43743a9d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz!	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0d2c934b43a9d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000c8e6c5626a0a7a1d06eabd313d6401a008a679ab9ddcf83fe744b3f05fe80b9beb6aea10259fa611b9cd9a6660de84a667d87015836548365949306554faea586fd34e1fdd84f643d3bc36124b3199c9b17ff27ede8f8dc0c76a34b8a3b552bd6241eb41265b74b3dbd8c2ecf5fc3fb9e4bb784217fb458e7ec94d9949ba377fe8d3cf090bc3bc92a2410559dde1b4972cad9d723f47a1f96f854847d6a71af5b1ab742cfd5b737bd1177145f37f99c1477323842214c303bdbdf59e5d1e97ee4fe8b91676c5aaaf857af56dcb765023fd2e0b4dc902555d3b930dfdb0bd940871aa2bd141a0fe6cf88a6e5cd0662b2045ffa64eb7b15f809e2569efe925b6a00811cd35ab8bdc4ec26759c509ef13073c047054e5c10ade0995a6b226f7b652fe3ce7733a2840c0ad31657b06b1b31cf95ef15c74d30316cf016786dad10b07a74daae2c6158280a10866e92c4c992dbf2df8db7b855d43448b07c95255fe924663da2aecf48434970cbb584e60feb84192c84032782a53cc517ceffb21f1e15b9e27b43e64b507815d300c608dbca16eabc3d7714ca8742f04be5a9def78cbdf7ce355c060	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

Dllhost.exe2CFUpdater.exe

pid	process
1116	Dllhost.exe
1116	Dllhost.exe
1116	Dllhost.exe
1116	Dllhost.exe
1116	Dllhost.exe
1116	Dllhost.exe
1116	Dllhost.exe
1116	Dllhost.exe
1116	Dllhost.exe
4136	2CFUpdater.exe
1116	Dllhost.exe
1116	Dllhost.exe
1116	Dllhost.exe
1116	Dllhost.exe
1116	Dllhost.exe
1116	Dllhost.exe
1116	Dllhost.exe
1116	Dllhost.exe
1116	Dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Dllhost.exe

pid process

1116 Dllhost.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

2288 MicrosoftEdgeCP.exe
2288 MicrosoftEdgeCP.exe

pid	process
2288	MicrosoftEdgeCP.exe
2288	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

Processes:

2Cheat Loader.exeDllhost.exesvchost.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe2CFUpdater.exe2Cheat Loader.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	1320	2Cheat Loader.exe
Token: SeDebugPrivilege	1116	Dllhost.exe
Token: SeDebugPrivilege	368	svchost.exe
Token: SeDebugPrivilege	504	MicrosoftEdge.exe
Token: SeDebugPrivilege	504	MicrosoftEdge.exe
Token: SeDebugPrivilege	504	MicrosoftEdge.exe
Token: SeDebugPrivilege	504	MicrosoftEdge.exe
Token: 33	368	svchost.exe
Token: SeIncBasePriorityPrivilege	368	svchost.exe
Token: SeDebugPrivilege	868	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	868	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	868	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	868	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4136	2CFUpdater.exe
Token: SeDebugPrivilege	4340	2Cheat Loader.exe
Token: SeDebugPrivilege	4660	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4660	MicrosoftEdgeCP.exe
Token: 33	368	svchost.exe
Token: SeIncBasePriorityPrivilege	368	svchost.exe
Token: 33	368	svchost.exe
Token: SeIncBasePriorityPrivilege	368	svchost.exe
Token: 33	368	svchost.exe
Token: SeIncBasePriorityPrivilege	368	svchost.exe
Token: 33	368	svchost.exe
Token: SeIncBasePriorityPrivilege	368	svchost.exe
Token: 33	368	svchost.exe
Token: SeIncBasePriorityPrivilege	368	svchost.exe
Token: 33	368	svchost.exe
Token: SeIncBasePriorityPrivilege	368	svchost.exe
Token: 33	368	svchost.exe
Token: SeIncBasePriorityPrivilege	368	svchost.exe
Token: 33	368	svchost.exe
Token: SeIncBasePriorityPrivilege	368	svchost.exe
Token: 33	368	svchost.exe
Token: SeIncBasePriorityPrivilege	368	svchost.exe
Token: 33	368	svchost.exe
Token: SeIncBasePriorityPrivilege	368	svchost.exe
Token: 33	368	svchost.exe
Token: SeIncBasePriorityPrivilege	368	svchost.exe
Token: 33	368	svchost.exe
Token: SeIncBasePriorityPrivilege	368	svchost.exe
Token: 33	368	svchost.exe
Token: SeIncBasePriorityPrivilege	368	svchost.exe
Token: 33	368	svchost.exe
Token: SeIncBasePriorityPrivilege	368	svchost.exe
Token: 33	368	svchost.exe
Token: SeIncBasePriorityPrivilege	368	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

751f66bf226c6773d41ee1b16788dc509d64af36206785fd9edb39eaf6028982.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

636 751f66bf226c6773d41ee1b16788dc509d64af36206785fd9edb39eaf6028982.exe
504 MicrosoftEdge.exe
2288 MicrosoftEdgeCP.exe
2288 MicrosoftEdgeCP.exe

pid	process
636	751f66bf226c6773d41ee1b16788dc509d64af36206785fd9edb39eaf6028982.exe
504	MicrosoftEdge.exe
2288	MicrosoftEdgeCP.exe
2288	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

751f66bf226c6773d41ee1b16788dc509d64af36206785fd9edb39eaf6028982.exesvchost.exe2Cheat Loader.exe2CFUpdater.exeMicrosoftEdgeCP.exe

description	pid	process	target process
PID 636 wrote to memory of 368	636	751f66bf226c6773d41ee1b16788dc509d64af36206785fd9edb39eaf6028982.exe	svchost.exe
PID 636 wrote to memory of 368	636	751f66bf226c6773d41ee1b16788dc509d64af36206785fd9edb39eaf6028982.exe	svchost.exe
PID 636 wrote to memory of 368	636	751f66bf226c6773d41ee1b16788dc509d64af36206785fd9edb39eaf6028982.exe	svchost.exe
PID 636 wrote to memory of 1116	636	751f66bf226c6773d41ee1b16788dc509d64af36206785fd9edb39eaf6028982.exe	Dllhost.exe
PID 636 wrote to memory of 1116	636	751f66bf226c6773d41ee1b16788dc509d64af36206785fd9edb39eaf6028982.exe	Dllhost.exe
PID 636 wrote to memory of 1116	636	751f66bf226c6773d41ee1b16788dc509d64af36206785fd9edb39eaf6028982.exe	Dllhost.exe
PID 636 wrote to memory of 1320	636	751f66bf226c6773d41ee1b16788dc509d64af36206785fd9edb39eaf6028982.exe	2Cheat Loader.exe
PID 636 wrote to memory of 1320	636	751f66bf226c6773d41ee1b16788dc509d64af36206785fd9edb39eaf6028982.exe	2Cheat Loader.exe
PID 636 wrote to memory of 1320	636	751f66bf226c6773d41ee1b16788dc509d64af36206785fd9edb39eaf6028982.exe	2Cheat Loader.exe
PID 368 wrote to memory of 2184	368	svchost.exe	netsh.exe
PID 368 wrote to memory of 2184	368	svchost.exe	netsh.exe
PID 368 wrote to memory of 2184	368	svchost.exe	netsh.exe
PID 1320 wrote to memory of 4136	1320	2Cheat Loader.exe	2CFUpdater.exe
PID 1320 wrote to memory of 4136	1320	2Cheat Loader.exe	2CFUpdater.exe
PID 1320 wrote to memory of 4136	1320	2Cheat Loader.exe	2CFUpdater.exe
PID 4136 wrote to memory of 4340	4136	2CFUpdater.exe	2Cheat Loader.exe
PID 4136 wrote to memory of 4340	4136	2CFUpdater.exe	2Cheat Loader.exe
PID 4136 wrote to memory of 4340	4136	2CFUpdater.exe	2Cheat Loader.exe
PID 2288 wrote to memory of 868	2288	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2288 wrote to memory of 868	2288	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2288 wrote to memory of 868	2288	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2288 wrote to memory of 868	2288	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2288 wrote to memory of 868	2288	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2288 wrote to memory of 868	2288	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2288 wrote to memory of 868	2288	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2288 wrote to memory of 868	2288	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2288 wrote to memory of 868	2288	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2288 wrote to memory of 868	2288	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2288 wrote to memory of 868	2288	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2288 wrote to memory of 868	2288	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2288 wrote to memory of 868	2288	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2288 wrote to memory of 868	2288	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe

C:\Users\Admin\AppData\Local\Temp\751f66bf226c6773d41ee1b16788dc509d64af36206785fd9edb39eaf6028982.exe
"C:\Users\Admin\AppData\Local\Temp\751f66bf226c6773d41ee1b16788dc509d64af36206785fd9edb39eaf6028982.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:636

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:368

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svchost.exe" "svchost.exe" ENABLE
3⤵
PID:2184

C:\Users\Admin\AppData\Roaming\Dllhost.exe
"C:\Users\Admin\AppData\Roaming\Dllhost.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1116

C:\Users\Admin\AppData\Local\Temp\2Cheat Loader.exe
"C:\Users\Admin\AppData\Local\Temp\2Cheat Loader.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320

C:\Users\Admin\AppData\Roaming\2CFUpdater.exe
"C:\Users\Admin\AppData\Roaming\2CFUpdater.exe" "C:\Users\Admin\AppData\Local\Temp\2Cheat Loader.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136

C:\Users\Admin\AppData\Local\Temp\2Cheat Loader.exe
"C:\Users\Admin\AppData\Local\Temp\2Cheat Loader.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:504

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:772

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:868

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4152

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2068

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2Cheat Loader.exe
MD5
4d367a5e08908246d9e2d3aadf977f7b

SHA1
4f6a51a40e78d11ba3fbcb253b5193634f2cde99

SHA256
4d96d255b6332130d71cda946af18287e08eb2cf622360ca8526dac0c6df9220

SHA512
27cfb0486cf331ad975ffdb609779c0a43d881389fc6fa73c81750d3abdcff3429fdffe77c0badedf2841a7442e19236ae7d266940643eae3401f0d173838d7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\2Cheat Loader.exe
MD5
e14f2dc9f0a38b9c9d6bbb3cd8f3e1a7

SHA1
297c154be52302c19587a860ef24bef0e551d7d1

SHA256
baaf061c5385480df0f55779ac4967618bb9cd61289021ac648578083530e343

SHA512
81c40b776b0f0575107f8675d6ac78748aa69278d12b4482be425a24ae71a1d7782f2021345fda97e12ed92847ced2e10b713cc4a68b926cb14d60387e486725

Download Submit
C:\Users\Admin\AppData\Local\Temp\2Cheat Loader.exe
MD5
e14f2dc9f0a38b9c9d6bbb3cd8f3e1a7

SHA1
297c154be52302c19587a860ef24bef0e551d7d1

SHA256
baaf061c5385480df0f55779ac4967618bb9cd61289021ac648578083530e343

SHA512
81c40b776b0f0575107f8675d6ac78748aa69278d12b4482be425a24ae71a1d7782f2021345fda97e12ed92847ced2e10b713cc4a68b926cb14d60387e486725

Download Submit
C:\Users\Admin\AppData\Roaming\2CFUpdated.exe
MD5
4d367a5e08908246d9e2d3aadf977f7b

SHA1
4f6a51a40e78d11ba3fbcb253b5193634f2cde99

SHA256
4d96d255b6332130d71cda946af18287e08eb2cf622360ca8526dac0c6df9220

SHA512
27cfb0486cf331ad975ffdb609779c0a43d881389fc6fa73c81750d3abdcff3429fdffe77c0badedf2841a7442e19236ae7d266940643eae3401f0d173838d7c

Download Submit
C:\Users\Admin\AppData\Roaming\2CFUpdater.exe
MD5
703c120638a2fc135eb709495725e165

SHA1
c260dc9d0b3bea6ddd4d471df3e1396fb2821078

SHA256
a71c9b3a633069ff7b73aac047afc971b549460e86bfb7df4631383885aac9bf

SHA512
4aacff11361cfa0b7320ee84652db9ae29a5f09e46f123e537e5c46551e04961ea81863225dd40866f260795c638b4f3147e52580889c37787f8c1ad1383128b

Download Submit
C:\Users\Admin\AppData\Roaming\2CFUpdater.exe
MD5
703c120638a2fc135eb709495725e165

SHA1
c260dc9d0b3bea6ddd4d471df3e1396fb2821078

SHA256
a71c9b3a633069ff7b73aac047afc971b549460e86bfb7df4631383885aac9bf

SHA512
4aacff11361cfa0b7320ee84652db9ae29a5f09e46f123e537e5c46551e04961ea81863225dd40866f260795c638b4f3147e52580889c37787f8c1ad1383128b

Download Submit
C:\Users\Admin\AppData\Roaming\Dllhost.exe
MD5
04ad2a13ef7cdf6c28ba52c79b362b31

SHA1
a1beaed9995ea784756e89f31b457194d5e4e6d3

SHA256
aa54457bbebfdbd3b2164df231638643edbec7ef9e2f58faa279df05ebe3abe3

SHA512
6f0dd0e9918d58653512dfe1d896f91ea8909b2c50294cdacec391da365c1f24bcca57045c9920c1d17a53951b62b661012aa8f24a267d02ecb500b816af04bc

Download Submit
C:\Users\Admin\AppData\Roaming\Dllhost.exe
MD5
04ad2a13ef7cdf6c28ba52c79b362b31

SHA1
a1beaed9995ea784756e89f31b457194d5e4e6d3

SHA256
aa54457bbebfdbd3b2164df231638643edbec7ef9e2f58faa279df05ebe3abe3

SHA512
6f0dd0e9918d58653512dfe1d896f91ea8909b2c50294cdacec391da365c1f24bcca57045c9920c1d17a53951b62b661012aa8f24a267d02ecb500b816af04bc

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
MD5
faba023813022c6a15b113ed6c6d1734

SHA1
df5683eb6557092451a6b65ed5fb0077d2d2d290

SHA256
b55ba6a4ed2cf82ac285c364723f099e5b1716144654b058f76bb646f4a69c08

SHA512
643e7276cf3fbc147a8a71641b39aec5bfe6d749cdf5560d2049f9fb735a252a93cb5f451c48ee63687588729c8c795e463eba32500d59a09f445e26f421f55e

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
MD5
faba023813022c6a15b113ed6c6d1734

SHA1
df5683eb6557092451a6b65ed5fb0077d2d2d290

SHA256
b55ba6a4ed2cf82ac285c364723f099e5b1716144654b058f76bb646f4a69c08

SHA512
643e7276cf3fbc147a8a71641b39aec5bfe6d749cdf5560d2049f9fb735a252a93cb5f451c48ee63687588729c8c795e463eba32500d59a09f445e26f421f55e

Download Submit
memory/368-116-0x0000000000000000-mapping.dmp

Download
memory/368-127-0x0000000003701000-0x0000000003702000-memory.dmp

Filesize
4KB

Download
memory/1116-119-0x0000000000000000-mapping.dmp

Download
memory/1116-126-0x00000000017B0000-0x00000000017B1000-memory.dmp

Filesize
4KB

Download
memory/1320-130-0x00000000057A0000-0x00000000057A1000-memory.dmp

Filesize
4KB

Download
memory/1320-125-0x0000000000C60000-0x0000000000C61000-memory.dmp

Filesize
4KB

Download
memory/1320-132-0x0000000005650000-0x0000000005651000-memory.dmp

Filesize
4KB

Download
memory/1320-133-0x0000000005840000-0x0000000005841000-memory.dmp

Filesize
4KB

Download
memory/1320-134-0x00000000057A0000-0x0000000005C9E000-memory.dmp

Filesize
5.0MB

Download
memory/1320-122-0x0000000000000000-mapping.dmp

Download
memory/1320-129-0x0000000005CA0000-0x0000000005CA1000-memory.dmp

Filesize
4KB

Download
memory/1320-131-0x00000000057A0000-0x0000000005C9E000-memory.dmp

Filesize
5.0MB

Download
memory/1320-128-0x0000000005690000-0x0000000005691000-memory.dmp

Filesize
4KB

Download
memory/2184-135-0x0000000000000000-mapping.dmp

Download
memory/4136-140-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/4136-136-0x0000000000000000-mapping.dmp

Download
memory/4340-144-0x0000000000000000-mapping.dmp

Download
memory/4340-146-0x0000000000E90000-0x0000000000E91000-memory.dmp

Filesize
4KB

Download
memory/4340-152-0x0000000005B20000-0x0000000005B21000-memory.dmp

Filesize
4KB

Download
memory/4340-153-0x0000000005B23000-0x0000000005B25000-memory.dmp

Filesize
8KB

Download