Analysis
-
max time kernel
120s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 02:50
Static task
static1
Behavioral task
behavioral1
Sample
Nc-LoaderV.exe
Resource
win10v2004-20240508-en
General
-
Target
Nc-LoaderV.exe
-
Size
53.9MB
-
MD5
123f78a5aa5655f88fb3389eaf5bfdb6
-
SHA1
8fc13d78c22452dd869aa27b035cb1a8872211f4
-
SHA256
ad00c7ec62ff3887e056d9021c43d3bdf9281dd308003aeb3640720c6a8101e0
-
SHA512
cfea0d373301c12120ffd9038848b6ba5c4057cc4985ff3641300aaf425d4ff86bf33813224bc7a26652ced75dffe5d3dce5ec7114f25befade827173a05dd15
-
SSDEEP
393216:kMyE1FlK/sL/wqGMt4RTt48XlVseZ08iga+8:kMyE7lc/BTRTt481JViga+8
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
BitLockerToGo.exedescription pid process target process PID 4472 created 2644 4472 BitLockerToGo.exe sihost.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepid process 2232 powershell.exe 4712 powershell.exe 2232 powershell.exe 4712 powershell.exe -
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
Processes:
MicrosoftEdgeUpdate.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MicrosoftEdgeUpdate.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation msedgewebview2.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 28 IoCs
Processes:
MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_126.0.2592.81.exesetup.exesetup.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exeMicrosoftEdgeUpdate.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exedriver1.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exepid process 2496 MicrosoftEdgeWebview2Setup.exe 2904 MicrosoftEdgeUpdate.exe 5076 MicrosoftEdgeUpdate.exe 2180 MicrosoftEdgeUpdate.exe 3212 MicrosoftEdgeUpdateComRegisterShell64.exe 2196 MicrosoftEdgeUpdateComRegisterShell64.exe 1404 MicrosoftEdgeUpdateComRegisterShell64.exe 4880 MicrosoftEdgeUpdate.exe 4256 MicrosoftEdgeUpdate.exe 1520 MicrosoftEdgeUpdate.exe 2400 MicrosoftEdgeUpdate.exe 1184 MicrosoftEdge_X64_126.0.2592.81.exe 5112 setup.exe 3332 setup.exe 3216 msedgewebview2.exe 4632 msedgewebview2.exe 3604 msedgewebview2.exe 3816 msedgewebview2.exe 1272 msedgewebview2.exe 396 msedgewebview2.exe 3684 MicrosoftEdgeUpdate.exe 1780 msedgewebview2.exe 2140 msedgewebview2.exe 3220 msedgewebview2.exe 4000 driver1.exe 3836 msedgewebview2.exe 4728 msedgewebview2.exe 4864 msedgewebview2.exe -
Loads dropped DLL 47 IoCs
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeNc-LoaderV.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exeMicrosoftEdgeUpdate.exeNc-LoaderV.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exeNc-LoaderV.exemsedgewebview2.exemsedgewebview2.exepid process 2904 MicrosoftEdgeUpdate.exe 5076 MicrosoftEdgeUpdate.exe 2180 MicrosoftEdgeUpdate.exe 3212 MicrosoftEdgeUpdateComRegisterShell64.exe 2180 MicrosoftEdgeUpdate.exe 2196 MicrosoftEdgeUpdateComRegisterShell64.exe 2180 MicrosoftEdgeUpdate.exe 1404 MicrosoftEdgeUpdateComRegisterShell64.exe 2180 MicrosoftEdgeUpdate.exe 4880 MicrosoftEdgeUpdate.exe 4256 MicrosoftEdgeUpdate.exe 1520 MicrosoftEdgeUpdate.exe 1520 MicrosoftEdgeUpdate.exe 4256 MicrosoftEdgeUpdate.exe 2400 MicrosoftEdgeUpdate.exe 1848 Nc-LoaderV.exe 3216 msedgewebview2.exe 4632 msedgewebview2.exe 3216 msedgewebview2.exe 3216 msedgewebview2.exe 3216 msedgewebview2.exe 3604 msedgewebview2.exe 3816 msedgewebview2.exe 3604 msedgewebview2.exe 3816 msedgewebview2.exe 1272 msedgewebview2.exe 1272 msedgewebview2.exe 3604 msedgewebview2.exe 3604 msedgewebview2.exe 3604 msedgewebview2.exe 3604 msedgewebview2.exe 396 msedgewebview2.exe 396 msedgewebview2.exe 396 msedgewebview2.exe 3216 msedgewebview2.exe 3684 MicrosoftEdgeUpdate.exe 4888 Nc-LoaderV.exe 1780 msedgewebview2.exe 2140 msedgewebview2.exe 3220 msedgewebview2.exe 3220 msedgewebview2.exe 3220 msedgewebview2.exe 3992 Nc-LoaderV.exe 3836 msedgewebview2.exe 4864 msedgewebview2.exe 4864 msedgewebview2.exe 4864 msedgewebview2.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
Nc-LoaderV.exeNc-LoaderV.exeNc-LoaderV.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Nc-LoaderV.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Nc-LoaderV.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Nc-LoaderV.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Nc-LoaderV.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Nc-LoaderV.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Nc-LoaderV.exe -
Checks system information in the registry 2 TTPs 12 IoCs
System information is often read in order to detect sandboxing environments.
Processes:
msedgewebview2.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
driver1.exedescription pid process target process PID 4000 set thread context of 4472 4000 driver1.exe BitLockerToGo.exe -
Drops file in Program Files directory 64 IoCs
Processes:
setup.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdge_X64_126.0.2592.81.exedescription ioc process File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\microsoft_shell_integration.dll setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Trust Protection Lists\Mu\Social setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Locales\bn-IN.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Locales\cs.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\MicrosoftEdgeUpdateCore.exe MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_lv.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FBBC2E92-75CB-428D-B88E-283B587ED06F}\EDGEMITMP_28509.tmp\MSEDGE.PACKED.7Z MicrosoftEdge_X64_126.0.2592.81.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Locales\or.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\Trust Protection Lists\Mu\Cryptomining setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\Locales\eu.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\delegatedWebFeatures.sccd setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\pwahelper.exe setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Trust Protection Lists\Sigma\Analytics setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\dxcompiler.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\show_third_party_software_licenses.bat setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Locales\ug.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_is.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\BHO\ie_to_edge_stub.exe setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\cookie_exporter.exe setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\edge_feedback\mf_trace.wprp setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_lb.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\BHO\ie_to_edge_bho_64.dll setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Locales\ru.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\VisualElements\LogoDev.png setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_fr.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Locales\gu.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Locales\sr-Latn-RS.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\wns_push_client.dll setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_cs.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Trust Protection Lists\Mu\Other setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\identity_proxy\win10\identity_helper.Sparse.Beta.msix setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\edge_feedback\camera_mf_trace.wprp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\identity_proxy\win11\identity_helper.Sparse.Beta.msix setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\Locales\it.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\Locales\th.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Locales\gd.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\Trust Protection Lists\Mu\Entities setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\mip_protection_sdk.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\Locales\es.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_ca.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_zh-TW.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\copilot_provider_msix\package_metadata setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\identity_proxy\win11\identity_helper.Sparse.Beta.msix setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Locales\sr.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Locales\uk.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\oneds.dll setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Trust Protection Lists\Sigma\Cryptomining setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_fil.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_az.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Locales\am.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Locales\ms.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\BHO\ie_to_edge_stub.exe setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\Locales\ar.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\Locales\ro.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\Locales\kk.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\Locales\nn.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\Locales\sk.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\identity_proxy\resources.pri setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_en-GB.dll MicrosoftEdgeWebview2Setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\msedge.dll.sig setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Trust Protection Lists\Mu\CompatExceptions setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\delegatedWebFeatures.sccd setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\Locales\fr.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_ca-Es-VALENCIA.dll MicrosoftEdgeWebview2Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4932 4472 WerFault.exe BitLockerToGo.exe 756 4472 WerFault.exe BitLockerToGo.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedgewebview2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe -
GoLang User-Agent 2 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 60 Go-http-client/1.1 HTTP User-Agent header 58 Go-http-client/1.1 -
Modifies data under HKEY_USERS 43 IoCs
Processes:
MicrosoftEdgeUpdate.exemsedgewebview2.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133640167570895565" msedgewebview2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine.1.0\ = "Microsoft Edge Update Broker Class Factory" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ProgID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\msedgeupdate.dll,-1004" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService.1.0\ = "Update3COMClass" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82CCB536-D2EE-4F19-9067-40531F08D1D4}\InprocHandler32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\VERSIONINDEPENDENTPROGID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine.dll" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods\ = "8" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachine.1.0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\Elevation MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\ = "Microsoft Edge Update CredentialDialog" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\CLSID\ = "{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods\ = "8" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\LocalServer32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ = "IBrowserHttpRequest2" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ELEVATION MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ = "ICoCreateAsync" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\ = "Microsoft Edge Update CredentialDialog" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ = "IGoogleUpdate3Web" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ = "Google Update Policy Status Class" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\AppID = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B} MicrosoftEdgeUpdate.exe -
Processes:
Nc-LoaderV.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 Nc-LoaderV.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Nc-LoaderV.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Nc-LoaderV.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
Nc-LoaderV.exeMicrosoftEdgeUpdate.exeNc-LoaderV.exepowershell.exepowershell.exeNc-LoaderV.exeBitLockerToGo.exeopenwith.exepid process 4888 Nc-LoaderV.exe 2904 MicrosoftEdgeUpdate.exe 2904 MicrosoftEdgeUpdate.exe 1848 Nc-LoaderV.exe 2232 powershell.exe 2232 powershell.exe 2232 powershell.exe 4712 powershell.exe 4712 powershell.exe 4712 powershell.exe 2904 MicrosoftEdgeUpdate.exe 2904 MicrosoftEdgeUpdate.exe 2904 MicrosoftEdgeUpdate.exe 2904 MicrosoftEdgeUpdate.exe 3992 Nc-LoaderV.exe 4472 BitLockerToGo.exe 4472 BitLockerToGo.exe 832 openwith.exe 832 openwith.exe 832 openwith.exe 832 openwith.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
msedgewebview2.exepid process 3216 msedgewebview2.exe 3216 msedgewebview2.exe 3216 msedgewebview2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
MicrosoftEdgeUpdate.exewmic.exetasklist.exepowershell.exepowershell.exewmic.exedescription pid process Token: SeDebugPrivilege 2904 MicrosoftEdgeUpdate.exe Token: SeIncreaseQuotaPrivilege 4652 wmic.exe Token: SeSecurityPrivilege 4652 wmic.exe Token: SeTakeOwnershipPrivilege 4652 wmic.exe Token: SeLoadDriverPrivilege 4652 wmic.exe Token: SeSystemProfilePrivilege 4652 wmic.exe Token: SeSystemtimePrivilege 4652 wmic.exe Token: SeProfSingleProcessPrivilege 4652 wmic.exe Token: SeIncBasePriorityPrivilege 4652 wmic.exe Token: SeCreatePagefilePrivilege 4652 wmic.exe Token: SeBackupPrivilege 4652 wmic.exe Token: SeRestorePrivilege 4652 wmic.exe Token: SeShutdownPrivilege 4652 wmic.exe Token: SeDebugPrivilege 4652 wmic.exe Token: SeSystemEnvironmentPrivilege 4652 wmic.exe Token: SeRemoteShutdownPrivilege 4652 wmic.exe Token: SeUndockPrivilege 4652 wmic.exe Token: SeManageVolumePrivilege 4652 wmic.exe Token: 33 4652 wmic.exe Token: 34 4652 wmic.exe Token: 35 4652 wmic.exe Token: 36 4652 wmic.exe Token: SeIncreaseQuotaPrivilege 4652 wmic.exe Token: SeSecurityPrivilege 4652 wmic.exe Token: SeTakeOwnershipPrivilege 4652 wmic.exe Token: SeLoadDriverPrivilege 4652 wmic.exe Token: SeSystemProfilePrivilege 4652 wmic.exe Token: SeSystemtimePrivilege 4652 wmic.exe Token: SeProfSingleProcessPrivilege 4652 wmic.exe Token: SeIncBasePriorityPrivilege 4652 wmic.exe Token: SeCreatePagefilePrivilege 4652 wmic.exe Token: SeBackupPrivilege 4652 wmic.exe Token: SeRestorePrivilege 4652 wmic.exe Token: SeShutdownPrivilege 4652 wmic.exe Token: SeDebugPrivilege 4652 wmic.exe Token: SeSystemEnvironmentPrivilege 4652 wmic.exe Token: SeRemoteShutdownPrivilege 4652 wmic.exe Token: SeUndockPrivilege 4652 wmic.exe Token: SeManageVolumePrivilege 4652 wmic.exe Token: 33 4652 wmic.exe Token: 34 4652 wmic.exe Token: 35 4652 wmic.exe Token: 36 4652 wmic.exe Token: SeDebugPrivilege 2912 tasklist.exe Token: SeDebugPrivilege 2232 powershell.exe Token: SeDebugPrivilege 4712 powershell.exe Token: SeIncreaseQuotaPrivilege 976 wmic.exe Token: SeSecurityPrivilege 976 wmic.exe Token: SeTakeOwnershipPrivilege 976 wmic.exe Token: SeLoadDriverPrivilege 976 wmic.exe Token: SeSystemProfilePrivilege 976 wmic.exe Token: SeSystemtimePrivilege 976 wmic.exe Token: SeProfSingleProcessPrivilege 976 wmic.exe Token: SeIncBasePriorityPrivilege 976 wmic.exe Token: SeCreatePagefilePrivilege 976 wmic.exe Token: SeBackupPrivilege 976 wmic.exe Token: SeRestorePrivilege 976 wmic.exe Token: SeShutdownPrivilege 976 wmic.exe Token: SeDebugPrivilege 976 wmic.exe Token: SeSystemEnvironmentPrivilege 976 wmic.exe Token: SeRemoteShutdownPrivilege 976 wmic.exe Token: SeUndockPrivilege 976 wmic.exe Token: SeManageVolumePrivilege 976 wmic.exe Token: 33 976 wmic.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
MicrosoftEdgeUpdate.exepid process 4256 MicrosoftEdgeUpdate.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Nc-LoaderV.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_126.0.2592.81.exesetup.exeNc-LoaderV.exemsedgewebview2.exedescription pid process target process PID 4888 wrote to memory of 2496 4888 Nc-LoaderV.exe MicrosoftEdgeWebview2Setup.exe PID 4888 wrote to memory of 2496 4888 Nc-LoaderV.exe MicrosoftEdgeWebview2Setup.exe PID 4888 wrote to memory of 2496 4888 Nc-LoaderV.exe MicrosoftEdgeWebview2Setup.exe PID 2496 wrote to memory of 2904 2496 MicrosoftEdgeWebview2Setup.exe MicrosoftEdgeUpdate.exe PID 2496 wrote to memory of 2904 2496 MicrosoftEdgeWebview2Setup.exe MicrosoftEdgeUpdate.exe PID 2496 wrote to memory of 2904 2496 MicrosoftEdgeWebview2Setup.exe MicrosoftEdgeUpdate.exe PID 2904 wrote to memory of 5076 2904 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 2904 wrote to memory of 5076 2904 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 2904 wrote to memory of 5076 2904 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 2904 wrote to memory of 2180 2904 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 2904 wrote to memory of 2180 2904 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 2904 wrote to memory of 2180 2904 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 2180 wrote to memory of 3212 2180 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 2180 wrote to memory of 3212 2180 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 2180 wrote to memory of 2196 2180 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 2180 wrote to memory of 2196 2180 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 2180 wrote to memory of 1404 2180 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 2180 wrote to memory of 1404 2180 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 2904 wrote to memory of 4880 2904 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 2904 wrote to memory of 4880 2904 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 2904 wrote to memory of 4880 2904 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 2904 wrote to memory of 4256 2904 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 2904 wrote to memory of 4256 2904 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 2904 wrote to memory of 4256 2904 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 1520 wrote to memory of 2400 1520 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 1520 wrote to memory of 2400 1520 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 1520 wrote to memory of 2400 1520 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 1520 wrote to memory of 1184 1520 MicrosoftEdgeUpdate.exe MicrosoftEdge_X64_126.0.2592.81.exe PID 1520 wrote to memory of 1184 1520 MicrosoftEdgeUpdate.exe MicrosoftEdge_X64_126.0.2592.81.exe PID 1184 wrote to memory of 5112 1184 MicrosoftEdge_X64_126.0.2592.81.exe setup.exe PID 1184 wrote to memory of 5112 1184 MicrosoftEdge_X64_126.0.2592.81.exe setup.exe PID 5112 wrote to memory of 3332 5112 setup.exe setup.exe PID 5112 wrote to memory of 3332 5112 setup.exe setup.exe PID 1848 wrote to memory of 3216 1848 Nc-LoaderV.exe msedgewebview2.exe PID 1848 wrote to memory of 3216 1848 Nc-LoaderV.exe msedgewebview2.exe PID 3216 wrote to memory of 4632 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 4632 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe PID 3216 wrote to memory of 3604 3216 msedgewebview2.exe msedgewebview2.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
msedgewebview2.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedgewebview2.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Nc-LoaderV.exe"C:\Users\Admin\AppData\Local\Temp\Nc-LoaderV.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exeC:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDIzRTY3NDctOUE0QS00MjVCLUFGNDEtREREMEQ2Qzg1OTg0fSIgdXNlcmlkPSJ7RkM1OEJBQ0QtRjgxQS00QkNDLUJEMDQtNjc1RTg5QTU1Mjc5fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0QwMjE3QzEyLTc1REUtNDcxOS1BMENDLTU2NUZBQkExNEU4QX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtEeE9iakhHYStuUmEyYXRDM3dvK0lFcEM3OCtaWWVBVWJrWHBEQzJjajdVPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTg3LjM3IiBuZXh0dmVyc2lvbj0iMS4zLjE4Ny40MSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDY1NTQ1NTYyNiIgaW5zdGFsbF90aW1lX21zPSI2NDEiLz48L2FwcD48L3JlcXVlc3Q-4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{423E6747-9A4A-425B-AF41-DDD0D6C85984}"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nc-LoaderV.exe --user-data-dir="C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4888.3148.10161676210097413002⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=126.0.6478.127 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=126.0.2592.81 --initial-client-data=0x164,0x168,0x16c,0x140,0xe8,0x7ffbb95e0148,0x7ffbb95e0154,0x7ffbb95e01603⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDIzRTY3NDctOUE0QS00MjVCLUFGNDEtREREMEQ2Qzg1OTg0fSIgdXNlcmlkPSJ7RkM1OEJBQ0QtRjgxQS00QkNDLUJEMDQtNjc1RTg5QTU1Mjc5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OEZFRTZBN0QtNzAzOC00QTAwLTlFMDQtQzg2MEE5OEM3RDlCfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O2hWZkRqTWRGRzZGZ0tzME56NmVtcllDU2c2VFF2RFBvbW9sUmF5UVhCSzQ9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjExMC4wLjU0ODEuMTA0IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI1MCIgaW5zdGFsbGRhdGV0aW1lPSIxNzE1MTY1MjIxIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNTk2Mzc4MTA1ODc5MTE5Ij48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjExNDMyNSIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDY2MjAxNzk4NiIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FBBC2E92-75CB-428D-B88E-283B587ED06F}\MicrosoftEdge_X64_126.0.2592.81.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FBBC2E92-75CB-428D-B88E-283B587ED06F}\MicrosoftEdge_X64_126.0.2592.81.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FBBC2E92-75CB-428D-B88E-283B587ED06F}\EDGEMITMP_28509.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FBBC2E92-75CB-428D-B88E-283B587ED06F}\EDGEMITMP_28509.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FBBC2E92-75CB-428D-B88E-283B587ED06F}\MicrosoftEdge_X64_126.0.2592.81.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FBBC2E92-75CB-428D-B88E-283B587ED06F}\EDGEMITMP_28509.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FBBC2E92-75CB-428D-B88E-283B587ED06F}\EDGEMITMP_28509.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=126.0.6478.127 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{FBBC2E92-75CB-428D-B88E-283B587ED06F}\EDGEMITMP_28509.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=126.0.2592.81 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff6e145aa40,0x7ff6e145aa4c,0x7ff6e145aa584⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODcuNDEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDIzRTY3NDctOUE0QS00MjVCLUFGNDEtREREMEQ2Qzg1OTg0fSIgdXNlcmlkPSJ7RkM1OEJBQ0QtRjgxQS00QkNDLUJEMDQtNjc1RTg5QTU1Mjc5fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezM1N0IxQ0M4LUE1MDYtNEI0NC1CNzJELUI4REQ4MkIzNEE1Nn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjYuMC4yNTkyLjgxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0NjY5Njc0MTMxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDY2OTY3NDEzMSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUwNDYzMjcyNzIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzExMTBiZjYzLWM2Y2UtNDcxNC05NjliLWIzMDI4YjQ0MWM0Nz9QMT0xNzIwMTQ3ODgyJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVVKakdNRVJRQmloS1R0MkZIMmRzQTJOQThibEk1bVZ2ZEJOWXJuQTBXbDFOaTVXJTJmOThrSlNlS0RpN3g1VFdpYVBab09uVVBjNHZyU0swV1ZLVWxjd3clM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzMwODIxNjgiIHRvdGFsPSIxNzMwODIxNjgiIGRvd25sb2FkX3RpbWVfbXM9IjMxMTk3Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTA0NjY0MDA1NiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUwNTk5MjExMzgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjU0OTkxNTQyNDMiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIyODIiIGRvd25sb2FkX3RpbWVfbXM9IjM3NjY1IiBkb3dubG9hZGVkPSIxNzMwODIxNjgiIHRvdGFsPSIxNzMwODIxNjgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQzOTIzIi8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Nc-LoaderV.exe"C:\Users\Admin\AppData\Local\Temp\Nc-LoaderV.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nc-LoaderV.exe --user-data-dir="C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1848.3592.167383626438496598522⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=126.0.6478.127 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=126.0.2592.81 --initial-client-data=0x178,0x17c,0x180,0x154,0x1bc,0x7ffbb95e0148,0x7ffbb95e0154,0x7ffbb95e01603⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView" --webview-exe-name=Nc-LoaderV.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1800,i,8397749265140342738,6979523743098938202,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView" --webview-exe-name=Nc-LoaderV.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=1876,i,8397749265140342738,6979523743098938202,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:33⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView" --webview-exe-name=Nc-LoaderV.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --field-trial-handle=1668,i,8397749265140342738,6979523743098938202,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView" --webview-exe-name=Nc-LoaderV.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3516,i,8397749265140342738,6979523743098938202,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView" --webview-exe-name=Nc-LoaderV.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=4764,i,8397749265140342738,6979523743098938202,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView" --webview-exe-name=Nc-LoaderV.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=4896,i,8397749265140342738,6979523743098938202,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\tasklist.exetasklist2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\";" powershell -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\Nc-LoaderV.exe\""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\Nc-LoaderV.exe3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks /create /tn WinDriver /tr C:\ProgramData\Microsoft\WinDriver.exe /sc onstart /ru SYSTEM2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\ProgramData\driver1.exeC:\ProgramData\driver1.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 4684⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 4884⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Nc-LoaderV.exe"C:\Users\Admin\AppData\Local\Temp\Nc-LoaderV.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nc-LoaderV.exe --user-data-dir="C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3992.3560.3267768270643450492⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=126.0.6478.127 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\126.0.2592.81\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=126.0.2592.81 --initial-client-data=0x160,0x164,0x168,0x13c,0x19c,0x7ffbb95e0148,0x7ffbb95e0154,0x7ffbb95e01603⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4472 -ip 44721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4472 -ip 44721⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Event Triggered Execution
2Image File Execution Options Injection
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Event Triggered Execution
2Image File Execution Options Injection
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Subvert Trust Controls
1Install Root Certificate
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\EdgeCore\126.0.2592.81\Installer\setup.exeFilesize
6.5MB
MD57c44a5cba89f38d967b1f4e11225da0f
SHA144837f2ff9b3ebc7c371ee5f9e0cd5dcaad508dd
SHA256a10c3e0b2ec1286bfe6b3fe9005a9132fad01be9afc4bdd5adb29f174b8fb706
SHA51225b4cae7fc6d200dab70e94461b7f2e7899813975cab498fb367a32aa2e187fb7b1330545b60f6340d53fe5e04a1ecfb5d6b8bf004ac26ecaa7a8f6e387dfe99
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\EdgeUpdate.datFilesize
12KB
MD5369bbc37cff290adb8963dc5e518b9b8
SHA1de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA2563d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA5124f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\MicrosoftEdgeComRegisterShellARM64.exeFilesize
179KB
MD5687ccc0cc0a4c1de97e7f342e7a03baa
SHA190e600e88b4c9e5bb5514a4e90985a981884f323
SHA256ecbab53f1a62d0459d6ca81f6c004651c09562f8e037b560dcb0890a2c51360d
SHA5124da91ee55de7abb6ce59203edd9ae7e6fcacd5528ac26d9e0bfbd12169db74758a9bc3fde437e3c1d10afc95d74b04b0e94586472b0a0bb15b738f5e6ec41d8d
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\MicrosoftEdgeUpdate.exeFilesize
201KB
MD5e3f7c1c2e2013558284331586ba2bbb2
SHA16ebf0601e1c667f8d0b681b0321a73e8f4e91fa3
SHA256d19616ac12d3d536c8fbf034513a4977c88ef2d1676d358a2358fa051c8a42ba
SHA5127d4fd7ad06b05d79211144cbaa0047bdb4910212565b79f292a6bea652735dacf69435b24c73bc679cbdad4207f6352726eb297a1e7af4f7eef14dbc8a2ca42d
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeFilesize
212KB
MD5a177a23ca2ed6147d379d023725aff99
SHA11a789e5ef7bf9f15f2ccbac5f9cf3750ee41f301
SHA2569c584238ea9189afd6b11cf71604b1c2762ac815d6ca8994788de7e076b21318
SHA512c508ffd3e2cc953d857a2128e29dfdfe0f9e729da38c9cc3022c4376342aec946c6e79176e7885f6637008573c85339bdc8a9e261b3811887ecf5a7dd78383c3
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\MicrosoftEdgeUpdateCore.exeFilesize
258KB
MD54f840a334c7f6d2a6cba74f201e83a7f
SHA1cb032c7b1293190f8f1cd466f6ded4bbe71c47a1
SHA2562ff44aa5f48a3e5b3ca3c5a3904be23d29a282b467e30d6f52494df3dc1d612d
SHA512575c20fcdbebb16bcd17a137a656769d355a81817e7fa3743981976998e00bdf3ce42bbfa046c42a835e9e9e7a10ef6f8d7b306de9940fa332817cb2885db833
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\NOTICE.TXTFilesize
4KB
MD56dd5bf0743f2366a0bdd37e302783bcd
SHA1e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA25691d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdate.dllFilesize
2.1MB
MD51125e435063e7c722c0079fdf0a5b751
SHA19b1c36d2b7df507a027314ece2ef96f5b775c422
SHA2567d8d1756343598bc651d62a0e81835820e0d6cf7a995503bb6b129b4bcc37df4
SHA512153f096af5c874c00a3c38602fab590eccf885f642040007b67799ef39d919d7cb261fba43a9ffbd68c8824eddea219505d49e05b3dcc70f00e6016a1fbd12b9
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_af.dllFilesize
29KB
MD53a8fa737407a1b3671d6c0f6adaabd8a
SHA1b705b27c99349a90d7a379d64fd38679eed6ec30
SHA2565995a5ae09cb7da69b5a6f8ea1a60406d8ebc2201b627417b578ebe903d22276
SHA5129872f32a727b248d3edafe303e5290e1bae0c270a988500424221970c0041268c1626ebb94712a0b8ba0f21d2f29d833ab9dbc4db884f7f9af5a5063f94d71b5
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_am.dllFilesize
24KB
MD586465afa3ac4958849be859307547f57
SHA19bbde5e4df719b5a7d815dd1704ab8215602f609
SHA256921fce73f4fc7b47749d250f5ab885141bd5ddec2ad057b049e470cffa4a6b20
SHA51213e178e317280cbd585261aa22a840ea2203d4ef5c845f4fd6d5b4fbf216d45aae55153aed43c1fe4284d45391c72e580e612347b2903effece8a2252a13b90e
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_ar.dllFilesize
26KB
MD5819e3c9e056c95b894f1863208d628a2
SHA1596993f5d21cfd92f29e2ea5b0a870dc2ac19917
SHA256588adf8e9a300e39b51f7404356c4ae863dee1f404664933585f8d9f2467d494
SHA5123a7e67248895ac2cbb1874514bffe62a23cdfff2c3674d21589f528ec283ccf3cc2e3abfea0d81f49046c7ba920f3e64cda100c5a20be69b91ce05095b50c06b
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_as.dllFilesize
29KB
MD5d1aa2764e05f7c8c88a17bb0cd25b537
SHA12bee78f103faffe3e25ca20c915cc6b46e2134e4
SHA2563dd5aab43eeaa6202adc115f40fc1feb5332128388c2d8e62176fdea20035097
SHA51280762e4611b8ac451490e5238c0650be048bf315526ed405d9c5837e5002bd6a9526f335a06c6baa009cba671ecb0613c76dce23086e13333f332480cbd9ced0
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_az.dllFilesize
29KB
MD51e4093c3b0af3eed6f95d2620d45bf40
SHA1e29a10ede562f2d057d6fc04c3a286996051a14d
SHA256afcc0b001c7ffc1f5bbdea02fcbd6054e8b15aff9ae47366910bcf5908d4437d
SHA512843480e2d2b431f32892830c26fc3e4b80656d069f83f9a9df78d10b1e22c9ceca99171360b2baa921d156995d87ea5223f18b11e2a8ac18fabdf905881940b1
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_bg.dllFilesize
29KB
MD5c30674009659b56bdb6a60f8629f0eb2
SHA14b6fc6ea93620a206a621875513455b57fd24e83
SHA256d09c23ecd92f5cfbe650c63bc93af84c11c9ae143a5838286c04169eab8bd103
SHA5128947a9bada21ed2e0f2cf080d58f9473a5c54092a5c1f75ca9523b48143caed346e831714e80466cc2e88513e507aef422d8560b69cbf8663eb21ab05c61707c
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_bn-IN.dllFilesize
29KB
MD5a8817334810c093e0c280e2a61caf36b
SHA19b3b2a8e33de3fa8df0b6b6ab4a40ab1d088ab28
SHA25618d4c6a9840ba877dd1906ff258fb06c245cfea6bab00bbffe18c442957393ac
SHA51224ee9a0c29d42c96ccec7f4f3322c3b6a2ed0e4d68b17a5b424a364f789adaa8f1404784c8feae77986cd0be39579dacc9ca89a3fa868bb0bf11d94c95f0bb23
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_bn.dllFilesize
29KB
MD54d2988ce0b2cf5cb02269a2455e1174b
SHA1d89cd05805965648c9e7b8bb4bc8bd3605ce2d4a
SHA256cbc9a8a3936e6cb279885dc8a23261a290e85907f947a1a16fe9e7d6bdee69f8
SHA51264cee7e579367faca4864ebb5feb9dee310915f8640780a5a52c19f5c68d817adab7ef357913a68fe841a3b2e801e85de173a37402cdd49cf35319571ff6ce44
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_bs.dllFilesize
29KB
MD53e817089a18c72bd505dd6bbe5ce6163
SHA12c21b568c2fda5e475a1a996b73874ba6fe420dd
SHA2567c31aa69e3109d7134443c47b12859fffbade13a2f994f0bf42a8fdc12f796df
SHA51220534eee7c59a9cdb595c3f6d01abc8cfa534aaf84a693d3b011e4dada3fde080142a95ba036270a6a2ad2b65e6fdb18b08e53552715cc4edfcb87662fbf8100
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_ca-Es-VALENCIA.dllFilesize
30KB
MD5e0de8c3f8252202d2f68341290c45e34
SHA11d3322ab111774484be8865c1893dd834c3f52f7
SHA256ed3676152ff3f24f93034f3931b0a735b704906c50ed59a8b9cf49452afb1891
SHA512bb22666ba675c88715aa1b906f2b356c0d4289723052b942f416d3b56f727666f4fb8cc51609ca96be0c76ffda85cfbdcea917979e8a1ada5a5ba1b82e5bf816
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_ca.dllFilesize
30KB
MD59e4ddaa68d6d4f210905092096051b36
SHA1f38198c364da7b5ebcc75aafdf42a7d55699d8d4
SHA2568bbbe723da938f6f0b3cc35f48779949c5fc177b5dd157ee053a088e2968f48b
SHA512d65102c0f4337cea443c5f8e65531f0f7b628c5edeff17257b427d1073a1b291d1cc90fe46dc4bbd2c2988f940480d46e5abb2cbb9985bcbafa7e5f3bc727151
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_cs.dllFilesize
28KB
MD5731cb513cd866dfc65e12446a0d4d62d
SHA1be32570fb7fd50c43cf1ae24e7a35302eb5278fe
SHA256829630039ca9125aeb8885d069214b4112972ed02dacd309ddd26fe087f3fec2
SHA5126357f965c183e89e5a1c485a0e3becf56ab91265241568d7df7fdc1c01f1ac8fa58bd206762ada8cec99b6988eff60c41cf4836290d5e007fff63a69a78de68c
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_cy.dllFilesize
28KB
MD504ee3ec0e73eae42509bdfb689927610
SHA16176e7ae836dcacea10f7004b04ba85e3e081da8
SHA2565410d30b82c006e207a8fab3a771eed3abff145d19ddcc92e48d47bb54684e81
SHA51289c41d77066fde1cad219603d1bbdd812a65bb0680d3c545ee4cb63135486296f1af934a69161e76ca53d00037729e75bdcc22a2eca954eba98cf3f34af5d839
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_da.dllFilesize
29KB
MD59fa41c3ba8bbd84e85f71c3cd377d90d
SHA1363c1d61c84fee42987193e8edeffa522eccbfdc
SHA256157c6cee2a283c6a1966356f8d91172f55c05408f292dc352579a4dc9283c0e6
SHA51234569a917bf08ac7d50add115b09cd8bf4583a3bc7652fa54c1cd606cb94e752f4e4e278fbb99ea1e41e2d712f82893ca5f59bbed05a57c8d29b2d7037d835e5
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_de.dllFilesize
31KB
MD5896c0f7b03a6cd211fea53ecc71a1308
SHA1434eac60a992ea77945a77964050a5d0e41d48b2
SHA25684ffabc322775aee896df188189fd633483c3eb10571c8c86ec55561c2329582
SHA5127d2f9fc0086b3dc60275c6a2e17b0562626a57fb080dc1bc4cd5ad80c2501f366e89533aa961613eacd3a0bce343bf831e8cfa3d3a691c33481042b1ee02908f
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_el.dllFilesize
31KB
MD58cb60db631b0939688f39e76564505cc
SHA16dee577de716460737f7a330f440880b4e73c5c8
SHA256e8f7c8baaa1187c430c22cfc5907541411ab46e0609a53d39b015d722e35bf6f
SHA512d43216c1a8ed2daf51d70d476b789a3797bd62f69c1a556e306dfccc41efea73117eafb970010d7db151cd3ebfb7cd82de01efb4e2a2c0757b2027732a3361f5
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_en-GB.dllFilesize
27KB
MD51b79536b20df86a2bd8b232abe07d533
SHA1a9d24de616055f9800d5c4bc902cb2d0f625d178
SHA256fbf5215552bf6e12e7ba5c3e6e69748c47b6750845f5e4f048096903ef009008
SHA512ac4704fade4879992f0a67888e1e4098be2879e5e3ce2bd80275ce68729f0037497d975e1ececb587ace4d72f3e71b038f616725831d4fca12280d583cd77d7b
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_en.dllFilesize
27KB
MD5a430ce95b80c07bb729463063e0c7c48
SHA1cc488bdc18c191d88dd93e45bb85fda19d496591
SHA256c9c8a06948123607b7b35d0d46c9600b1d3e2f674e6117820b4f559818c26b60
SHA512cc9c24b95d079a949a8e725002494b0c75c19bce9ec6457cb4307f5803b7433eed738944f1baf770df8e034212224b1d9662fa533aa5bc5c01568d192fa49efc
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_es-419.dllFilesize
29KB
MD531177139af7d1da131c31d7d5cbe8099
SHA1113f3b38baeab35d2d0f51f1238f5b9e11402f26
SHA25639e80dad7071bc0a82fbd3475a780b50b9c0f1cac2240322c48b6befb1837163
SHA5126828a1cab2fdefe642a0b58f47c31e02b9dba7b15ad28cdb8039b194d9a86e2d24ff0e658fdf982e3d2d4208a2b57eb7546136e4739e64d714939c14a3d58410
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_es.dllFilesize
29KB
MD5dd3dd031e05a54c4bbf6660dd8053608
SHA1f32870bb0f7f522fd536c4ffae8c39c9d2f266f1
SHA2562d71da96f961fafe269241c27290917bf54a3c7fc5ced2de0c4b33e4b0386dab
SHA5127b0bb0ae619baea45cddab042d10d7e4b394c70a29c01632585fec7ff9aaa54a50a8fbc894f02af5e2130cff11c4573cf41ab6b5fc4c29392b69e72212c41c2d
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_et.dllFilesize
28KB
MD52e1b7c75e1ee567906a62eb19ee4308d
SHA110b77bc1040db4a3712a94c2e5ba56be3a54bfd4
SHA25683a38cc799974f6a018dea761420a77e25bf17d2c1b7d09d6d75a7b50c5762c2
SHA5129bcbb626945390ca07c99b4a698036b2a59869040944866edb893f4e5f7a6524b8980183f9825b33bafa41b10165b7ef6d20dd7750e38edd880fc22362110c08
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_eu.dllFilesize
29KB
MD560417e3a859f5e728bb9edeacc439309
SHA1ee96ac74353e0e1725e09a6e5e6d070767286e45
SHA256698dd9be2f9edce221977a6c076e894f72ffd1287c4a67423d1ea06ddfa90b21
SHA5122470f2cb04c720e3b0259ea2440761adef1493253a7a93242ff543d52936a67685a59d36d3e7f39c7807c2ee1d2932109534337e3096137441668f9cf507d16c
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_fa.dllFilesize
28KB
MD53d30bd97390f100a3dc9cf3263623434
SHA1ac328d192b4218722e0994c8c3c67df1aa8383ba
SHA256a66e9dc8829de13dfaf3e727ddf5a1655e0dd8844ab95fe461b61f996287a802
SHA512bb45aaca5f13bab5ebb5b542a71635e15cf0a111ddf752db510f7f161bd889f58ff30d0fcc4f36e9882564271a32281d4d9a48cfffe06172e2a46041b2af62f9
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_fi.dllFilesize
28KB
MD57483cb4ff3f422d05af3267a242130e3
SHA1f723b294d2088cf8a4ff2478e18470b256116979
SHA256c3800427be8e5550e6fa985f28bb4cf183f8b49d398533ad0eacea53a5a573d6
SHA512fc5ef6b792a9c2f113f5fc6cef1bf268e8688ae8f5de369224458c07b4fa229da3b6bcf698b0d9962d4644b7e1b9c682cf4f4dfe66c46c0297a41a14fc6e53ed
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_fil.dllFilesize
29KB
MD51b18f02bac918465032f9c4c6226f3ee
SHA18173e1be4375ba1ab5fcd35da8b8a4399bee1fbb
SHA256e1f0c497bb4d9b2a9f4cb6cf6e382fb4fb8827979c5eb230737af3953db24bda
SHA512baadab3af2d3988acc31a94f9b1321a613a794cd8b8da2ec2e938b7cf7774d586f566fa2bfdfff6da4f05c90e8cb101e261883faa4de48b9a911cc37576ec999
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_fr-CA.dllFilesize
30KB
MD5a2ca38f79d18fd44b0288fab8cb6f31f
SHA15e94d1265d5dee58d9ff7c72b7b1ba7b07eb4948
SHA25640b00c38c1cb9b0ef6b916ffe1e52605f2523659592e29d06f3f08716033df69
SHA51237a1aacbe69b90fb3b89bf92b6851a8f7038061dd009bb372db64227657224604ab01f0b09bee54d43205a08536cc43f992ede01cdab64cbad404cd557ccb34c
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_fr.dllFilesize
30KB
MD59666bd1ba06b37249980b198b22aa208
SHA1a26043d46dd8767f76e111cc971a53237ce720d3
SHA2565f2461703e6da108b61709078bd19ddf18ff673e8059ec795d52ded554846fac
SHA51261b893bf94fb3efb70b8da1412d6eb149734da1bb2d3eef2a62fefac469e0e0f3f25b851c6cc0ef2062f826e32ef777bd6469a3402d6dd7aa596600476f14331
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_ga.dllFilesize
29KB
MD5ee66c6c39b414cd5adc1c59be87074b1
SHA16f34917e48c5e55850ba55b528faa6e075a76230
SHA2565ac439af44574f3b1c5557edcf8bc416babdba89aaebd51bd5d13d9c023ba5fe
SHA512451fdf3331b8f02bb60530dc184a0ff5e2193bc05b59e602e8b633047209ca668e38968e7cdae268e993d619be44685fa0e06a46f2ac3c0f8c606a3e4b4825ff
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_gd.dllFilesize
30KB
MD5e4dbb357e40a839f9c8caaa5a1c1b827
SHA110c66bf5312110a2feed763afa41a448d4070bd7
SHA256e18b53fd3b34c85dad87f43b7833b518e61c712c3b48c6967408312ff9e43b35
SHA512a09ca0ae932a81919c37faf138dcf017bd2fe9ad21ae8a560444d7c7d3338213274e205d04b7378512603537af2d5fa0235c2ba2bd458cad947ece24c99c9e71
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_gl.dllFilesize
29KB
MD5d53c4b0747cd028a7a4a59fcdfe6f375
SHA1edbb5606edb9f9899c18853872a2380bb02f39bc
SHA2560ea76700d2286185f0b65d24106b81258e1593e617a4e66a129004b659518bd7
SHA51256ff2ed53a6b9f3a2c2f36713b18049ac2bba2494992f0c1dc8d92d2d9dcfe0cb1296041e9a53394bb4d5402e03794b99a774f9054609dd48d42622eb192ac72
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_gu.dllFilesize
29KB
MD5099eef142a6e8af6f7bb01895dcac818
SHA102d320adb865e6cc6bc22c70ac51102b3473d1a2
SHA2569208225c1d83b314ead913c9c5a4f7d5d353a048642f102cfd06bc94598a41a1
SHA512e2586b5660ee6e0cd0030895f9c4c398432d041b2db03d1f94e2df47d404d78baa8a18eecab1736d313eb031fdfd2600cf3025b7a39c00cbb82d2b7b094de24a
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_hi.dllFilesize
29KB
MD58ae7c60978f1797c22819452c28e5755
SHA1e3c595e988d06248da11f415d279b7371b068e8a
SHA256c591dbd7563109d709a6fd6b897a3439fca8e14270c4905e6cfbba98590fb6be
SHA512fff4683ee4b0233f37bb8196e9b30e34d66712e0c462207b48c7e5ae40b36c440aeb6015f3b7db3f723bf02c5b0a3853cf2d0a424d187e2587bb4c568f93f3c9
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_hr.dllFilesize
29KB
MD599298a89e5aaddd4c5d31c8159e9df40
SHA1980b0840b77f5dfba8af1fe1132afeefa7343e55
SHA256771d490248327bbed8e0f666284b02f691252198034f5b4873c4f5863b60dbda
SHA5120776b89edf8a6be71e813db06c48f0bd97afb4f90387f39f882b255dbd818bd6edffa6ae719d758a63d7d0c236b303e0a053a3741bc9941f3b850e9298820b7d
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_hu.dllFilesize
29KB
MD53b3917a776c95d41114b590f31513253
SHA16aaf5c9054a4c661f1374f4828ce15cb065d1db1
SHA256a96e5b1a84537708d5ed1e16e59f593cfc35599024e333f0ebaba631f4655ce0
SHA512f22b73146cd84f1e14eb83c461bebc56317bd32b3f734c5f2103cfe6f395a822da33873ff7331330b54c734c2f15685a2b9fac9dfc1895f80e46ee8f2fcc2155
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_id.dllFilesize
27KB
MD5eb92a889850152a3c67a046b26afb1de
SHA125744a9c829c08faa644d4fdddbaaef2c662605b
SHA256f66d54d3e1ab099d8df66700a9dd04018d088d3d47422b59636bbe1868de495c
SHA51214f353ed295e9b2adf1bae45e9eb8ffaeb738f1ca75b7bfdae9c1162b48e24d32ff8c2472d701924c341d9ad4a8216576f666bd08cf012167d325f013987f64b
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_is.dllFilesize
28KB
MD53f3efa36258e2aa2e06d692e25003a72
SHA1eb263e69ae3242a518ea0e4c6563e4a99e294292
SHA256b5b48151003cdbf1368b2fc3431fcb5a9646504439b14a95248048706e0b89cd
SHA512a5b20784e9531f37a0d25352b033a75d2d5286d914ffba2d401f37ac34fb3acfe024b70c1cbe8ba4a8e9f447db3cc5f45990e2e7e71461961a33d2ef2409efb4
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_it.dllFilesize
30KB
MD57a928cdc306a15eca2acba8c6e7fb49c
SHA11d61d526ea7b21b5efcd70d40942bb0b2a3e78d9
SHA25645f3d6c9396208c5a92af53562db2924a6369004a1f6a06bafdc5c51bbf7c084
SHA512843d93cea038ace31ad92e9cf92f2d3b7b6a627c4926605c67760740c6b1e6d7adf965fd549c0aee327b409227e5afef8758944e0015278a035c8b9efd2ac8f7
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_iw.dllFilesize
25KB
MD58e4ca001a9ae5aa92c5e74b9b6d490fa
SHA170e3a474c967873aad7d2ad9cb4831f17e032701
SHA25634eca96f268259a6a67308cb4acd4ec00f33ca3b03c29d5e7cff47d83c137b4c
SHA512997b66aa0c70e26b9b3893f61d9c26a05f87c6d8eb7c1d4a579bfcd1bd54382978f76c1fa6cb59cca20749bfa43890b6c4a65922d77e7914b00821c49fc5e0a2
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_ja.dllFilesize
24KB
MD552a48aa3c01cb348b109e7e2233b85aa
SHA18bb93772ada23ad818788de655c2b1f68bfbf9ee
SHA2561708bf78de41b10f3fe8c3f56de08af88670f672390970de76878dfcb5cfb1a7
SHA5123c3246ab0b780576304765cad51aabf71dae49181983ea7eb4b084f31aef500794604db4c7153e9866abf09dcf5be971808eaf0910fdca7ef1e36fe10bedda92
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_ka.dllFilesize
29KB
MD5b2447c1b8586e9d659bd6c236589e60e
SHA19f0642a974738bd5eb0569dcea308d46d3235dce
SHA2562a3830279c80da4ce28b02391703d5315e4b674cc81195bbd9cc18f1bcd6f67f
SHA5127c2fb588fa440473436318e1028303831941988ea9f36ca56c5acd8936b4f52246973c6c76a1e7b3b25ba5069bdd986ec04709c6e0a4f6f2bafaa2029c1c0c91
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_kk.dllFilesize
28KB
MD5fe09bc3153f94b68208f3ae813e15cb0
SHA17e7264fe77a31826549919aa99c7af6ad3769c40
SHA2563573e2e52e84b9ce87e535244376f8fb57c9bc565c5ef3a6defaeb7433a3a958
SHA512a6cd7185c47496a3fb666f8fa53cdf40fa1f71cb3759a68088da5f20f54bc4198d0d0c85fc0f0fc215827f4631c1022eca43878487f9fc379a7cfbbd229fb102
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_km.dllFilesize
27KB
MD5a01f834efd28c57faee53d79949ecec5
SHA1c3cf458bb2f1315f5d2fc4e2c4dfe2bdf8dcb0f7
SHA256ee917d39a77d9a66491da123f0a54242c444f3a0e72645121488f7cdc75c8889
SHA512b767e3be9a164736e8b5aca1768cba4452c2c2fe543f30e08707f6a63ce0d345474c922c9af09f702c437887d4d9dd2d1be59ba69395e9f0f0a47273d7a2e3df
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_kn.dllFilesize
29KB
MD59360c3a97180c78044c67fcfa2f51a8b
SHA1b1fe6cf821e6dedb1f961833c791a9ce7b2c5754
SHA25684b3f954cb61c4a87c769c215ec570e8974141c6534517b128989931e881e7ee
SHA512f65c857c1f6364fccf512125d841ac86d4457e0d1d8aae24bab65b1aaf79502993218a2e41916fe32d2ef10af3f8691fdf76c0b280d4778a67b3984fd3af2d8f
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_ko.dllFilesize
23KB
MD583995c5253aabdd4bd236d8238809ceb
SHA118c763f657ee6d3270829290564fb0199615f122
SHA256bd4f94f7d9e3617d7b05fefe59925b7cbfe7dfbdcf051b6fb378291b7b7bfb25
SHA512ebbf4bbd8970b6f7eac79d73a6858c0b9546d3ee7ec189f05e74045f6c91385376d4110256aced247828e17812e505919babcd5f623006289021dc3e5a2abb69
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_kok.dllFilesize
28KB
MD54140a967a1579c92bf488998b934fd86
SHA19a174bec29f2c166c612e9cf2b25b47d99ef9be7
SHA2569c9a0984b09ec8ace7e6879dabc5ca60cac45c00992972a91dd6425bf2bffe62
SHA51212436a277adcea2aefcdacc3d96f78a759e8eabe313887dd7c2fe9a5f6c02b75bd301b82a8120a11f51b6c8120d56b47eb7988b3f9c7bada34dea2de182e27c4
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_lb.dllFilesize
30KB
MD5c6b06f583f3e048363e22c24caadbda6
SHA13c119a1008c463f7efb55492ad88ce56fbb3533c
SHA2563a4342864e18ea9050f0c5c58a89c95fc5a1b868c835290a3be244965b08f314
SHA5124aef4224601b9a8df3b07188133b9d97fa90e06a245f49397baec7fbcb85996ba886f13b41c3b909a6b87f821c4f969f77f6be112b1c71c21f8a585d087acdc1
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_lo.dllFilesize
27KB
MD596c98965a7904d7adaa31f5f8a1f1f95
SHA11d9fb588e7cca9c2a7836ec49eb9202081adeb1d
SHA256b7285701b7a1ee1089568caa05a1e527825f578baf188eabf5d43179a934669f
SHA512d316000ad7e65f9b131664411b8adbd0e27842e9f61a016b5f5f1624202c5281939459f9380ef63977b217126ac5bdb481d5ae9ae318beffa44aa57303930372
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_lt.dllFilesize
28KB
MD541bb0d130f5466432a94b2a45028ed5c
SHA123a81de294a82986da25eb86b73097195a629e78
SHA256ace485702162345de29b705b3be37826db72f568a44410d7961732d1cd62e56c
SHA512f106ee7052352d41b0c56d0a557239860dc7e885823cf21ad2cffc00ecae603227ccd18f7d9d1edb2c6752263c9b159e444124d1256b8c442c921d1add69cfbb
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_lv.dllFilesize
29KB
MD514c89980237895b168b2805db7964212
SHA18c2bccf5b24869c2ffc19e6230e866d5721bbc3c
SHA2565a4fbb96bd165f7dc7a55d56f70ede22068819835b60ffc14d7a370c2c891804
SHA51283f436072281daa4d6ad7ae4e27912ff661ff72bc3ad34e41f96574925e9abbedc1e3381d557320208aa23978c50a8b46c2d9ee2f6fdc630e30658d207803438
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_mi.dllFilesize
28KB
MD5761440b1b177daf4f51beb2f66d79c16
SHA176577f1e098e7e81b2ce9e61d6e853c5491a5dd2
SHA25649e02d60f70fcd0d7ab35cd0deea17ba1f8c687dcd0484ed34a31a529d63ac46
SHA512ebcb7c62427fe303d3f381b626fabbf4d1aa35583db7333b90889f0b3462b6196dc2dd8649d1071e893c1461870e046476f6089cdc2024f7a71dbc533e2fa103
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_mk.dllFilesize
29KB
MD5c3aeb80795b68157737bcf7535c69bd1
SHA1163c1cb7d0ae484f1cb9e6eb25c80969efe2f702
SHA256ef2578df3ec1bc94a9624f80af4bcf8e70392553ae28930063692dd7d1d4c46a
SHA512ebef893a8e82f7fa99a5e6a5d94da72788c83e7ba4e385a8dc189c622e5759200f136742dcb812d1cae6f1564f97ee4ffc9d10650bde2b88e5bff298918b9432
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_ml.dllFilesize
30KB
MD5bd23100a9b8bf75e9e5e68966022bd71
SHA16562f97d29d19e41b864aae00a1c1279b7f44dfc
SHA256e56c8c324b1578347bc93c0fe47d9b6276b999a18e9da52e414d56006e1fdf48
SHA512d77594af22cf97afc68bc7857daf1032333009111675b52fde7c2f83bf7658585f6915abea38e5d3e524453a34b6633a5d5b00594f10cc86da7e4bcf616acf2f
-
C:\Program Files (x86)\Microsoft\Temp\EU66E8.tmp\msedgeupdateres_mr.dllFilesize
28KB
MD58725cb4ef60ec46f76f4129b959f6a6e
SHA15ed33580e581b6d9b026ba2b385df0b93d76d382
SHA2562436c483e8789dd4ba5ca2d0713020b1c1f812b113d5dddc3f8473cdd9667408
SHA512d65ec21da2ef8256125820f781bc2fb1a4feeffa62c873fe439f2a2f1c151ef548da1feb58618aba3a58f6a154ea4f3fb70e6aebffb588b5a84770d77d783fe7
-
C:\Program Files\MsEdgeCrashpad\settings.datFilesize
280B
MD5e924e53d1e288bf91548d913ce030b32
SHA1efb649584c62b6a1f9c349b25ffe0dd76db9b6dd
SHA2564c93fce1aec07249d1378d2d472215e27f0316aef305557c7b442e74e822a2a6
SHA512f910f49e50afb63c4499cfe3d2764fe6e2accdd72d3fae1b90073c22a13ca5cf4f1e418dced0ba9b942728a7876fca40f03b7859e1adf65773a88ed67b565992
-
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.logFilesize
107KB
MD5f58e89754121b0d7a09effb306ddf74e
SHA1fe07755d2895713bf553961ff54eb2ad652bb5c7
SHA2560733584f244c1ab5787dd6b5acffe616f1c30f7ddab603d2cfaa526b24189029
SHA51265f3aa921ec9b7e6718a9fb0e42ae3732f54c0397d8d5914e9bd1c145162937696c69596ca138ec231eac5a72341f5ddfb0c82b09f021dd65600b3f50a2ddcf9
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exeFilesize
1.6MB
MD5db7fb67fcec9f1c442de25f3ad59f50c
SHA1b600aa26d1cded59760304c6d77f4ff75722eabd
SHA256c227208854734bbd38c9f74f39034111733da5c7ce71515b1610aedd79417f9f
SHA512c14ec7d252a6f201dfea476d302fbc5140713cb4ea7bc8d4e610bfd806b3fa3c141153e2e9b8cb36255fba1fab4d4400ed83f5f5c1228d77d77bace41d5de7fe
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ntzz4pbo.jdn.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\Crashpad\settings.datFilesize
280B
MD597b436cee829628a3e4a71cd1154968b
SHA1b9937fb35c08b623af9177144075f626fff10938
SHA2564f1cb97e8dcb59d13f83971c7302d72bb7711b754b05368495e04c72a32267e5
SHA512c7ea089480ffbd824e68efe4f27e15c3b04dbbe7341e42b909eb11aadd82c08567b602629a6f72d318b014f443fa17735e3c826ec5c42ef04b88018289ae89b7
-
C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\Default\60e7e203-6c53-4d39-bb9e-729396ad0a17.tmpFilesize
6KB
MD5addac1012bf50e6a8c1c462826e95017
SHA1d18f300dc051ccba0feb07710e29005284e5bc85
SHA25616158688e7eeed0e37260369e64f7ed20930733ecc6540122b90d3b82a2f4dea
SHA512ba08f4bc46585e6c26712417d48e3bf90d7822fa135f09f0a920275e4797ac72238406d6ffb95c5b2930f70629cd22f52b02ee273ea8c9fbbe0597889b156b60
-
C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-indexFilesize
96B
MD5590f5b11be29cf221accd6293b01c8e2
SHA1cb2bc8e6d68fe4624493cbd22f7400b0a8b50e9f
SHA256ea3619f6c6acbec5b630c8713fd9600ee8e7bf3a75641f87ea5509e14fd21442
SHA512cbe661cb9a4c659f45eb446bf823d9fa095611a6f28e2e4272b4a6dea392c6f2ec6fc5a80489c7e7ba7104d138d723f68a27cc62d142faebb67a00d137983af1
-
C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58ea1d.TMPFilesize
48B
MD5aa183c77180c68308f27cce8d4ef0763
SHA1aa14339a84dd4f29b1299d07951ad96bf0b01939
SHA2560c5347ddc67321c7aef94e89c16c6d885869f4f83961df60e8807dcf679057a1
SHA5129260efd55e59974294ef6d13d2f573713e1b788a5a6cf4b36a0fd603b65e5f8beeb0a582256f45d6b7e4ce31fef002df62ea961bd4d4124cde5b21cd59127d59
-
C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\Default\GPUCache\data_1Filesize
264KB
MD5ef89a6d3fe86b0efcf6d0b5990a83722
SHA188f6dc9063db2e9bf35632d6ee4f7c7b7878f911
SHA2566e5126d78b870a4202bb1f48c4bce58ea13e300bf4a5debdff424dd9117706e6
SHA512b69bf6f892889ceed448f3716c67035dc1b3583e2565f20aed13a356490bfa68b957c19e293af9d2e608c228931a648fe63b8194a75863883bda0c47cdb4c444
-
C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\Default\Network\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\Default\Network\Network Persistent State~RFe591ca6.TMPFilesize
59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\Default\PreferencesFilesize
6KB
MD5eb1af26578a70d3571a4e21c0cd5b1a7
SHA115e5c3a01c3cd2aec1bc9bc23e20e0ac3cd906ee
SHA25654d8dfca78121e7772ce3e846be5625fc7dbc88777753514881b683659244121
SHA51210496238fb79654a1db15345f41b30d13e91393f792957687c6c61f796533f91d366d7f1af3219fad98f154c17c5201c679e04cd1445d3ed53f5b5ad7a646466
-
C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\Default\Site Characteristics Database\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\GrShaderCache\data_0Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\GrShaderCache\data_2Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\GrShaderCache\data_3Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\Local StateFilesize
16KB
MD56d5f5dfdcce09b432cf41f4896d60691
SHA1b607a6a1cf501fd7ac0883a7c07ab7089540f375
SHA256e268707f4fa0da32534d40c3e044ed8f9254c8f503e483004fc9ba5bff70d96a
SHA51205f215c27dc4d451d60448a1aee0b506fdd90f1368553a2998ac3b9bf9c8cc89aefa104273b39c5f3823a5e9b3a8aeb514cd6ed2f14641196c7e75d0804a0fb3
-
C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\Local StateFilesize
2KB
MD5cf05d89453321e4e22866e0768049abc
SHA1219fe6bd193ea074d8ba06fa270be4bf9c8d1d57
SHA256c3bb44964121f54d20c802826cda8644dfb78bd5087651ca22cd40012ebda8ed
SHA512ea68ab3702df75a7be5fefbc984463a6d94904eacc3b0c664425fca927c3c26110ca59896acde9725dbf4dc6de6121c0d79d7b5726db6dc0c25e20e59c0ff20e
-
C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\Local StateFilesize
3KB
MD582003750b3aa7efe66367628545c3a10
SHA124db24313c369a05b6c51339e51efe98d4ca5edb
SHA2561de3342e41f663de9bfb7c63b016d11414cb18668fa0cef946ab221e362ae52e
SHA5128cb7feff869f5d8888a7407284b9cf9ee08fcd64728aaca970f64831712cf3137384a4568135a8e79a3ae8bdfb5e3f9dabd19affb5e134428895b7c8a18ba79b
-
C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\Local StateFilesize
1KB
MD58fa1d7704c5f457277027446775c904b
SHA1a8b465bcd66c385ade49ff8bc1741b0ce82ed9ba
SHA2569d1e36a236c2bed7f2e37f1af1aa39a2b1c30df8d27be8b03c1c57bbc4b02602
SHA512b418d0d1c297330c665941bd2328b41ec459ec91504f9aa8d1ce04ff0ecaedf84408758eadfcb16e7668d4471dca2d9351867801f23322fcaab0c2ace24c1fa8
-
C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\Local StateFilesize
16KB
MD5408a62946bac85ea9eac477481a357fb
SHA1c1c557ea549f5e799a8262fe125493f5d053b28d
SHA2565484ae468b31ddb5cd5379c5f9f5d06729cb9fd1fabd57f81d89c5852ed47b33
SHA512d9fb37d2e8550fc4b0a81c5bad13073541630710daf345e7ebbd1b9cf2607d6700a82042f22c87ee433c3cbb8ead65053e28afb893bd114332b9ec1b55c77ef4
-
C:\Users\Admin\AppData\Roaming\Nc-LoaderV.exe\EBWebView\Local State~RFe58998c.TMPFilesize
1KB
MD5c389d121ef06f5ffc9fe58f2d3fe0b05
SHA1ff7424872c5fdcdbf2ca6c09e9dbf3685c35741f
SHA25659851b8c36a1271732d94ca676bff59666fdb3491cd02c98d91497c21e7c1439
SHA512d169f7afa83fb30c7401aa54dadff54652db79953b219173696e0f8e47d470de41a8164be032972ce3e2bb9c4af07d17ed7d0ef1b9105d55a80a596860e33156
-
memory/396-347-0x00007FFBD8EA0000-0x00007FFBD8EA1000-memory.dmpFilesize
4KB
-
memory/396-489-0x00000142AE940000-0x00000142AE9EC000-memory.dmpFilesize
688KB
-
memory/832-731-0x0000000002810000-0x0000000002C10000-memory.dmpFilesize
4.0MB
-
memory/832-734-0x0000000075680000-0x0000000075895000-memory.dmpFilesize
2.1MB
-
memory/832-729-0x0000000000A60000-0x0000000000A69000-memory.dmpFilesize
36KB
-
memory/832-732-0x00007FFBDA110000-0x00007FFBDA305000-memory.dmpFilesize
2.0MB
-
memory/1272-303-0x00007FFBD89D0000-0x00007FFBD89D1000-memory.dmpFilesize
4KB
-
memory/1272-302-0x00007FFBD9B30000-0x00007FFBD9B31000-memory.dmpFilesize
4KB
-
memory/1848-554-0x0000000000AF0000-0x000000000418D000-memory.dmpFilesize
54.6MB
-
memory/1848-487-0x0000000000AF0000-0x000000000418D000-memory.dmpFilesize
54.6MB
-
memory/1848-533-0x0000000000AF0000-0x000000000418D000-memory.dmpFilesize
54.6MB
-
memory/1848-548-0x0000000000AF0000-0x000000000418D000-memory.dmpFilesize
54.6MB
-
memory/2232-419-0x00000259D35D0000-0x00000259D35F2000-memory.dmpFilesize
136KB
-
memory/2904-453-0x00000000000C0000-0x00000000000F5000-memory.dmpFilesize
212KB
-
memory/2904-210-0x0000000074C50000-0x0000000074E6F000-memory.dmpFilesize
2.1MB
-
memory/2904-196-0x0000000074C50000-0x0000000074E6F000-memory.dmpFilesize
2.1MB
-
memory/2904-195-0x00000000000C0000-0x00000000000F5000-memory.dmpFilesize
212KB
-
memory/3220-471-0x00000200439A0000-0x0000020043A4C000-memory.dmpFilesize
688KB
-
memory/3604-488-0x0000024EB6D40000-0x0000024EB6DEC000-memory.dmpFilesize
688KB
-
memory/3604-279-0x00007FFBD8EA0000-0x00007FFBD8EA1000-memory.dmpFilesize
4KB
-
memory/3992-507-0x0000000000AF0000-0x000000000418D000-memory.dmpFilesize
54.6MB
-
memory/4000-552-0x00007FF660DA0000-0x00007FF66172C000-memory.dmpFilesize
9.5MB
-
memory/4000-545-0x00007FF660DA0000-0x00007FF66172C000-memory.dmpFilesize
9.5MB
-
memory/4472-724-0x0000000003280000-0x0000000003680000-memory.dmpFilesize
4.0MB
-
memory/4472-553-0x0000000000600000-0x000000000067E000-memory.dmpFilesize
504KB
-
memory/4472-725-0x0000000003280000-0x0000000003680000-memory.dmpFilesize
4.0MB
-
memory/4472-728-0x0000000075680000-0x0000000075895000-memory.dmpFilesize
2.1MB
-
memory/4472-726-0x00007FFBDA110000-0x00007FFBDA305000-memory.dmpFilesize
2.0MB
-
memory/4472-551-0x0000000000600000-0x000000000067E000-memory.dmpFilesize
504KB
-
memory/4864-510-0x0000017D65F80000-0x0000017D6602C000-memory.dmpFilesize
688KB
-
memory/4888-470-0x0000000000AF0000-0x000000000418D000-memory.dmpFilesize
54.6MB
-
memory/4888-194-0x0000000000AF0000-0x000000000418D000-memory.dmpFilesize
54.6MB