Overview
overview
10Static
static
10NanoCore-m...in.dll
windows7-x64
1NanoCore-m...in.dll
windows10-2004-x64
1NanoCore-m...ib.dll
windows7-x64
1NanoCore-m...ib.dll
windows10-2004-x64
1NanoCore-m...er.exe
windows7-x64
1NanoCore-m...er.exe
windows10-2004-x64
1NanoCore-m...re.exe
windows7-x64
10NanoCore-m...re.exe
windows10-2004-x64
10NanoCore-m...in.dll
windows7-x64
1NanoCore-m...in.dll
windows10-2004-x64
1NanoCore-m...te.dll
windows7-x64
1NanoCore-m...te.dll
windows10-2004-x64
1NanoCore-m...nt.exe
windows7-x64
3NanoCore-m...nt.exe
windows10-2004-x64
7NanoCore-m...op.dll
windows7-x64
1NanoCore-m...op.dll
windows10-2004-x64
1NanoCore-m...op.dll
windows7-x64
3NanoCore-m...op.dll
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
06/02/2025, 08:06
Behavioral task
behavioral1
Sample
NanoCore-master/sample/ClientPlugin.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
NanoCore-master/sample/ClientPlugin.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
NanoCore-master/sample/Interop.NATUPNPLib.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
NanoCore-master/sample/Interop.NATUPNPLib.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
NanoCore-master/sample/NanoCore Plugin Compiler.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
NanoCore-master/sample/NanoCore Plugin Compiler.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral7
Sample
NanoCore-master/sample/NanoCore.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
NanoCore-master/sample/NanoCore.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral9
Sample
NanoCore-master/sample/ServerPlugin.dll
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
NanoCore-master/sample/ServerPlugin.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral11
Sample
NanoCore-master/sample/System.Data.SQLite.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
NanoCore-master/sample/System.Data.SQLite.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
NanoCore-master/sample/client.exe
Resource
win7-20241023-en
Behavioral task
behavioral14
Sample
NanoCore-master/sample/client.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral15
Sample
NanoCore-master/sample/x64/SQLite.Interop.dll
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
NanoCore-master/sample/x64/SQLite.Interop.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral17
Sample
NanoCore-master/sample/x86/SQLite.Interop.dll
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
NanoCore-master/sample/x86/SQLite.Interop.dll
Resource
win10v2004-20250129-en
General
-
Target
NanoCore-master/sample/client.exe
-
Size
87KB
-
MD5
e7dde6ff81df20066d7c57bb32d45193
-
SHA1
f4494f962a6241715f1d313fee37203b6607e42b
-
SHA256
f63d7fecabfd501643a12ff3988f2809a1573009a452510e286a91554d49599d
-
SHA512
da3ec487122b70a062dd7ffc792fc4d7cb223775a7e09ca9664bc259097d53ad93678cfeec32d554783f37f9d23a299a0e75ee7e9951abf9d4da8d55e58eb527
-
SSDEEP
1536:EtPtlChZHNnK1MJTmvuzazpZl4hTPnmOIP+LNPSP2avOauA:Edtl8NnwMJTm/9kTPnmOg+LNQ2aJuA
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2416 client.exe Token: SeDebugPrivilege 1936 client.exe Token: SeDebugPrivilege 2368 client.exe Token: SeDebugPrivilege 824 client.exe Token: SeDebugPrivilege 2972 client.exe Token: SeDebugPrivilege 3044 client.exe Token: SeDebugPrivilege 2896 client.exe Token: SeDebugPrivilege 2752 client.exe Token: SeDebugPrivilege 876 client.exe Token: SeDebugPrivilege 2308 client.exe Token: SeDebugPrivilege 2604 client.exe Token: SeDebugPrivilege 2000 client.exe Token: SeDebugPrivilege 1140 client.exe Token: SeDebugPrivilege 3020 client.exe Token: SeDebugPrivilege 1932 client.exe Token: SeDebugPrivilege 2904 client.exe Token: SeDebugPrivilege 2156 client.exe Token: SeDebugPrivilege 2172 client.exe Token: SeDebugPrivilege 2248 client.exe Token: SeDebugPrivilege 704 client.exe Token: SeDebugPrivilege 684 client.exe Token: SeDebugPrivilege 1744 client.exe Token: SeDebugPrivilege 1464 client.exe Token: SeDebugPrivilege 804 client.exe Token: SeDebugPrivilege 572 client.exe Token: SeDebugPrivilege 2116 client.exe Token: SeDebugPrivilege 2324 client.exe Token: SeDebugPrivilege 1436 client.exe Token: SeDebugPrivilege 1504 client.exe Token: SeDebugPrivilege 280 client.exe Token: SeDebugPrivilege 2836 client.exe Token: SeDebugPrivilege 2372 client.exe Token: SeDebugPrivilege 2824 client.exe Token: SeDebugPrivilege 2952 client.exe Token: SeDebugPrivilege 3048 client.exe Token: SeDebugPrivilege 2736 client.exe Token: SeDebugPrivilege 2596 client.exe Token: SeDebugPrivilege 1968 client.exe Token: SeDebugPrivilege 1232 client.exe Token: SeDebugPrivilege 2520 client.exe Token: SeDebugPrivilege 2892 client.exe Token: SeDebugPrivilege 2920 client.exe Token: SeDebugPrivilege 1244 client.exe Token: SeDebugPrivilege 2244 client.exe Token: SeDebugPrivilege 2164 client.exe Token: SeDebugPrivilege 2632 client.exe Token: SeDebugPrivilege 1432 client.exe Token: SeDebugPrivilege 788 client.exe Token: SeDebugPrivilege 1944 client.exe Token: SeDebugPrivilege 1736 client.exe Token: SeDebugPrivilege 1808 client.exe Token: SeDebugPrivilege 968 client.exe Token: SeDebugPrivilege 2500 client.exe Token: SeDebugPrivilege 2096 client.exe Token: SeDebugPrivilege 2504 client.exe Token: SeDebugPrivilege 904 client.exe Token: SeDebugPrivilege 2564 client.exe Token: SeDebugPrivilege 2592 client.exe Token: SeDebugPrivilege 2412 client.exe Token: SeDebugPrivilege 2624 client.exe Token: SeDebugPrivilege 2968 client.exe Token: SeDebugPrivilege 1632 client.exe Token: SeDebugPrivilege 2852 client.exe Token: SeDebugPrivilege 2784 client.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 1936 2416 client.exe 30 PID 2416 wrote to memory of 1936 2416 client.exe 30 PID 2416 wrote to memory of 1936 2416 client.exe 30 PID 1936 wrote to memory of 2368 1936 client.exe 31 PID 1936 wrote to memory of 2368 1936 client.exe 31 PID 1936 wrote to memory of 2368 1936 client.exe 31 PID 2368 wrote to memory of 824 2368 client.exe 32 PID 2368 wrote to memory of 824 2368 client.exe 32 PID 2368 wrote to memory of 824 2368 client.exe 32 PID 824 wrote to memory of 2972 824 client.exe 33 PID 824 wrote to memory of 2972 824 client.exe 33 PID 824 wrote to memory of 2972 824 client.exe 33 PID 2972 wrote to memory of 3044 2972 client.exe 34 PID 2972 wrote to memory of 3044 2972 client.exe 34 PID 2972 wrote to memory of 3044 2972 client.exe 34 PID 3044 wrote to memory of 2896 3044 client.exe 35 PID 3044 wrote to memory of 2896 3044 client.exe 35 PID 3044 wrote to memory of 2896 3044 client.exe 35 PID 2896 wrote to memory of 2752 2896 client.exe 36 PID 2896 wrote to memory of 2752 2896 client.exe 36 PID 2896 wrote to memory of 2752 2896 client.exe 36 PID 2752 wrote to memory of 876 2752 client.exe 37 PID 2752 wrote to memory of 876 2752 client.exe 37 PID 2752 wrote to memory of 876 2752 client.exe 37 PID 876 wrote to memory of 2308 876 client.exe 38 PID 876 wrote to memory of 2308 876 client.exe 38 PID 876 wrote to memory of 2308 876 client.exe 38 PID 2308 wrote to memory of 2604 2308 client.exe 39 PID 2308 wrote to memory of 2604 2308 client.exe 39 PID 2308 wrote to memory of 2604 2308 client.exe 39 PID 2604 wrote to memory of 2000 2604 client.exe 40 PID 2604 wrote to memory of 2000 2604 client.exe 40 PID 2604 wrote to memory of 2000 2604 client.exe 40 PID 2000 wrote to memory of 1140 2000 client.exe 41 PID 2000 wrote to memory of 1140 2000 client.exe 41 PID 2000 wrote to memory of 1140 2000 client.exe 41 PID 1140 wrote to memory of 3020 1140 client.exe 42 PID 1140 wrote to memory of 3020 1140 client.exe 42 PID 1140 wrote to memory of 3020 1140 client.exe 42 PID 3020 wrote to memory of 1932 3020 client.exe 43 PID 3020 wrote to memory of 1932 3020 client.exe 43 PID 3020 wrote to memory of 1932 3020 client.exe 43 PID 1932 wrote to memory of 2904 1932 client.exe 44 PID 1932 wrote to memory of 2904 1932 client.exe 44 PID 1932 wrote to memory of 2904 1932 client.exe 44 PID 2904 wrote to memory of 2156 2904 client.exe 45 PID 2904 wrote to memory of 2156 2904 client.exe 45 PID 2904 wrote to memory of 2156 2904 client.exe 45 PID 2156 wrote to memory of 2172 2156 client.exe 46 PID 2156 wrote to memory of 2172 2156 client.exe 46 PID 2156 wrote to memory of 2172 2156 client.exe 46 PID 2172 wrote to memory of 2248 2172 client.exe 47 PID 2172 wrote to memory of 2248 2172 client.exe 47 PID 2172 wrote to memory of 2248 2172 client.exe 47 PID 2248 wrote to memory of 704 2248 client.exe 48 PID 2248 wrote to memory of 704 2248 client.exe 48 PID 2248 wrote to memory of 704 2248 client.exe 48 PID 704 wrote to memory of 684 704 client.exe 49 PID 704 wrote to memory of 684 704 client.exe 49 PID 704 wrote to memory of 684 704 client.exe 49 PID 684 wrote to memory of 1744 684 client.exe 50 PID 684 wrote to memory of 1744 684 client.exe 50 PID 684 wrote to memory of 1744 684 client.exe 50 PID 1744 wrote to memory of 1464 1744 client.exe 51
Processes
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"7⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"8⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"10⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"11⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"13⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"14⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"15⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"16⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"23⤵
- Suspicious use of AdjustPrivilegeToken
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"24⤵
- Suspicious use of AdjustPrivilegeToken
PID:804 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"25⤵
- Suspicious use of AdjustPrivilegeToken
PID:572 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"26⤵
- Suspicious use of AdjustPrivilegeToken
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"27⤵
- Suspicious use of AdjustPrivilegeToken
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"28⤵
- Suspicious use of AdjustPrivilegeToken
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"29⤵
- Suspicious use of AdjustPrivilegeToken
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"30⤵
- Suspicious use of AdjustPrivilegeToken
PID:280 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"31⤵
- Suspicious use of AdjustPrivilegeToken
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"32⤵
- Suspicious use of AdjustPrivilegeToken
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"33⤵
- Suspicious use of AdjustPrivilegeToken
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"34⤵
- Suspicious use of AdjustPrivilegeToken
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"35⤵
- Suspicious use of AdjustPrivilegeToken
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"36⤵
- Suspicious use of AdjustPrivilegeToken
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"37⤵
- Suspicious use of AdjustPrivilegeToken
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"38⤵
- Suspicious use of AdjustPrivilegeToken
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"39⤵
- Suspicious use of AdjustPrivilegeToken
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"40⤵
- Suspicious use of AdjustPrivilegeToken
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"42⤵
- Suspicious use of AdjustPrivilegeToken
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"43⤵
- Suspicious use of AdjustPrivilegeToken
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"44⤵
- Suspicious use of AdjustPrivilegeToken
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"45⤵
- Suspicious use of AdjustPrivilegeToken
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"46⤵
- Suspicious use of AdjustPrivilegeToken
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"47⤵
- Suspicious use of AdjustPrivilegeToken
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"48⤵
- Suspicious use of AdjustPrivilegeToken
PID:788 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"49⤵
- Suspicious use of AdjustPrivilegeToken
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"50⤵
- Suspicious use of AdjustPrivilegeToken
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"51⤵
- Suspicious use of AdjustPrivilegeToken
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"52⤵
- Suspicious use of AdjustPrivilegeToken
PID:968 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"53⤵
- Suspicious use of AdjustPrivilegeToken
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"54⤵
- Suspicious use of AdjustPrivilegeToken
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"55⤵
- Suspicious use of AdjustPrivilegeToken
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"56⤵
- Suspicious use of AdjustPrivilegeToken
PID:904 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"57⤵
- Suspicious use of AdjustPrivilegeToken
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"58⤵
- Suspicious use of AdjustPrivilegeToken
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"59⤵
- Suspicious use of AdjustPrivilegeToken
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"60⤵
- Suspicious use of AdjustPrivilegeToken
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"61⤵
- Suspicious use of AdjustPrivilegeToken
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"62⤵
- Suspicious use of AdjustPrivilegeToken
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"63⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"64⤵
- Suspicious use of AdjustPrivilegeToken
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"65⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"66⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"67⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"68⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"69⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"70⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"71⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"72⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"73⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"74⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"75⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"76⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"77⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"78⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"79⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"80⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"81⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"82⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"83⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"84⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"85⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"86⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"87⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"88⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"89⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"90⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"91⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"92⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"93⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"94⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"95⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"96⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"97⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"98⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"99⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"100⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"101⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"102⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"103⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"104⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"105⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"106⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"107⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"108⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"109⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"110⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"111⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"112⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"113⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"114⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"115⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"116⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"117⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"118⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"119⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"120⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"121⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\client.exe"122⤵PID:1036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-