asyncrat | b2ac1e407ed3ecd7c7faa6de929a68fb51145662cf793c40b69eb59295bba6bc

Resubmissions

12-05-2024 07:58

240512-jt1e9aag96 10

12-05-2024 07:55

240512-jscykaag45 3

Analysis

max time kernel
405s
max time network
407s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
12-05-2024 07:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bloxstrap-v2.5.4.exe
Size

7.6MB
MD5

dbb820772caf0003967ef0f269fbdeb1
SHA1

31992bd4977a7dfeba67537a2da6c9ca64bc304c
SHA256

b2ac1e407ed3ecd7c7faa6de929a68fb51145662cf793c40b69eb59295bba6bc
SHA512

e8ac879c7198dffb78bc6ee4ad49b5de40a5a7dbbda53d427d0a034941487d13c8bb2b8d590a1fcdd81cd6abb8f21fdfcd52924eb00c45a42ee06c1e4b3d590f
SSDEEP

98304:XNd5DSd5DxTsed5D2ZT00UuOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTl1:X+sdtObAbN0u

Score

10^/10

asyncrat nanocore nano keylogger rat spyware stealer trojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

nano

dool.ddns.net:1606

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
svchost.exe
install_folder
%Temp%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\svchost.exe	family_asyncrat

Executes dropped EXE 4 IoCs

Processes:

NanoCore.exeNanoCore.exesvchost.exeNanoCore.exe

pid process

1308 NanoCore.exe
696 NanoCore.exe
3972 svchost.exe
1648 NanoCore.exe

pid	process
1308	NanoCore.exe
696	NanoCore.exe
3972	svchost.exe
1648	NanoCore.exe

Loads dropped DLL 13 IoCs

Processes:

NanoCore.exe

pid	process
1648	NanoCore.exe
1648	NanoCore.exe
1648	NanoCore.exe
1648	NanoCore.exe
1648	NanoCore.exe
1648	NanoCore.exe
1648	NanoCore.exe
1648	NanoCore.exe
1648	NanoCore.exe
1648	NanoCore.exe
1648	NanoCore.exe
1648	NanoCore.exe
1648	NanoCore.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

2 raw.githubusercontent.com
3 camo.githubusercontent.com
33 camo.githubusercontent.com
41 raw.githubusercontent.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
2	raw.githubusercontent.com
3	camo.githubusercontent.com
33	camo.githubusercontent.com
41	raw.githubusercontent.com

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	dw20.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exedw20.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exe

pid process

3748 ipconfig.exe

pid	process
3748	ipconfig.exe

Modifies registry class 55 IoCs

Processes:

NanoCore.exemsedge.exeOpenWith.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	NanoCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a003100000000006b565c49100078363400380009000400efbeac580740ac5807402e00000077ac0200000001000000000000000000000000000000dce36200780036003400000012000000	NanoCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	NanoCore.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2457560273-69882387-977367775-1000\{DD74D79A-8A9A-45F7-8E80-577DEA4BA27E}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NanoCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NanoCore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "3"	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NanoCore.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar:Zone.Identifier msedge.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4368 PING.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar:Zone.Identifier	msedge.exe

pid	process
4368	PING.EXE

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exe

pid	process
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2152	msedge.exe
2152	msedge.exe
4340	msedge.exe
4340	msedge.exe
1696	identity_helper.exe
1696	identity_helper.exe
4380	msedge.exe
4380	msedge.exe
3412	msedge.exe
3412	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OpenWith.exeNanoCore.exe

pid process

4412 OpenWith.exe
1648 NanoCore.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

Processes:

msedge.exe

pid	process
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

Bloxstrap-v2.5.4.exe7zG.exeNanoCore.exedw20.exesvchost.exeNanoCore.exe

description	pid	process
Token: SeDebugPrivilege	2660	Bloxstrap-v2.5.4.exe
Token: SeRestorePrivilege	5004	7zG.exe
Token: 35	5004	7zG.exe
Token: SeSecurityPrivilege	5004	7zG.exe
Token: SeSecurityPrivilege	5004	7zG.exe
Token: SeDebugPrivilege	696	NanoCore.exe
Token: SeRestorePrivilege	2224	dw20.exe
Token: SeBackupPrivilege	2224	dw20.exe
Token: SeBackupPrivilege	2224	dw20.exe
Token: SeBackupPrivilege	2224	dw20.exe
Token: SeDebugPrivilege	3972	svchost.exe
Token: SeDebugPrivilege	1648	NanoCore.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

msedge.exe7zG.exe

pid	process
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
5004	7zG.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

OpenWith.exeNanoCore.exe

pid	process
4412	OpenWith.exe
1648	NanoCore.exe
1648	NanoCore.exe
1648	NanoCore.exe
1648	NanoCore.exe
1648	NanoCore.exe
1648	NanoCore.exe
1648	NanoCore.exe
1648	NanoCore.exe
1648	NanoCore.exe
1648	NanoCore.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2540 wrote to memory of 3660	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 3660	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2216	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2152	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 2152	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 1484	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 1484	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 1484	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 1484	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 1484	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 1484	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 1484	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 1484	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 1484	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 1484	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 1484	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 1484	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 1484	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 1484	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 1484	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 1484	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 1484	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 1484	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 1484	2540	msedge.exe	msedge.exe
PID 2540 wrote to memory of 1484	2540	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4.exe
"C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd1a503cb8,0x7ffd1a503cc8,0x7ffd1a503cd8
2⤵
PID:3660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
2⤵
PID:2216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8
2⤵
PID:1484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:3544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:3852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
2⤵
PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
2⤵
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3528 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
2⤵
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1784 /prefetch:1
2⤵
PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
2⤵
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
2⤵
PID:3088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
2⤵
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5384 /prefetch:8
2⤵
PID:3784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5156 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
2⤵
PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
2⤵
PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
2⤵
PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
2⤵
PID:4668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,18138570589138235267,10444766101646120059,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2296 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4800

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5104

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap674:142:7zEvent21124
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5004

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4412

C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe
"C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe"
1⤵
- Executes dropped EXE
PID:1308

C:\Users\Admin\AppData\Local\Temp\NanoCore.exe
"C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:696

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 1164
3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2224

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3972

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping -n 3 127.0.0.1 & copy /Y "C:\Users\Admin\AppData\Local\Temp\NanoCore.exe" "C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe" >> NUL
2⤵
PID:2916

C:\Windows\SysWOW64\PING.EXE
ping -n 3 127.0.0.1
3⤵
- Runs ping.exe
PID:4368

C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe
"C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1648

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:3496

C:\Windows\system32\ipconfig.exe
ipconfig
2⤵
- Gathers network information
PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0d84d1490aa9f725b68407eab8f0030e

SHA1
83964574467b7422e160af34ef024d1821d6d1c3

SHA256
40c09bb0248add089873d1117aadefb46c1b4e23241ba4621f707312de9c829e

SHA512
f84552335ff96b5b4841ec26e222c24af79b6d0271d27ad05a9dfcee254a7b9e9019e7fac0def1245a74754fae81f7126499bf1001615073284052aaa949fa00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0c705388d79c00418e5c1751159353e3

SHA1
aaeafebce5483626ef82813d286511c1f353f861

SHA256
697bd270be634688c48210bee7c5111d7897fd71a6af0bbb2141cefd2f8e4a4d

SHA512
c1614e79650ab9822c4e175ba528ea4efadc7a6313204e4e69b4a9bd06327fb92f56fba95f2595885b1604ca8d8f6b282ab542988995c674d89901da2bc4186f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\27eb8193-c9b0-4ae8-86e1-df8f58b98f2b.tmp

Filesize
1KB

MD5
ff20404e705023e373a2668eda832433

SHA1
86c2c249206fc117acff18bb2a0f37dc6b2d0dd2

SHA256
ea56ac44385344ef07415b56422bfba36f24fecc6de7879b9d3a5837e138f3cd

SHA512
61c3857bb765aee84b01bf46c18712e83202851d2de70284f948093f9adc95340eb26d09007bec282b88393b3fe0baaf2da35e812e6081a98b6131333cc93060

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\76eada60-27f9-4d00-b210-5915222125fd.tmp

Filesize
951B

MD5
c3587fef3f4ace719573426f2d0c0639

SHA1
571456e184f05d1a8fedd0a8d836686eb113a992

SHA256
532de6a14dd61632602578d70bf833c18c379241aeedfff4449107e147677b33

SHA512
d84fc0e543540b48cf50036ce9c413be344ee95c6008c9070c686e3c0776dd853619a5a5d50404e262f2c886f4dab9eb3c2c8f81101ed22ce7e76be04ca1f745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
b6228aa0e4c2976781a329da6bb26aa4

SHA1
1ba54dc85ed37a547af5b84fc85297a2d592ba53

SHA256
da8d7376fc35729fface06965867b83f7f937f5f538be23fd58655d09ec953b0

SHA512
54a0a806f07a620590628e11a49c683e4eb8697bd748a9ea8cc942a2a3fda0c660cedcfeb968bbae65ee1f4fdfda965ce044ab0c8c5b78393ed9dc36bd0a5156

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
fa06686889ee9001a15951978cbb0181

SHA1
077edffb127bf9e6ac5b2774cd902ba9cdc885f0

SHA256
87adcf1d03dcd6691f910fe2bec4c57a732710107741244672ef268720933b1d

SHA512
b9c29cc5e540f45656d84d4fc904842eec086eb13dbe3a85846f81585dfb580e3641bbd154d340f11c3238f78ba2952ff2651a4d459d2778f2558377a4df3cf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a69a6e4d085a16d85379bfa681fe499f

SHA1
acc04be39b419df3a9274f4bb891a1a402ab9fdc

SHA256
792264de87dc8f51670dc0c665dc5d22f8898d2fa37c54dfffb194627f0f6636

SHA512
cf53d238b39f2ed85f55ada4284c035e5d6eddae8b3c4d77cda5d3aac36362c584343b2ae30827d6d0eaba037be518a70b7e53908eb068ec14c7bcd0a69e0678

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e4df5adb36216d24167785e2dd0965b8

SHA1
58f92d20d8658be185de4c10ca94f935b69f4ef4

SHA256
1955058266cb099a32f963eb8c8d03fdfcf812a4b8640bbd15bedb6124de6815

SHA512
9c8cbc24e1815a2318bad836d6bdc6d460ebe7fa38e674c43dc739f5687cb0c556d708e07a6a29fe00a43a42d61f6da50aad3f695356ffee4f30bbd1ffdbac65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
164f16a277cb779d355071591bb687ab

SHA1
e0d2f2489623cc8531546b89d01228e22b134462

SHA256
2e3419f6cff932dc2b34e12b324273fb8adc7f3cc90411e3c62d4aaadb57bc9c

SHA512
70866ae7001ddff82f32ad06ff9cfe55ef30a73c52ccc3ddcc3f82e2d69223a497ade807e419cfb6e261abff970949545cabb896ad9120daacd4429a9e07ba91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cd897b939a7417e1907a85ff1c390499

SHA1
fbe593a80c0fb2c1482caae0a2e656f3bf14002e

SHA256
0d26f951f3e3a2200b304a3868f9d82a967e3cb88ce3dadbaaede494437ea5d9

SHA512
2aadd623868b451b64360921bac1289377a14e6e96ed82c455641c14490908b45a3123e9766ea0ba3d2a3228f7fe7946a470b5f823a488891cbd235c1ae061a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586e45.TMP

Filesize
1KB

MD5
c6402f13edd7708114e4ca89ef8e714d

SHA1
d7e456f20838b8e54c615742b03fab9d9d28c43b

SHA256
447b0ce2031923e7e952d0f7028a999ee97328c22aa9d722069ac4d3e79fe3ee

SHA512
465cd2cc72189dabe241fd59e5833029ed19cf398b4c6ed50da1433cb53fe526583597aa9075d68be579bb1611c325b8e392e17dc92c2a0cf245423df1ec028f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7726f16aab0858b20cb669295d2452b8

SHA1
7e877509a20a795df0e6cf78b7315d67f0dd2e30

SHA256
1f3d843a8fec472816ee1c522c0381a0a0e38238c439f0f074e00180dcff7c51

SHA512
41065c64352967efe000a474c59bb1afdf5efcede45809c77d36c5d2f4b520e1ee728268943b549a915862db1afeebff0b9befcdc320b4ac5a16a05e15e7ecc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d60367b886c1e7b0959e8d7d8b323913

SHA1
7ee6f70a7756f568097d68b6e8d4bde6bf00f04d

SHA256
dd4cb9327ebd8d3642de04d48d1d224280e7007076902b75bc3134cc07880a56

SHA512
d88f0e25394eebc7e7d0466deeb90b54a7c371558b2a4074a23134cb614c7b9c0de490f8c2102e01905d5afec5fe9b27bfe356a3f67d70746f1e9ee59f2c18b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8c2e25cbb94f4c2d6ccd36162caf671f

SHA1
d837b1b33c101862cd8992d5547839f44b6c8c5a

SHA256
59b96a5de4cddab42b77708b159a9409db2d1b0ea5027f411b60146c8dab867f

SHA512
ce38ae1e1fb12f06de6ab75ff20afa1500f60d2d99fad03a7330f577715d91c3719829d9b89f1b5362e552f2983e6468fc387c8fdcda356f83eb8ab6e4fedd37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1817763e757b20d733d5cd6c0013449b

SHA1
44873f711d1f9e24f66c8101766f331bdb4f0706

SHA256
ad1076709f7473c5fd51073cc458633eb0471516917cc8fd113ab0dc1d7c5443

SHA512
5bcdb988412280d9af9f757d421c014f9b74babc81062c6420b494f7bd71ac7f6cd499776b9aa8b241ebe5a2d4c8d78151287161b8472aba498434c41af24957

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e027b0fa550c76b139119e06cc16de22

SHA1
13ab896f7c3bd5b852f297a58c307b759c67ec9e

SHA256
5f90babcd5c21c640fdf09ee94bf6483c148fae86a8044fe613e020de346b965

SHA512
9d01150756c38f23d8db4c0edbe72cd997e281d73564c6a0676f98c726ee2f720286b0a744dd9d959eca0d3317ea7e9ab31f78f7625c20208ee5089cc8ecb023

Download Submit
C:\Users\Admin\AppData\Local\Temp\NanoCore.exe

Filesize
1.4MB

MD5
1728acc244115cbafd3b810277d2e321

SHA1
be64732f46c8a26a5bbf9d7f69c7f031b2c5180b

SHA256
ec359f50ca15395f273899c0ff7c0cd87ab5c2e23fdcfc6c72fedc0097161d4b

SHA512
8c59fdd29181f28e5698de78adf63934632e644a87088400f1b7ab1653622e4bc3a4145094601211a2db4bcbd04ea5f1ac44129907fbb727fe24a1f3652c7034

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
45KB

MD5
49dda59f0c4cdd8edceb12c8a656be01

SHA1
fd07e12453e858cc7f9f36fcd580a770fdf61f09

SHA256
e55d1db22d0aeb018ed7fc2a5cf6d0c72941cb0ea0af08ffd370aa89b38fea37

SHA512
56dec368a6a44dcd9c2f8ff583d10f14a4e6701bb76186a011e3e98657fc92338a012d66284f6b21b4a5ee7f1a2739232672c65d5273bc9ca31e16f43bc52ec4

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar

Filesize
6.0MB

MD5
018e7d97045c5887468501f83aeaabc8

SHA1
08164ff3d19c55db15e031d66176ef897f248b1d

SHA256
7946e7eb4c07a11f19e8bcbf7356c0140f48d110c26306c7461812daf5d7a1d9

SHA512
d49fceac389b27c0f4be3496d074344ccf81dc9d96716100aab3d9b8a81fff82f6a7e6ee93da27231955a9a7ea0816ac962804dd53915a47a6c0f8a9d87a93fe

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\main.sqlite

Filesize
15KB

MD5
c3ffbadb0823730a36df801a954b53bd

SHA1
424fadb114e3dba88ecc037b282afb492f2b68e1

SHA256
4b9ebadc4ad23daec86d687bf7f56aa2e6da641284838a1ee90192d1424d153d

SHA512
8091093449eb86765eeeaa069ed4c38013d900d7ad477dd81fbf35e94fc9f3b532dfdcef25249c09372b78ead181356a63f01612c40280e5cf6adb9ef3397161

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\NanoCore.exe

Filesize
1.2MB

MD5
582c1464562374ef36e266c3c881ac77

SHA1
5bac94ad083b0467cae59cd3f9649a7de0f43723

SHA256
5ebeaf3ed77ac8dbbc14e05cada6059e39dd2a1b3fcfcb5cb49db2e68752dcc9

SHA512
f7e7f742f3901f1e8b8cba9245ad90b886fcbade1347b3f3d00fec07d15d8883368a56e647c766dbffcadc6da7cb6285a5454732a447bebfe96c033701e644b3

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\AIO.ncp

Filesize
17KB

MD5
60c274ccb344da9e3d77449f6068d253

SHA1
ab25eddf3ddb61ef52104a01e5c9b8a23451c764

SHA256
0a59aaee013c57f3b6190d683160d88ca1c5868565cbf5acbb7b17d3e925c602

SHA512
9600d852b56557f31a5a18a6aa2cb76cf4fabf36ae32bbeccf82677f64737542234e2fb06ac8d917f9839120320b7db212d76e8dea24445f13096d86a474b9c9

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\CorePlugin.ncp

Filesize
119KB

MD5
7914e7302f72d330aa5f6c5c8c26df43

SHA1
8c411f3fe5297a78cb018539b44df87c0a51606a

SHA256
f66985518b1e56a04f512d110f5b79f21ed91cbcbf6bd3e17eba3dcdfb85f9b5

SHA512
8959843f282162ff0c59d890d04012c4f62dc36058aa7095d708a97a34313082cd4ca5ea5df5623cd2d6b8b91c527297168cab08ec59c1ec48fafac5983ad012

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\DucPlugin.ncp

Filesize
73KB

MD5
5eca68a8368e0e144b7016e30b85515c

SHA1
0ba48b49974156e5746958aeeb1c2a26c916b3be

SHA256
e2ce89b3e68b003cb27e2c5652ccba073c8938bef194e51830539b2464a3f676

SHA512
ea1d1363fb072a5c646ce070184855588124be42392dc492ce86c88fe93eae78e23f5de4f2df75fb5b0e8d67bf08ff192dd163ed3c62a1ccfb0b8436ae1df644

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\ManagementPlugin.ncp

Filesize
300KB

MD5
b612c2c9a6d361a5db14c04ba126119c

SHA1
d2b29e235b0f45242088b78313438bdfd51209dc

SHA256
b86fe4e126a9748a383a34d615b9598c715f2380c0aad957495c66923902026c

SHA512
194d4688935235f3ca686868c9ff53c7945d4e076d4a51fdcbc254bfa1461494766480794c65715bce314256c7cc5268bd6547c937984d3010f54f5a3db4ba9c

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\MiscTools.ncp

Filesize
66KB

MD5
78e3006fc6468eb7dfc7761072b84ac6

SHA1
e46cae768d2754f48a29b7e424a9bddf0d67bcd8

SHA256
3a3a3b105eefb45e3b70cc1592e484df02df7020d5154e8c2e5d7d439e295e46

SHA512
0daa1cc9ddae70f442ee5eed784523dc1378b9d095edfaec1df95e02f00d09b461d60ee180f716f7ba755543ef7b0c87d791a454cf254dde0033b8615b2841e8

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\MultiCore.ncp

Filesize
236KB

MD5
becb82e1e914e906be158e3f9dd658ac

SHA1
725d3d658680ca8dcb610d998db4b28733b5ee52

SHA256
5494adf651fc64e3aa6c08e38165d8dbfec52056cdf4fadae90b76b0e6816a33

SHA512
1d67e7d5686ea225262501afb572bec23e35bbd33c660a57e84b9cad7adfadbe457b128af0059ac705d53c6b65798f5525fe4ed3c16537b0c085414cdca74174

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\NanoBlack.ncp

Filesize
107KB

MD5
794ab16c092ebf2b1d812d6cce158537

SHA1
6dd9edd26b50265d5af4642f9d1f1f8703a44805

SHA256
7919b7998d6b359d7cb700018dc2d69ff6ffb45bd01c9c190b98fb4c9ff4beab

SHA512
e639bb0f7d309344c45ddff3d7f91212b3c6a9db6970d06db35f6bac228b389ed8c32dbda75ae23ad1359bb60f678b0b891caa3ed07245aaad21dcb3ea4a5347

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\NanoBrowser.ncp

Filesize
102KB

MD5
8b13fdc96af0a84c152f5a601dcc6b06

SHA1
1250db70fda8a2c32f37bbdc5638074c6dc171a7

SHA256
997c41b05150480bcfae9abb3132fc807f6c6b511b810b554fdb5aedf89f5db0

SHA512
536d4e1b9e7c95ebac762d0a438106a5409c69e990940d3411709364783f957015d4a5dc0651b33591e37dcda8549e689a87b853e32f3ad065391a2d8190a552

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\NanoCoreSwiss.ncp

Filesize
49KB

MD5
fcb5afd01e75aca8ed9fbd35a46e54f3

SHA1
94b69f8612d31fc0698089d5e08aea1cafea52e7

SHA256
bf0386f6e9b4a35fefe5fe917e2be7c64867efe24521f18e4567f8af5f6dd5e5

SHA512
b587dd23eaea6de486c30864908f8603451c459153cd21b86a5e43bb9c2cca7cbc015daf620808fad76a4d56bbc4e57e127059c8e73be6c85bf958781c1343fe

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\NanoNana.ncp

Filesize
157KB

MD5
c5d40b767bd6b97f88ccce13956d0ad8

SHA1
ef7f7fdd9d5ea0b55ffbb17c171ee6a46b347100

SHA256
a3c39444ac74bb91f14f3f2ae6918d9b1d368268e137aca310450fefbc8983aa

SHA512
3fcb5a6afdc7de59bac645d8b4dc6368b0405a51985ff86c95fc8cd579bd59bc423cab940dc0ab3de9a0cd0d9e04dad82e380ef18030330d72b2e72936a95ee1

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\NanoProtectPlugin.ncp

Filesize
179KB

MD5
e51af633e5f5f4a817a54773fb90d337

SHA1
0cb8a7965f9f042954b1f318ea1026b76e12f8e0

SHA256
b37602dbb924bb94df0d9745d13fcace8a6642397fb738fbe02a88f667f3ab66

SHA512
6454305121597073d4ea2b8f57a4bb4a4fe7fafbd05336c91265534faea5a5cdec7504c1329ea0c8cb344a4f32d59c60af5348dfd89375876ae95ee2c15f0c14

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\RCX8A38.tmp

Filesize
203KB

MD5
20a82f7f2ce3bb4b6c811c8ba011873e

SHA1
29a9e216c0596b2e717948da1ed5b5f0bd5cf33c

SHA256
88f476207aee20119b1a65b3d9add75bb526cad069bb4120e9ba5dc8a1f28edd

SHA512
d4a7a6b5137fd4933b0a6054528dd733471dfa9d7b83ba0645090069554a0fd2f607c08ab1e7b68e7e5a8049cea5ab0ad396be96a5bb84df16548c2d5d40d2f2

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ListIcons\flag_aq.png

Filesize
351B

MD5
b841c2ebdca6bb23c15c98da4aa671d7

SHA1
42f562132fe6e9a5029247a2b9666395dd5ad9b0

SHA256
b668f1a313e57c97a5abd0212631ea6211aace15b10f1ca82484f23f7d6924b5

SHA512
e093c2c454e8ceb318df0629f5f7e8494213e69caef640dd4554f3c250029e8a06b4c5add9c13e457f901c3d328738b66db524a8404617e486fd8c564dd04c90

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ListIcons\flag_cx.png

Filesize
626B

MD5
fbf02dad6f60392ce777d006d5762248

SHA1
f9d95e6e5e25b83953e4f898bf99636d85511709

SHA256
45203a04468ff78fb3434f46799ca630172e04f97c566f8e143539a80c48bfc5

SHA512
9f5b7b5399cb7c8b41cda202eac5a344524f135fd2e32a5f312917c7684ee13a94976984154355297bb31fd06435efe91456e189bb5f1c9d6010dfad01415b4f

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ListIcons\flag_gp.png

Filesize
546B

MD5
5ac0d15234533136bf6ec230686a4aa5

SHA1
2f208a8baf30d13aa23382d3821cc73c4aa466f0

SHA256
5cceb033c0262b5905f88d5905777471e9f1b0b0d9cb857f2361e88ada73610d

SHA512
d6215183f13e36a268b849056fe1479ebd36eab4b6f175cbdd3a4ecd4ba4df7734189a2f9e9d69ee344ca63baf2c9ef10f62663cc721e9c9c59775d5e84e2268

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\ListIcons\flag_sj.png

Filesize
562B

MD5
4f82c2e83eab05d2bd9baaeff6c81a96

SHA1
e1cd3981d14653bf5df976ece649120134e88546

SHA256
15493361692068154ac1b1baf8878c179b353996dcda4d63e0322ea37f998f9b

SHA512
b69030fffb689094952eb472b272e1d18b40d0f11e3bba647c9b01226ccf072d276cc31ce3a1ffcbc84c5de82bedfe7fc2466fb060ff50e528f7c258179e626d

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\TabIcons\builder.png

Filesize
303B

MD5
d2d498dc06990b948ef42c479c4c1f94

SHA1
eb380e6d156f5cc2ab28baa5add2ba8acda088b3

SHA256
ce8e344d1975972fa3f1b54383ab01cf522217e83b4e01f5c5b8563641bf6550

SHA512
fd9f99b7489507d8208432847085507e5d1823f1eed5d3c7e644c59bc5e5b36d8705d4add01a0c291240029458b25d72894fc05efede8b795bb6872e1e5f9ef9

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\TabIcons\clients.png

Filesize
462B

MD5
0331dbac2291c05d567461b58654d350

SHA1
1f89cdf7199983e788fd1f22b873ab9b0500952d

SHA256
8d1339e002540de132326aeb1d17c66a9a60b0af7e3daca9bc40df17e9c96542

SHA512
2d12a85226a21670c49038e4347b39227b8d8bca07b8eb66f2adae0ccf1135270f5ba5f16a40bf526477c70c00c1ca572bfb973306e6eb8dd057600de38da161

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\TabIcons\home.png

Filesize
343B

MD5
0a482ce7f891fe7a64118bbb34a34b9c

SHA1
2aba3c06942273aebc5e616602620e4b2526ebe7

SHA256
76d3e6c51702b37227b73a4f84771e44d7c1a8551b4c1fdd90e341f03a805346

SHA512
0e900eff9109ac2f32137d9d18993a29ed6065299ef96554f2288128fe07d1e8db1a0dac29b39b0eb05bb8a9bdca5f083da8e25dec3c880ef155401fd649107b

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\TabIcons\network.png

Filesize
230B

MD5
48780574121d519661c2e0bc51b25b68

SHA1
89d8d5e42fbae3d95c8036c1738656b8e6343091

SHA256
28f4c682d85fb4ef531a71b7fed8f0d7ef548f1126da378aaf60349219a681d6

SHA512
7f0d9b6e18b812350b9d57439069ebb9140365830ea6fa247527f793cc58271ed7743c514d7488f026064b6d44afaf93717192bcff3ea8a3b501f2bf7718ff30

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Resources\TabIcons\system.png

Filesize
273B

MD5
9993c66f33d16d11e701abbabf5a5db8

SHA1
415a0069f21dc5fcbb7bdaa7f17a679eb18e6b1e

SHA256
24c4edf86254f9e2359508909ba52dd683e1f6af0d8c1a52f875c472fc73bd40

SHA512
7a3f0546f4fb12e72fd774f5c4446e8bcc2a26c762aad91675c3bc10931c1c0ac2c40d66a25afd0a376ab665427164367c1cf398c22811eedf88c90ce51a23e7

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\ServerPlugin.dll

Filesize
28KB

MD5
952c62ec830c63380beb72ad923d35dc

SHA1
6700baa1fb1877129e79402dfe237f0b84221b69

SHA256
2e5fbfb7932b117a2f6093dc346cdee4a5702e39739d9c40d27bfd1580f6f0d7

SHA512
5dc19d7d6ab7670ded766f357e481328c8df4a96ac3c2a00194a5ccea8c34bca0e34cfea3d9d17934db384d302446be2fec9853438371561d70580665bffe121

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\System.Data.SQLite.dll

Filesize
256KB

MD5
dd3d6f00b1aba3f1d9338d9727ab5f17

SHA1
faf9364a7ab15f27c93a6e6f97fa025030c9dad7

SHA256
f0d4beab24e94e61f219df451d90dbba3d0f48539f9b6a448f91e0c94b4e80c4

SHA512
0794d850a133a98affe627e3023114b229b982e507d366895ece6a1ef99b42d708554c64b52f0f2ed63673e1c5aeea7e794085d45f0797159e21ba4efdf23cd7

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\builder.log

Filesize
3KB

MD5
9ae03ba03c696d10337c00e3a916e755

SHA1
2bb1976f92e51888094856a77a9ab646e3c32ff1

SHA256
b56f1289bec019acc69408527784aeb17a50fa372e2d7a52ea8bd8c447fc9f4c

SHA512
5eef30489a33a6f869c507b4625811d2ef00623b83452972006fb9831659f4bf481fe11b207796b717e621a0973ba4121c51d51eca9e712fe684f6d36137de68

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\client.bin

Filesize
130KB

MD5
906a949e34472f99ba683eff21907231

SHA1
7c5a57af209597fa6c6bce7d1a8016b936d3b0b6

SHA256
9d3ea5af7dc261bf93c76f55d702a315aa22fb241e4207dc86cd834c262245c8

SHA512
29fd20ae7f1b8bac831c0bb85da4325a62e10961989e14299f5f50776c8f7e669cc1527bf2c3868bd7230e73ac110ba8b1f0491ac0f2923d79d7a2871c7c961d

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\plugins.bin

Filesize
240B

MD5
5e709fc806e8ba3385487699004f6d29

SHA1
2f32547ed5b9db3b33969fb4858945610aaeedb2

SHA256
9ecbf989dedf1403db953fb4e5955c9f63415cbe1f6492c3246bac405a4d036f

SHA512
a6706c9f76d837a7e0ab12e3c1c6d94fedde9dc52d4fecd02befd8850752155e2bf801cdf0488a98e49c50c4f0595a3fc4916950badba9bb83a5b7a35d3ffaab

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\server.log

Filesize
40KB

MD5
cae8d97342be26f424aff27df045eca3

SHA1
333eb084801fb0f25d988e19501713d8ddeb87ea

SHA256
35cfb7c9bf4396f9fc2b213dd4239a040869a5746fc92679918e128178eb5e6e

SHA512
0bd7e4b0c7685e949d0fc06e0d34729f284a91e7fc31be1225ed5187e22b9d656414dbe709c3c75a4eee5c81807340b8c50ed1e81ea8e1f256239f847d29d27c

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\settings.bin

Filesize
88B

MD5
2e80d3867d56f43e41dff8becd51b0e3

SHA1
5dcae6c0d08900f343b8049391723c97d72f65b3

SHA256
52f259931fe6f9c7c00b7e4ae12e6bccc4a9220b305a6c5811b0a0540f24f607

SHA512
28664060c97d9fb9bb6eafe3f2021aba66c94efa2e88057d9a082d180feded7e23de4603ec000512cda6f514470c28bcd0b8ef85c037ea70894bb9cc9405127b

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\spyware.exe

Filesize
130KB

MD5
40864227154aa6de9050f5f71273a622

SHA1
474dc9c7deeda672585085c8cb13278215223882

SHA256
fdd722f6cad6bdddf532b1f65ac9238700e0d7e09de3da363b611f743c3ff858

SHA512
57be149a0eafcad43cb7398b2134a1bfa3cbb740fcf517e981aeed14b740a248995328fbf37235b6d36a8421233b0f19d3bba2f27ec1604c7e8315035cf72d19

Download Submit
C:\Users\Admin\Downloads\NanoCore 1.2.2.0_Cracked By Alcatraz3222\x86\SQLite.Interop.dll

Filesize
792KB

MD5
9b19dcee960dc215e64b1d82348707a9

SHA1
9c1e0f76673eb385787120e17404df179316ca2b

SHA256
3515f704b0012c01fc8be5b717905c0587b29255fc9eb7ad3f2b66a130691d38

SHA512
cc1304ab171feb2ac6df941f4b35aab8ce7b503f96b5539b366b39268cce8b21ea2fdbce16eff809a9a121a60a65ebbd0f59f75360800f541b9e5f93e729a55d

Download Submit
\??\pipe\LOCAL\crashpad_2540_ONCZZMXQUYVHFGEZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2660-0-0x00007FFD1A26B000-0x00007FFD1A26C000-memory.dmp

Filesize
4KB

Download
memory/2660-1-0x00007FFD1A26B000-0x00007FFD1A26C000-memory.dmp

Filesize
4KB

Download
memory/3972-1292-0x0000000006200000-0x000000000629C000-memory.dmp

Filesize
624KB

Download
memory/3972-1283-0x0000000000FE0000-0x0000000000FF2000-memory.dmp

Filesize
72KB

Download