nanocore | hxxps://github[.]com/reed427/Nanocore-Rat/archive/refs/heads/master[.]zip

Analysis

max time kernel
530s
max time network
517s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
27-12-2024 15:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/reed427/Nanocore-Rat/archive/refs/heads/master.zip

Score

10^/10

nanocore collection discovery evasion keylogger spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Nanocore family
nanocore

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/600-1984-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/600-1985-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/600-1988-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/600-1984-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/600-1985-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/600-1988-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

Executes dropped EXE 3 IoCs

pid	Process
3280	NanoCore.exe
2736	NanoCore.exe
1980	virus.exe

Loads dropped DLL 26 IoCs

pid	Process
3280	NanoCore.exe
3280	NanoCore.exe
3280	NanoCore.exe
3280	NanoCore.exe
3280	NanoCore.exe
3280	NanoCore.exe
3280	NanoCore.exe
3280	NanoCore.exe
3280	NanoCore.exe
3280	NanoCore.exe
3280	NanoCore.exe
3280	NanoCore.exe
3280	NanoCore.exe
2736	NanoCore.exe
2736	NanoCore.exe
2736	NanoCore.exe
2736	NanoCore.exe
2736	NanoCore.exe
2736	NanoCore.exe
2736	NanoCore.exe
2736	NanoCore.exe
2736	NanoCore.exe
2736	NanoCore.exe
2736	NanoCore.exe
2736	NanoCore.exe
2736	NanoCore.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	virus.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 600	1980	virus.exe	118
PID 1980 set thread context of 1324	1980	virus.exe	119

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NanoCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NanoCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	virus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NanoCore_Portable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NanoCore_Portable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2356	timeout.exe
1020	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.4355\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffcfffffffd10000005504000036030000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{44B60F44-C466-11EF-B6D2-7E1C239293DA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133797861304627554"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NanoCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = 00000000ffffffff	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0 = 50003100000000009b592f7a10004c6f63616c003c0009000400efbe8b5970779b59317a2e000000190904000000020000000000000000000000000000009ce2d2004c006f00630061006c00000014000000	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\MRUListEx = 00000000ffffffff	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0\MRUListEx = ffffffff	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0 = 4e003100000000009b59317a100054656d7000003a0009000400efbe8b5970779b59317a2e0000001a090400000002000000000000000000000000000000f4c38500540065006d007000000014000000	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = 00000000ffffffff	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	NanoCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 78003100000000008b5970771100557365727300640009000400efbe874f77489b59ef792e000000fd0100000000010000000000000000003a0000000000551d890055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NanoCore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0	NanoCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0\NodeSlot = "6"	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 = 50003100000000008b596784100041646d696e003c0009000400efbe8b5970779b59ef792e000000fb0804000000020000000000000000000000000000000f351b01410064006d0069006e00000014000000	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 19002f433a5c000000000000000000000000000000000000000000	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0 = 56003100000000008b59707712004170704461746100400009000400efbe8b5970779b59ef792e000000060904000000020000000000000000000000000000005fd57a004100700070004400610074006100000016000000	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\MRUListEx = 00000000ffffffff	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NanoCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NanoCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NanoCore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	NanoCore.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings	NanoCore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5016	chrome.exe
5016	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe
1980	virus.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
3280	NanoCore.exe
2736	NanoCore.exe
1980	virus.exe
1360	iexplore.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5016	chrome.exe
5016	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeDebugPrivilege	3280	NanoCore.exe
Token: SeShutdownPrivilege	5016	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
3280	NanoCore.exe
2736	NanoCore.exe
5016	chrome.exe
2736	NanoCore.exe
2736	NanoCore.exe
2736	NanoCore.exe
1360	iexplore.exe
1360	iexplore.exe
2736	NanoCore.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe

Suspicious use of SendNotifyMessage 63 IoCs

pid	Process
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe
956	taskmgr.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
3280	NanoCore.exe
3280	NanoCore.exe
2736	NanoCore.exe
2736	NanoCore.exe
2736	NanoCore.exe
1360	iexplore.exe
1360	iexplore.exe
860	IEXPLORE.EXE
860	IEXPLORE.EXE
860	IEXPLORE.EXE
860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 2144	5016	chrome.exe	81
PID 5016 wrote to memory of 2144	5016	chrome.exe	81
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 5032	5016	chrome.exe	82
PID 5016 wrote to memory of 908	5016	chrome.exe	83
PID 5016 wrote to memory of 908	5016	chrome.exe	83
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84
PID 5016 wrote to memory of 2452	5016	chrome.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/reed427/Nanocore-Rat/archive/refs/heads/master.zip
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffb225acc40,0x7ffb225acc4c,0x7ffb225acc58
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1956,i,5345044870746009274,13737139945518261736,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2140,i,5345044870746009274,13737139945518261736,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,5345044870746009274,13737139945518261736,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,5345044870746009274,13737139945518261736,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3104,i,5345044870746009274,13737139945518261736,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4816,i,5345044870746009274,13737139945518261736,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4672,i,5345044870746009274,13737139945518261736,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4956,i,5345044870746009274,13737139945518261736,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2668

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:732

C:\Users\Admin\Downloads\Nanocore-Rat-master\Nanocore-Rat-master\NanoCore_Portable.exe
"C:\Users\Admin\Downloads\Nanocore-Rat-master\Nanocore-Rat-master\NanoCore_Portable.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempDel.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:408
- - C:\Windows\SysWOW64\mode.com
    mode 30,20
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4024
- - C:\Windows\SysWOW64\timeout.exe
    timeout /nobreak 10
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2356
- - C:\Users\Admin\AppData\Local\Temp\NanoCore.exe
    "C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3280

C:\Users\Admin\Downloads\Nanocore-Rat-master\Nanocore-Rat-master\NanoCore_Portable.exe
"C:\Users\Admin\Downloads\Nanocore-Rat-master\Nanocore-Rat-master\NanoCore_Portable.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempDel.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4144
- - C:\Windows\SysWOW64\mode.com
    mode 30,20
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4772
- - C:\Windows\SysWOW64\timeout.exe
    timeout /nobreak 10
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\NanoCore.exe
    "C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2736

C:\Users\Admin\Downloads\virus.exe
"C:\Users\Admin\Downloads\virus.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1980
- \??\c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
  "c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\Admin\AppData\Local\Temp\b3vcuiby.zkw"
  2⤵
  - Accesses Microsoft Outlook accounts
  - System Location Discovery: System Language Discovery
  PID:600
- \??\c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
  "c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" /shtml "C:\Users\Admin\AppData\Local\Temp\iogxeikw.n55"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1324
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1072

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4d0 0x3a4
1⤵
PID:2552

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1360 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:860

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
23560697a8f4b2ec4aa747bc26d389ab

SHA1
c9e9f6d4b2c98b7c67990de2e73d9275e7bba2c3

SHA256
a07177e888cc637b21e38968b57a985d83704a0e70c3df49c8c7644235556d69

SHA512
0ddcb03a1d7c14c495621295ca3bc80374e331df2494ee133a774ee8c7651289c4c2bc7c0e73cc33ffb04f18af62e6510c25cf527da96a035604a0db9693d6b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
ee75aca4fb6df4e77dc92112293bed11

SHA1
ab078254253edd1ae1d6b46c98dc2ca9edc4f6a1

SHA256
2ab56180f689ac4da198a8cdb53553dd3d9c4af77b83f4665a66ee297254d24d

SHA512
636e51e3ab8bd6fab4413e4d3a8d5a0197d3d17fae4ef74158b97b56803f1d74a628b262d1712a3bb4dcc6270454e22ce0e3b8ac8e28fc9a52c6ba44e4ba7023

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b7fab7683c900ccf253d9ca6a34cd16a

SHA1
6a43da3a5465d4e0b5b22f207ea3136097ab1d88

SHA256
f706b5be9bf4d9264aec454769f1a455f8f03185ee33a7cf3d18bac6a56081cb

SHA512
227df273e073b1045e491d27368e58d38900cd2b07abd3a653b96c4e514888cba06bd4baf04929a0d77a759b895cf1a232907edac0c4fd77165ff372f5a95c9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
691B

MD5
d5c8cc410cf3400d9643895be584a968

SHA1
53a1d676c39d120b8b76dee3eb715d8c174a8a40

SHA256
0e7fcc61fcb7bdea7a6655c459b79740738cf9df7a8d3387f90376417f8d074d

SHA512
9b5dff6c2eff13cf9065f3c0ecac0e2da2ccef18caf87e6431ff54ee1e5de6e038fbf36bb362ce89de419f2a90d6bcf4e285591d6d36cdd39d55c580080208f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
c6e12fa0044c3a278ec10468fe00e7a1

SHA1
777b9c54032304ce347c2d2f604cec18a5c977f7

SHA256
a4668f7c9d07724e5af4e8c7736466445726469509c991d171a666ab4bf138a2

SHA512
721595337d55ec3ee1499a1d18b1c8290e68ee42318a2441cddf81f67bc229cbfd2a899be6d30d3859d336343e264f824d240e4d0dc33ae76b295b9c98c5f00f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
2e2e4296a722eec6b7a4dc7fc37cccfa

SHA1
5c50e2881d3e0ff4a1ee18b93b798c2bc2f3b325

SHA256
74af70194228a68d183024e5ae001c009593e0c4ce8f0cdc3aa7cdc6b6061e79

SHA512
2118c5f992b7b2146de136a00af70de5a53365d8cf0949a63629107f97113ab46f6731f76d42cac1d0e1bee376807e4a0e5a53af14675cbe02f32c7697634efb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
90b8dc241b3a573fea6b6240ed1d39c7

SHA1
9ccaf324729bcc5515217b9df2d7615298f7e15e

SHA256
28e37d35cac32002e7da11d6608c120d2efaeaf174eb93bf0285bfb4f785978d

SHA512
5e2353a8f51b6d60f58ac1b071abd127f5641fd5d3e780ff3b6fa8a83b847e01a249260b8df6e6cec1ccdf5648b9e9517705154a2c4a05e00eaf1f244b7dff2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
f59e4ef7aa14522e7e2f521a6e7c3870

SHA1
fddfb99419146bf2329955b4d4ea94a5905d8cf1

SHA256
31444af6c5aecfaa8ce49369eb429a22dbb9ee9bac9173bc89373e2ed88d6614

SHA512
895e2d84b0fc4cfe24a0826a66b3f0fcd028d45e75ecf0925b3c46497029e9c034db49c8eaa5d8617f49fcb103acb8b46ab142e7e1ff4455a4890cffa532953c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
f4ec382e66b64e26099801838719942e

SHA1
3d0d0b94693b0ae0dad066a99733634b950162f8

SHA256
5af41972d42e42671b326b76dfaabec0acf6804647aacd844645b82b580e2ac6

SHA512
19ba843cc7d8b4a33c616e258f979e4e52e2c1650ec5c4f8ddc2818c2c03373cafad4500a4bd8f3f77c7895a0f359135fd50adcc0068255884124d1ec1d3a8cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
b4918ecffafcd675a20df5806f39a875

SHA1
6613f9a9c7f58db8ce84b9d82da641945e907b6d

SHA256
c23a5a077524ec1dac6cfaef994c64763f9d4399338fcae8883d809522a6c960

SHA512
a0e09c17e3b6f2fcf608780b2b3050a13f7535fa29125fc6e332229c1f34262e4d90d6e01f7ced90bc1906fd8b252308fa7d95e90a68de375a0490c3bc826e16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
d7e156697d50982b62af1c9396a77e2b

SHA1
97e876e66cb709fceff09f6437f0f801ba893ff1

SHA256
72d79233729eec9b65a833e40843cd3e044fe121a741ac1b0327dea0feadd346

SHA512
5a21cf2b06df5135345dd5b4d3c0682ec605e3f84782f4e6cfe4ff81da8ea8443b7831d2fbf6db4d15d56e562e844a06dbdb2f6f716ef8c050997de1ef0fa7a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
6a584025831df8eb5a4fa038d7e14c69

SHA1
21055ae005c3381fa86c78cbded0283fbbb9cd1a

SHA256
ab508fbdd3e392b1aad258861de49bd22d6752cd5f79db39b5aa581fa1ceed3c

SHA512
b956f6844d6522d4411e70ac53c89d0e7cf1e99b2c042f29a03d63d3827d3fb0f53232846b3596aa46eaa953bb6cc3d8cb14d8ccb5426394fcc5b0dafb67d8f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
45ef47f6d007dc3f34c3fb16875113f1

SHA1
3dd94e571d2ab36dc1fe9e3e419e92ddba7cd571

SHA256
b671059b690e899e825865faf37bf55afdd4fecec7aad5071c20a101e88d6b00

SHA512
e143d715fc45fe48037851aea24eb623214f69576ea3e78188019630e9a0567d788ebf676d35b703715eb45c5d9f6f7c2f6a5927cf61236d9ac2867f571a4fa7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
c57cd3e7ec792a8786c1f73c63c1f335

SHA1
195570aef30ecc90bb6ee52f9182fac99b5822e1

SHA256
300b81e88682c99d4ef1571e931861ffa1f096a6fb357491a429d1b65dd9fd7a

SHA512
50682cca83e0e5a1104375d081a03875d3f9bc388ac8f3ea1bc557ea1429e10b7b973aeb238e2a37cabdf2d82560611674f1a5053173ca98c77254907e152375

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
6eeacf7cf006f2513607fa8c896153e4

SHA1
a42ce606cae8ffb17eb066062736b60244af8cfc

SHA256
5712ae8e31596f0e121b5b23035ceaff7cd16c928389fbfb87048b0f00202460

SHA512
fac6924d1bdf96d1a41b693082929f5f78466f89c6e7e8040610ab75ba52c1bdee52c18c4c226c1601bac959022e4aff8ebe38e4d3ed61ddc88183cec1755d0b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
49b0ea61a146ec1764d018bfb8c93c03

SHA1
1296ce5e859730f2fef0e02e2e4ca247bfac2195

SHA256
934eace82fee3d3761e0cadf8be5bd349c4f1aef3ff8e4c5d25cff44089387df

SHA512
12225cca0afaeae77344a8abbb1369312778cc39303ecb1f342cdd7271ea63f74f72f79b865e6597f50b5488b14deb2cf9897e90e50320aa346ebbe75020537e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
828792d97d36b76c9d14bbddfbe850ed

SHA1
12169ab332a3e3c28eaa5466aa6ab1ec9de4769f

SHA256
115cae792eca2465bdb2abb4336b5cd9990f43d86a762264bc640862193d61a2

SHA512
195befbc81b35b9c6debe1631b72caec6c8a43dc80b9aaea35bd96207deca21fbf806a4a54b28c728d6203da17173aa8b63da27f4da2c775545f306a50996687

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
d40574760c7d8ec429945888d6379cc1

SHA1
1f3b8275adcf8c84469b448a8127f1ba14240d0d

SHA256
6f91e0b6dfde5d1877308400e0583ef9873413cd6c112dc86469fc3a183b8120

SHA512
6a5fb3d7f5ccb4b29a30c4602943366b6d5cb413b763e011d04e8db0f3cb76b1a95de3852038a579ee87a37b445b0778ac5ad57fd219de85db380219ce180ad7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
cba65adc3e64b900b0401663c012fe05

SHA1
51e746e2a75e70f80c462a59deea9129b4921153

SHA256
30b5a0147b61d1a0d06659de58eacb57737a3825bf60b44108a986191d715273

SHA512
fc967a2749fddfa0629e8ed2b71f1fb6c2ae232e9759e87d4b60df200e2ba50a0c874ee1536bd4d2a08248361c8f59c50c64cadfe4f6eb10c64e58b76e5b3e4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
ac86fe32f02ec854ebfc11c8e50a8daf

SHA1
29d0ef55a5a830d069ba49d3296a35ec15298e69

SHA256
da65b155a7f1279f0404e8e00270d557a7adb18fe3c0d73768dbfcdef8c4f8e2

SHA512
d0f691cb79545c4ad22cd040ad248ebd5ffd95762b2be46da6f3794267b274212966c7bae39e239306b845b2ea32aa331e4ffad284056be563a0560bbcbb8cb8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
3eeaf89909b7a415c4316e504827d4ce

SHA1
6c68f28455ff65d8479cb68cf46b51b983119f8e

SHA256
ec9ef8e0bdc1ad54d687365d53752df47b34aef5e0be18be6667de4df018bf11

SHA512
4521605e5bdd790c3d9c922ef56f4bcc04523642188fb6f04458ed0dcc9ef835350c235ceb2fd9e74e98ffabc06cd5866f4e4e19564120b56a9cd2a58a467d2f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
a0a1fbbb03df78aab326883db05d1c9a

SHA1
a15e7d1b4857ab55a59d3c0ea3902f903937e2da

SHA256
3a8fd386e3248b2090313b7d049340b81bf539093c869f54e5654833e75a6597

SHA512
ace31a5f010dd4de4580426f7ecfd7e111a9719af3db16707a791de4e27bfe616f4d22c2b7909f16bd431752fb6ddd3a68610e2ae017fe92963f4473cf81c7f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ClientPlugin.dll

Filesize
19KB

MD5
bdc8945f1d799c845408522e372d1dbd

SHA1
874b7c3c97cc5b13b9dd172fec5a54bc1f258005

SHA256
61e9d5c0727665e9ef3f328141397be47c65ed11ab621c644b5bbf1d67138403

SHA512
4fa0ed4ef66e4c442f5fc628e8bfc8a4f84cb213210643996d9387027edb619c054f6104ac889ae77cece09f0304f95d5f20e14d66847e2d382ef51eecec0962

Download Submit
C:\Users\Admin\AppData\Local\Temp\Databases\core.sqlite

Filesize
3KB

MD5
3732df3263fbaa868bb866bcca1f402c

SHA1
f247dc7dfea7bcbb69116920d48af2dabf85b444

SHA256
716d9992711b5b17eca841836ba5a63db0a62251bd056a92db96deccfa887b41

SHA512
bb99cfe2be9488c6d7e57991b2bbc4e593ade8c8d2c79e4b7056ec5be60fd5e0b88467f65dca71c269540b800f0c3319e4e849e7e77069a6e9b1b89a2d4807fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Databases\main.sqlite

Filesize
15KB

MD5
ea522fc387e8e1c1c65e946c9118e2c7

SHA1
0d3fe3c0f59b651f4b9210ec4d7324e7686b5a21

SHA256
ae429dbfca9416cfc6832aed1190fa7b9eb90127328136a249de024349fd3b3b

SHA512
52161556c3d3a1e12fe8de217aab806ac8e8e47135d57f057c257d16576ec08b13bc37aeb7f7234042d89d6deb594a635e0764675f4e04f7abb94836fac1d921

Download Submit
C:\Users\Admin\AppData\Local\Temp\Databases\main.sqlite

Filesize
15KB

MD5
944a89d6d83c4bdb43f35cf424207c8c

SHA1
dde72b17c2c52d600d1ccbfa15f84bc0364f2eb4

SHA256
beaedeb1677204f01353688fe618f5cb7e0fb904563390c7701fa56c569da868

SHA512
ba8c508a4d883c3b9078d0a0724ddc25f67215f3c52ebe2310cc9567536eb79955660ff4aa34c6760b4c33e5f575e55d3276017c6391ce31aa56e4f9bc775203

Download Submit
C:\Users\Admin\AppData\Local\Temp\NanoCore.exe

Filesize
1.4MB

MD5
1728acc244115cbafd3b810277d2e321

SHA1
be64732f46c8a26a5bbf9d7f69c7f031b2c5180b

SHA256
ec359f50ca15395f273899c0ff7c0cd87ab5c2e23fdcfc6c72fedc0097161d4b

SHA512
8c59fdd29181f28e5698de78adf63934632e644a87088400f1b7ab1653622e4bc3a4145094601211a2db4bcbd04ea5f1ac44129907fbb727fe24a1f3652c7034

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plugins\AIO.ncp

Filesize
17KB

MD5
60c274ccb344da9e3d77449f6068d253

SHA1
ab25eddf3ddb61ef52104a01e5c9b8a23451c764

SHA256
0a59aaee013c57f3b6190d683160d88ca1c5868565cbf5acbb7b17d3e925c602

SHA512
9600d852b56557f31a5a18a6aa2cb76cf4fabf36ae32bbeccf82677f64737542234e2fb06ac8d917f9839120320b7db212d76e8dea24445f13096d86a474b9c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plugins\CorePlugin.ncp

Filesize
119KB

MD5
7914e7302f72d330aa5f6c5c8c26df43

SHA1
8c411f3fe5297a78cb018539b44df87c0a51606a

SHA256
f66985518b1e56a04f512d110f5b79f21ed91cbcbf6bd3e17eba3dcdfb85f9b5

SHA512
8959843f282162ff0c59d890d04012c4f62dc36058aa7095d708a97a34313082cd4ca5ea5df5623cd2d6b8b91c527297168cab08ec59c1ec48fafac5983ad012

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plugins\DucPlugin.ncp

Filesize
73KB

MD5
5eca68a8368e0e144b7016e30b85515c

SHA1
0ba48b49974156e5746958aeeb1c2a26c916b3be

SHA256
e2ce89b3e68b003cb27e2c5652ccba073c8938bef194e51830539b2464a3f676

SHA512
ea1d1363fb072a5c646ce070184855588124be42392dc492ce86c88fe93eae78e23f5de4f2df75fb5b0e8d67bf08ff192dd163ed3c62a1ccfb0b8436ae1df644

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plugins\ManagementPlugin.ncp

Filesize
300KB

MD5
b612c2c9a6d361a5db14c04ba126119c

SHA1
d2b29e235b0f45242088b78313438bdfd51209dc

SHA256
b86fe4e126a9748a383a34d615b9598c715f2380c0aad957495c66923902026c

SHA512
194d4688935235f3ca686868c9ff53c7945d4e076d4a51fdcbc254bfa1461494766480794c65715bce314256c7cc5268bd6547c937984d3010f54f5a3db4ba9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plugins\MiscTools.ncp

Filesize
66KB

MD5
78e3006fc6468eb7dfc7761072b84ac6

SHA1
e46cae768d2754f48a29b7e424a9bddf0d67bcd8

SHA256
3a3a3b105eefb45e3b70cc1592e484df02df7020d5154e8c2e5d7d439e295e46

SHA512
0daa1cc9ddae70f442ee5eed784523dc1378b9d095edfaec1df95e02f00d09b461d60ee180f716f7ba755543ef7b0c87d791a454cf254dde0033b8615b2841e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plugins\MultiCore.ncp

Filesize
236KB

MD5
becb82e1e914e906be158e3f9dd658ac

SHA1
725d3d658680ca8dcb610d998db4b28733b5ee52

SHA256
5494adf651fc64e3aa6c08e38165d8dbfec52056cdf4fadae90b76b0e6816a33

SHA512
1d67e7d5686ea225262501afb572bec23e35bbd33c660a57e84b9cad7adfadbe457b128af0059ac705d53c6b65798f5525fe4ed3c16537b0c085414cdca74174

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plugins\NanoBlack.ncp

Filesize
107KB

MD5
794ab16c092ebf2b1d812d6cce158537

SHA1
6dd9edd26b50265d5af4642f9d1f1f8703a44805

SHA256
7919b7998d6b359d7cb700018dc2d69ff6ffb45bd01c9c190b98fb4c9ff4beab

SHA512
e639bb0f7d309344c45ddff3d7f91212b3c6a9db6970d06db35f6bac228b389ed8c32dbda75ae23ad1359bb60f678b0b891caa3ed07245aaad21dcb3ea4a5347

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plugins\NanoBrowser.ncp

Filesize
102KB

MD5
8b13fdc96af0a84c152f5a601dcc6b06

SHA1
1250db70fda8a2c32f37bbdc5638074c6dc171a7

SHA256
997c41b05150480bcfae9abb3132fc807f6c6b511b810b554fdb5aedf89f5db0

SHA512
536d4e1b9e7c95ebac762d0a438106a5409c69e990940d3411709364783f957015d4a5dc0651b33591e37dcda8549e689a87b853e32f3ad065391a2d8190a552

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plugins\NanoCoreSwiss.ncp

Filesize
49KB

MD5
fcb5afd01e75aca8ed9fbd35a46e54f3

SHA1
94b69f8612d31fc0698089d5e08aea1cafea52e7

SHA256
bf0386f6e9b4a35fefe5fe917e2be7c64867efe24521f18e4567f8af5f6dd5e5

SHA512
b587dd23eaea6de486c30864908f8603451c459153cd21b86a5e43bb9c2cca7cbc015daf620808fad76a4d56bbc4e57e127059c8e73be6c85bf958781c1343fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plugins\NanoNana.ncp

Filesize
157KB

MD5
c5d40b767bd6b97f88ccce13956d0ad8

SHA1
ef7f7fdd9d5ea0b55ffbb17c171ee6a46b347100

SHA256
a3c39444ac74bb91f14f3f2ae6918d9b1d368268e137aca310450fefbc8983aa

SHA512
3fcb5a6afdc7de59bac645d8b4dc6368b0405a51985ff86c95fc8cd579bd59bc423cab940dc0ab3de9a0cd0d9e04dad82e380ef18030330d72b2e72936a95ee1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plugins\NanoProtectPlugin.ncp

Filesize
179KB

MD5
e51af633e5f5f4a817a54773fb90d337

SHA1
0cb8a7965f9f042954b1f318ea1026b76e12f8e0

SHA256
b37602dbb924bb94df0d9745d13fcace8a6642397fb738fbe02a88f667f3ab66

SHA512
6454305121597073d4ea2b8f57a4bb4a4fe7fafbd05336c91265534faea5a5cdec7504c1329ea0c8cb344a4f32d59c60af5348dfd89375876ae95ee2c15f0c14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plugins\NanoStress.ncp

Filesize
117KB

MD5
ba6f59df971d6db7a8951edbd5d6691b

SHA1
ed766de1fb4ab0889b3fbc8127f1393eb3cddc15

SHA256
6b33a572e019266749a3e04966e2c57822e247c5197f6f9bd6a4bb8792633581

SHA512
bbd50d7cb2b2799055b8864da3d3d6037bbac41312ce8582c4627611ef856ae38ecff67dc4223e236d1b555bf02a7c0c7284a76ab90007621a2f2997b6bc5dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plugins\NetworkPlugin.ncp

Filesize
319KB

MD5
70e5b02349742a550fbfcfb5bb78c906

SHA1
2319b68398af74fe08b6a3a7d6943cf700240a4e

SHA256
160030b8444b6fa86775a11d1be35df6a75252070fc5661055884d3f8b07296d

SHA512
bbb5d2fd6eff637da303a4ab2fdb02f781619ffe25c5795c5b9e514214227717771a98ce6c3becc87b29c15303ac4373ee3847060ad5755a2455362e6e26932b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plugins\SecurityPlugin.ncp

Filesize
74KB

MD5
44bd68199bb393d0eeb7ae83b56d9b9f

SHA1
c6cfa069a17ace16c651a11945bd54f4ca6193d1

SHA256
25b1b0836838740d394cd35eaefc660e9eabeb611a701a451eb1119f6427fc12

SHA512
a02b82e40f66dc925de3324c03e8a0a497bfdb6ed44549001efbf86f2e5381aaf9259978908cce9ecc7798f083d3691f007b207ea301a9dc73f2430662146bb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plugins\SurveillanceExPlugin.ncp

Filesize
423KB

MD5
195fbe66986564288c3285935fe87b27

SHA1
2fe84fbbf109b3e4c7c63b414689021ba847b568

SHA256
a2ce9ed783b26d01d58e07b9c97bcfecace9ced72960cf3ecf471fbd008afbae

SHA512
552161e555d07fdf7062a4c0d3738819b13ad4c9a5c54f09db48dccf6faf49b014eb043037500abdac7af0210ed118c5232d8d54be367d8a4caccfae7904332e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plugins\SurveillancePlugin.ncp

Filesize
352KB

MD5
ed3edf12bac989d1dd6edf7146feb805

SHA1
776a667bf2341b43e199c3601856ac223b86d221

SHA256
3301f9fd4700458a18589956fd2bb6e5101b15c14f52d5e079ae1c3a008da040

SHA512
e6873a5d1caada8954907bdb3120aa2c60a4137fb9d04abdbb74ade58f35ada1ff87a447cf6a35f5798dbd0e1e0ed813d62e34d98de8d6402b6432746aa80413

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plugins\ToolsPlugin.ncp

Filesize
130KB

MD5
699eb468e7d6bee9c429923b5b477545

SHA1
80bc420c3e441c9b9c3813ac05ea9e168cca1e3a

SHA256
d753bc28d842e44ffbf6cf99314febe5ed7759b25a74ca34a47fdd153bf2a6ab

SHA512
5d82a98e918ea3eb024dbb7552e5cdecc317b49635a5789029e7a0035d2f0cb2a3c47ef53e603217afd17d6f59fc78a918e2e5f70266119c619e41b3b647aac9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plugins\VisibleMode1.1.ncp

Filesize
49KB

MD5
37c2ef6e5214600396ee87c4168a5664

SHA1
69b6e1f612f5a3435fab05074cffd3ebd1c232fa

SHA256
4a8d45e13a38c502a3109d2ea17a81905fb9eabbf643ae611b62f62ef11f09b2

SHA512
667ad370f48470d60dbd437b0601eb05de421ab59b281adcf9c6f54b9c6fd272d3aa34c35e7e6df889771dc5fbdfa9bc683a4bf156727827595edf6eb2fe8cab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\ContextIcons\application_delete.png

Filesize
580B

MD5
333c3e0cc3ff3a57b9ca358de9bd39cb

SHA1
799169a02fc0ad101dad6b8d6d86c5ba76015841

SHA256
9e3de440bec32e23846a9ef37235453ea627a8aeb0a17ac0afedb433fcb448ee

SHA512
3551ad2fba75328aab0ca185290c18d44c1943fc1423f9c3c12b6f450c14be27c4fbfa548d98a664e06693cc706dce1a41c3f5bfaac245440692a25fb11b6b82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\ContextIcons\arrow_refresh.png

Filesize
674B

MD5
9b1a30ac871af0684baa0e4e76911d48

SHA1
c1bf620aa2e493ed63d96729842c650b62c26ab3

SHA256
6141eaf716680ef3030c0db1252bb39bf3145e4a17225d787808c7731ba9358d

SHA512
22c6a8d27ed029cde7812b5cc0442c8e6733fa00f1f62506f6f94cec48026709e0c444fb72dd123b37182c791bb9358d00cac899bd65480c9d05d4b8ce80758d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\ContextIcons\books_stack.png

Filesize
1KB

MD5
f85aa7e604e376846e22060f39ed5cef

SHA1
52682e511e742f72f370946a87022d00e6218e64

SHA256
e10f4dd9daaf95f3aa0f6009e2d82d5c09981cced09c253bf105931a40673750

SHA512
3ccb257db311259887b811ba217122325dc7ff443697abb875a56950be3dd0d1ba481f9ff9b1666c264c277e40938ac403df90179ff1f43749e5882897a9d6b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\ContextIcons\computer.png

Filesize
715B

MD5
c0dc4d56147b86b211c7419f727be0a3

SHA1
71740927a6e212b9caaf30a04eba86ad549bf63c

SHA256
b0b606f3f84b5e1f8c7f8558dd3f092adce374f5c810613845276d47a6401d58

SHA512
a1e89366800e611979fe693cc1a87d75d3e0e9629523b2d19a222b87a4f80e813319f861fd972cb861cf227de272d701f7bac508fb48c8f2d025485fe8b75a97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\ContextIcons\disconnect.png

Filesize
661B

MD5
560aa223ee6d663270b49df9fee84d7a

SHA1
5e177aa1e3180cccc15fc81bce5d23ae32ddef6e

SHA256
d79ca587e71fa6dc2fe27b2fb678b84b01b0509a1956ee8bd852417e860d5fa7

SHA512
7a2295769cd2ed15ad9491afda427a7584fe206fe1158caf01d5d229d7d223820b92fe6b804ed0a5681f0cfd25ba3a2a7280b4180a985c0ba67cd3eca2c37487

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\ContextIcons\remove.png

Filesize
399B

MD5
51f8eafbfab6b02f83e24336f4bb7ec8

SHA1
e18154aabac4f28b829197666e0c156b6fe52349

SHA256
e2a8bd43684bf7955927ed689b191b0fb79552c1440342f0c6dd2ab6bccd7b7f

SHA512
56777a5b8a0e1f65c6767325d6c0527de33e19055fa9af6e4a11af4127d5f2ec22c2a957fbd972991eb754202f56effe53ee392a5cf80ccd5fccb47dfc8c90bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\ContextIcons\system_monitor.png

Filesize
541B

MD5
cbc5a799bd030812570fe27b8a5c804b

SHA1
ef0be2295a7165b76785602e9bd7f5fc13c8cb6d

SHA256
9913c8c7871b787d832a3688db5623e8f72ac547d0517a5c1741e9c24d6ea279

SHA512
ec40b627f37e1c368314cfa7dd6d13adf8d4ab420c96267cb5a1f384a625ec8a4eb8fbbedab0e2b8239906e1eb1961c862a6a104fde83adf14f3fe29109e1197

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\ListIcons\flag_ap.png

Filesize
351B

MD5
b841c2ebdca6bb23c15c98da4aa671d7

SHA1
42f562132fe6e9a5029247a2b9666395dd5ad9b0

SHA256
b668f1a313e57c97a5abd0212631ea6211aace15b10f1ca82484f23f7d6924b5

SHA512
e093c2c454e8ceb318df0629f5f7e8494213e69caef640dd4554f3c250029e8a06b4c5add9c13e457f901c3d328738b66db524a8404617e486fd8c564dd04c90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\ListIcons\flag_ax.png

Filesize
501B

MD5
4ae673575f11db0b2934308ce1c92190

SHA1
31bdeda888dfecf35e3b8a278b1bddd1d4154855

SHA256
bee6cbdada24b441e920ec43be7c0225fc6055db1fd8b8a55b478751e1df19b5

SHA512
88d378227378f388469ba282c3d1366fe7960a494df1b6e2c43bd17983eb313cf4b9669a2fe7fba2755e93cd1d048fbf0289c9843e377e6eb932dd8f26b8928b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\ListIcons\flag_cx.png

Filesize
626B

MD5
fbf02dad6f60392ce777d006d5762248

SHA1
f9d95e6e5e25b83953e4f898bf99636d85511709

SHA256
45203a04468ff78fb3434f46799ca630172e04f97c566f8e143539a80c48bfc5

SHA512
9f5b7b5399cb7c8b41cda202eac5a344524f135fd2e32a5f312917c7684ee13a94976984154355297bb31fd06435efe91456e189bb5f1c9d6010dfad01415b4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\ListIcons\flag_eh.png

Filesize
538B

MD5
2ae81f24c0ad633631872e262ea44d69

SHA1
21cc59676364f57710050ee058f29bc8cc5c4cdf

SHA256
ccff90eb951ac70f01134e0ad8736d0567060b7a535dc742b9508f8a5d69bb33

SHA512
302c7e62af7f9d61a8cbd1a718ed666274b442ac66de457d45942c2dba6e05ab3465b9b6f758e6fccd0b75e3ceddd2264a4f4dcbb6df9c854f62556e4b29d997

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\ListIcons\flag_gp.png

Filesize
546B

MD5
5ac0d15234533136bf6ec230686a4aa5

SHA1
2f208a8baf30d13aa23382d3821cc73c4aa466f0

SHA256
5cceb033c0262b5905f88d5905777471e9f1b0b0d9cb857f2361e88ada73610d

SHA512
d6215183f13e36a268b849056fe1479ebd36eab4b6f175cbdd3a4ecd4ba4df7734189a2f9e9d69ee344ca63baf2c9ef10f62663cc721e9c9c59775d5e84e2268

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\ListIcons\flag_iq.png

Filesize
492B

MD5
458a340415689f3e1804e6fea70b95be

SHA1
7badfd77fd48158f447e7ba10ee31e5e5ec8c607

SHA256
05f9e0f0b718791d3da5d81d73e8d57c3ac5650a05561584e981fd58bd51cbaa

SHA512
6e15693692b8841c8d6303b9d859289041bdd2d2903c6877e1bf0969856bedbc2ff72f633ac684d9d33c6a9f56343ed637058516390b5d690c5e62f92e46e3f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\ListIcons\flag_nz.png

Filesize
641B

MD5
522755a2f4275cd5d5f858d879a9ca05

SHA1
02c4fa14b8dcb9e054813cf4c4f5ac3e3327cae9

SHA256
ad76983c860e3f7645ba50b60660ef3b1020a874546f0c8a0d3911a72b842949

SHA512
57b7d798d22508c59ca8fdb11ff3cbf7a71879a5c94b1ff807d3a5e162fdaa92683dd48ad0c1f8fbc34f60fc96f7716531ef714918b15d9162ec7dea774dd15f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\ListIcons\flag_sj.png

Filesize
562B

MD5
4f82c2e83eab05d2bd9baaeff6c81a96

SHA1
e1cd3981d14653bf5df976ece649120134e88546

SHA256
15493361692068154ac1b1baf8878c179b353996dcda4d63e0322ea37f998f9b

SHA512
b69030fffb689094952eb472b272e1d18b40d0f11e3bba647c9b01226ccf072d276cc31ce3a1ffcbc84c5de82bedfe7fc2466fb060ff50e528f7c258179e626d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\ListIcons\plugins.png

Filesize
14KB

MD5
3191ca0269497a9566299585d427bc15

SHA1
7db0caabd0a466730b264d07c8cceeb62648788c

SHA256
e60d5bbd1aaa36e731ef53f09dd4b010a041dd7c346c4f3ae0b824f63c37959f

SHA512
6d76f44efea93a2f43e3d9ac11bb97d279a9d3fe668382c2e747ec5bcc0e48d5decf59e2772058e804bf32bc74f4b0380db8dcd0f652073661e68abcbe5adb08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\TabIcons\builder.png

Filesize
303B

MD5
d2d498dc06990b948ef42c479c4c1f94

SHA1
eb380e6d156f5cc2ab28baa5add2ba8acda088b3

SHA256
ce8e344d1975972fa3f1b54383ab01cf522217e83b4e01f5c5b8563641bf6550

SHA512
fd9f99b7489507d8208432847085507e5d1823f1eed5d3c7e644c59bc5e5b36d8705d4add01a0c291240029458b25d72894fc05efede8b795bb6872e1e5f9ef9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\TabIcons\clients.png

Filesize
462B

MD5
0331dbac2291c05d567461b58654d350

SHA1
1f89cdf7199983e788fd1f22b873ab9b0500952d

SHA256
8d1339e002540de132326aeb1d17c66a9a60b0af7e3daca9bc40df17e9c96542

SHA512
2d12a85226a21670c49038e4347b39227b8d8bca07b8eb66f2adae0ccf1135270f5ba5f16a40bf526477c70c00c1ca572bfb973306e6eb8dd057600de38da161

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\TabIcons\home.png

Filesize
343B

MD5
0a482ce7f891fe7a64118bbb34a34b9c

SHA1
2aba3c06942273aebc5e616602620e4b2526ebe7

SHA256
76d3e6c51702b37227b73a4f84771e44d7c1a8551b4c1fdd90e341f03a805346

SHA512
0e900eff9109ac2f32137d9d18993a29ed6065299ef96554f2288128fe07d1e8db1a0dac29b39b0eb05bb8a9bdca5f083da8e25dec3c880ef155401fd649107b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\TabIcons\network.png

Filesize
230B

MD5
48780574121d519661c2e0bc51b25b68

SHA1
89d8d5e42fbae3d95c8036c1738656b8e6343091

SHA256
28f4c682d85fb4ef531a71b7fed8f0d7ef548f1126da378aaf60349219a681d6

SHA512
7f0d9b6e18b812350b9d57439069ebb9140365830ea6fa247527f793cc58271ed7743c514d7488f026064b6d44afaf93717192bcff3ea8a3b501f2bf7718ff30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Resources\TabIcons\system.png

Filesize
273B

MD5
9993c66f33d16d11e701abbabf5a5db8

SHA1
415a0069f21dc5fcbb7bdaa7f17a679eb18e6b1e

SHA256
24c4edf86254f9e2359508909ba52dd683e1f6af0d8c1a52f875c472fc73bd40

SHA512
7a3f0546f4fb12e72fd774f5c4446e8bcc2a26c762aad91675c3bc10931c1c0ac2c40d66a25afd0a376ab665427164367c1cf398c22811eedf88c90ce51a23e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ServerPlugin.dll

Filesize
28KB

MD5
952c62ec830c63380beb72ad923d35dc

SHA1
6700baa1fb1877129e79402dfe237f0b84221b69

SHA256
2e5fbfb7932b117a2f6093dc346cdee4a5702e39739d9c40d27bfd1580f6f0d7

SHA512
5dc19d7d6ab7670ded766f357e481328c8df4a96ac3c2a00194a5ccea8c34bca0e34cfea3d9d17934db384d302446be2fec9853438371561d70580665bffe121

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.dll

Filesize
256KB

MD5
dd3d6f00b1aba3f1d9338d9727ab5f17

SHA1
faf9364a7ab15f27c93a6e6f97fa025030c9dad7

SHA256
f0d4beab24e94e61f219df451d90dbba3d0f48539f9b6a448f91e0c94b4e80c4

SHA512
0794d850a133a98affe627e3023114b229b982e507d366895ece6a1ef99b42d708554c64b52f0f2ed63673e1c5aeea7e794085d45f0797159e21ba4efdf23cd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TempDel.bat

Filesize
204B

MD5
3b2fb2a8ccaaa86a5fbcab338e641ff1

SHA1
bfd7df0e383c404d6c5cd58687954426a43acd7f

SHA256
34cba91daa5d60239496f52d4da9c526a0ed7680adf8f4fc491b2ddb32d48208

SHA512
cf00ac00845f1ac0cde6a18507c8b629c95a4391170dc1297e596406e0aa5802090b3631aa2bc3dc8632fe6c85c3d33557f9235cb43a833cbb4d8f3d84bc4443

Download Submit
C:\Users\Admin\AppData\Local\Temp\builder.log

Filesize
22KB

MD5
0061a98407086fb3106b61fe5d0fbb27

SHA1
c5882467e947fa1cab30dd45fe337b23bce1712a

SHA256
054dbc3e14992bea750e1f366c16f6b0c861bc9db2617be91cbf7306fd25219a

SHA512
b4e0f10067b2a5b7865b404c63be1c93cbda482ed3d20e618ede411fe7f9bc177792d0ab0bb7c13730809f9630ba5160f485a38590096ba8cb8104ab189f2c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\client.bin

Filesize
130KB

MD5
906a949e34472f99ba683eff21907231

SHA1
7c5a57af209597fa6c6bce7d1a8016b936d3b0b6

SHA256
9d3ea5af7dc261bf93c76f55d702a315aa22fb241e4207dc86cd834c262245c8

SHA512
29fd20ae7f1b8bac831c0bb85da4325a62e10961989e14299f5f50776c8f7e669cc1527bf2c3868bd7230e73ac110ba8b1f0491ac0f2923d79d7a2871c7c961d

Download Submit
C:\Users\Admin\AppData\Local\Temp\plugins.bin

Filesize
240B

MD5
5e709fc806e8ba3385487699004f6d29

SHA1
2f32547ed5b9db3b33969fb4858945610aaeedb2

SHA256
9ecbf989dedf1403db953fb4e5955c9f63415cbe1f6492c3246bac405a4d036f

SHA512
a6706c9f76d837a7e0ab12e3c1c6d94fedde9dc52d4fecd02befd8850752155e2bf801cdf0488a98e49c50c4f0595a3fc4916950badba9bb83a5b7a35d3ffaab

Download Submit
C:\Users\Admin\AppData\Local\Temp\public.bin

Filesize
17B

MD5
602d0cc4e7246f8a3b8a5ee9c7fabe30

SHA1
e9ecc8f782cf27ae68339b0cdfd0f79c69aa4afc

SHA256
6de29ee3e660fd3ab419f568fcf65f8418484eb43d5bfcdbfac5d456fd8488f2

SHA512
ccaf306f4e4b4ee7de6a62954bbebcb52d131da49912d2d6ad39d07012dffe66ec6109dfbd5fbfd166e98e7bcb2c564b75eda0a2eda2ee815f71db5986506f43

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.log

Filesize
103KB

MD5
ac6285562e5e3e4e98feb7fe8df884a4

SHA1
4b7fc4ea7c39b95efa7d4e1d68b9b3994c38683b

SHA256
51d9e422386e5e64eadc212bff06b33c2a163bfe355ce98d756ce00afd76ae2a

SHA512
6db244bf0e1948626e64b2b8636b9bf71fa4b2bbe5e7c4877a444da00bcc7964efa9f01f6e4c90963961a3a8bdb3bb8ff7d28660596e6f468b53313ab5e3453b

Download Submit
C:\Users\Admin\AppData\Local\Temp\settings.bin

Filesize
280B

MD5
daa76574a834b950a015d191e410c400

SHA1
c93dae186bb23e7fc052b6cbc4626c58bc0f60a5

SHA256
c4c2bb97d9abf6e224897855a0f6699d8f886ca816811ea5bfeb8e71d72b7d4f

SHA512
9cd119d3f55a172036fd625738c3ebcd45b534255da36c208b594605eca32a58470ea4d0493026d160e062806d015cd878c44521e2450247eb5a8ae203a8fe6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\x86\SQLite.Interop.dll

Filesize
792KB

MD5
9b19dcee960dc215e64b1d82348707a9

SHA1
9c1e0f76673eb385787120e17404df179316ca2b

SHA256
3515f704b0012c01fc8be5b717905c0587b29255fc9eb7ad3f2b66a130691d38

SHA512
cc1304ab171feb2ac6df941f4b35aab8ce7b503f96b5539b366b39268cce8b21ea2fdbce16eff809a9a121a60a65ebbd0f59f75360800f541b9e5f93e729a55d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFCEC8CA076E2F2E7D.TMP

Filesize
16KB

MD5
d2a1167636cc6dce9180690f39028334

SHA1
287512312b2bae5b8625a0e1c42ccf756f37f736

SHA256
54ddfbf6daec64a21f8396939dc9e77c0aab3ca08386caf6fcf435c3622a509f

SHA512
72bee052ffce8d28664454cab45f21fee73bd1770b7d1f15fcc1b5d7c08a3d7319cc33a6f9174db124294debc6beb4464d98b8ba782e4103f3fbd34f20184865

Download Submit
C:\Users\Admin\Downloads\Nanocore-Rat-master.zip

Filesize
6.2MB

MD5
288a61c6a24a15c0c95639add8cdf4c7

SHA1
1d64ace6afd5d73d7c0a54c8744ca56a4b3dd8e2

SHA256
4a24bcbccffb74be94f8fc5802bd5ce23afd8ad8dbfa1c200c829ec982707435

SHA512
16f28206cc7719e96bff08d5d844c3810080d9cbb96159013aeda5690777302fb3e46bfb39bf23751f6132a1ad1a811249dd53c137a132ac447a32178471aecb

Download Submit
C:\Users\Admin\Downloads\virus.exe

Filesize
130KB

MD5
e6efbcee022f15c6fc3a03a6c2d29d02

SHA1
3fd1856e0281faceefa6e6adc189ba36eef4a48f

SHA256
e0868087364d796382ae395fb6c77501d58bf557ce07087be2b1ae2a8e4b0a56

SHA512
e6a5261cd1cc6f9acb0d9a0e2ea19dd2c6788f996d1d955f040b2753f602083aa817517a2191bdb7cc51287cb5236c4cecdf4c15b0ac87ad41ad37cb8183f849

Download Submit
memory/600-1984-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/600-1985-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/600-1988-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/600-1987-0x0000000000420000-0x00000000004E9000-memory.dmp

Filesize
804KB

Download
memory/956-2028-0x000001BD682F0000-0x000001BD682F1000-memory.dmp

Filesize
4KB

Download
memory/956-2018-0x000001BD682F0000-0x000001BD682F1000-memory.dmp

Filesize
4KB

Download
memory/956-2017-0x000001BD682F0000-0x000001BD682F1000-memory.dmp

Filesize
4KB

Download
memory/956-2016-0x000001BD682F0000-0x000001BD682F1000-memory.dmp

Filesize
4KB

Download
memory/956-2027-0x000001BD682F0000-0x000001BD682F1000-memory.dmp

Filesize
4KB

Download
memory/956-2026-0x000001BD682F0000-0x000001BD682F1000-memory.dmp

Filesize
4KB

Download
memory/956-2025-0x000001BD682F0000-0x000001BD682F1000-memory.dmp

Filesize
4KB

Download
memory/956-2024-0x000001BD682F0000-0x000001BD682F1000-memory.dmp

Filesize
4KB

Download
memory/956-2023-0x000001BD682F0000-0x000001BD682F1000-memory.dmp

Filesize
4KB

Download
memory/956-2022-0x000001BD682F0000-0x000001BD682F1000-memory.dmp

Filesize
4KB

Download
memory/1324-1996-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1324-1990-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1324-1989-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download