File name:

NanoCore 1.2.2.0_Cracked By Alcatraz3223.rar

Full analysis: https://app.any.run/tasks/b96e1300-8d71-490b-9e94-a791319dce8a
Verdict: Malicious activity
Threats:

NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website.

Malware Trends Tracker     >>>
Analysis date: July 12, 2020, 16:15:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
nanocore
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

6C9A8AA7152F4E9389BB06965F36CC1A

SHA1:

E2CEC42394D6116BD594A4E914CC74B8F9B2E5DB

SHA256:

40E8540C8A72AB19A9B1696FB6B72B0680D0BD9DAF2AB53CD1C049855D4EAA07

SSDEEP:

98304:owCXrrbodpPWEtoftDDjWYcLRfRASQiwMmO93R/BqYhwGyer0UTl4pRR:FOHmRWqacL3lQa9hZ3hw04Eat

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • NanoCore.exe (PID: 3012)
      • fgfgtyf.exe (PID: 2768)
      • fgfgtyf.exe (PID: 3856)

    • Loads dropped or rewritten executable

      • NanoCore.exe (PID: 3012)
      • fgfgtyf.exe (PID: 2768)

    • Starts Visual C# compiler

      • sdiagnhost.exe (PID: 2760)

    • NANOCORE was detected

      • fgfgtyf.exe (PID: 2768)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1840)
      • msdt.exe (PID: 1464)
      • NanoCore.exe (PID: 3012)

    • Creates files in the user directory

      • NanoCore.exe (PID: 3012)
      • fgfgtyf.exe (PID: 2768)

    • Application launched itself

      • taskmgr.exe (PID: 1640)

    • Executed via COM

      • sdiagnhost.exe (PID: 2760)

    • Uses IPCONFIG.EXE to discover IP address

      • sdiagnhost.exe (PID: 2760)

  • INFO

    • Manual execution by user

      • NanoCore.exe (PID: 3012)
      • taskmgr.exe (PID: 1640)
      • q.exe (PID: 692)
      • opera.exe (PID: 332)
      • msdt.exe (PID: 1464)
      • fgfgtyf.exe (PID: 2768)
      • fgfgtyf.exe (PID: 3856)

    • Creates files in the user directory

      • opera.exe (PID: 332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 3135
UncompressedSize: 22746
OperatingSystem: Win32
ModifyDate: 2016:06:05 21:53:28
PackingMethod: Normal
ArchivedFileName: NanoCore 1.2.2.0_Cracked By Alcatraz3223\NanoCore 1.2.2.0_Cracked By Alcatraz3222\builder.log
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
15
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe nanocore.exe taskmgr.exe no specs taskmgr.exe q.exe no specs opera.exe msdt.exe sdiagnhost.exe no specs csc.exe cvtres.exe no specs ipconfig.exe no specs route.exe no specs makecab.exe no specs #NANOCORE fgfgtyf.exe fgfgtyf.exe

Process information

PID
CMD
Path
Indicators
Parent process
332"C:\Program Files\Opera\opera.exe" C:\Program Files\Opera\opera.exe
explorer.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Internet Browser
Exit code:
0
Version:
1748
Modules
Images
c:\windows\system32\advapi32.dll
c:\windows\system32\cryptbase.dll
c:\program files\q\q.exe
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msctf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\conhost.exe
692"C:\Program Files\q\q.exe" C:\Program Files\q\q.exe—explorer.exe
User:
admin
Company:
http://www.qemu-project.org
Integrity Level:
MEDIUM
Description:
QEMU machine emulators and tools
Exit code:
1
Version:
2.10.65
Modules
Images
c:\program files\q\q.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\q\libglib-2.0-0.dll
c:\program files\q\libpcre-1.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1464"C:\Windows\System32\msdt.exe" -skip TRUE -path C:\Windows\diagnostics\system\networking -ep NetworkDiagnosticsPNIC:\Windows\System32\msdt.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Diagnostics Troubleshooting Wizard
Exit code:
4294967295
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msdt.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1640"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1780"C:\Windows\system32\taskmgr.exe" /1C:\Windows\system32\taskmgr.exe
taskmgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1840"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\NanoCore 1.2.2.0_Cracked By Alcatraz3223.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2220"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\lj-0dh25.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.4927 (NetFXspW7.050727-4900)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2608"C:\Windows\system32\ROUTE.EXE" printC:\Windows\system32\ROUTE.EXE—sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Route Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\route.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
2720C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESA193.tmp" "c:\Users\admin\AppData\Local\Temp\CSCA192.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.4940 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
2760C:\Windows\System32\sdiagnhost.exe -EmbeddingC:\Windows\System32\sdiagnhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Scripted Diagnostics Native Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sdiagnhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
Total events
1 549
Read events
1 325
Write events
221
Delete events
3

Modification events

(PID) Process:(1840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1840) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1840) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(1840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\NanoCore 1.2.2.0_Cracked By Alcatraz3223.rar
(PID) Process:(1840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
Executable files
10
Suspicious files
60
Text files
350
Unknown types
21

Dropped files

PID
Process
Filename
Type
1840WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1840.40100\NanoCore 1.2.2.0_Cracked By Alcatraz3223\NanoCore 1.2.2.0_Cracked By Alcatraz3222\PluginCompiler.exeexecutable
MD5:E2D1C5DF11F9573F6C5D0A7AD1A79FBF
SHA256:0B41B2FCD0F1A4E913D3EFE293F713849D59EFEBB27BAC060AB31BED51AC2F6B
1840WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1840.40100\NanoCore 1.2.2.0_Cracked By Alcatraz3223\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\ManagementPlugin.ncpbinary
MD5:B612C2C9A6D361A5DB14C04BA126119C
SHA256:B86FE4E126A9748A383A34D615B9598C715F2380C0AAD957495C66923902026C
1840WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1840.40100\NanoCore 1.2.2.0_Cracked By Alcatraz3223\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\core.sqlitesqlite
MD5:3732DF3263FBAA868BB866BCCA1F402C
SHA256:716D9992711B5B17ECA841836BA5A63DB0A62251BD056A92DB96DECCFA887B41
1840WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1840.40100\NanoCore 1.2.2.0_Cracked By Alcatraz3223\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\network.sqlitesqlite
MD5:856342A3A887715F53CD7277A2B220AF
SHA256:DE1CC5F927BDC0ACE22CF11BEBE0B83977B16338A97724E2489302A0FCDA0173
1840WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1840.40100\NanoCore 1.2.2.0_Cracked By Alcatraz3223\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\main.sqlitesqlite
MD5:EA522FC387E8E1C1C65E946C9118E2C7
SHA256:AE429DBFCA9416CFC6832AED1190FA7B9EB90127328136A249DE024349FD3B3B
1840WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1840.40100\NanoCore 1.2.2.0_Cracked By Alcatraz3223\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Databases\geolocation.sqlitesqlite
MD5:0E8D861CDDEDE3A0B2B02CFC0B060B99
SHA256:11BD851D8994D3CA9D078144679AA2DC06841ADDD0947B8FA8AD36758BDECF7A
1840WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1840.40100\NanoCore 1.2.2.0_Cracked By Alcatraz3223\NanoCore 1.2.2.0_Cracked By Alcatraz3222\ClientPlugin.dllexecutable
MD5:BDC8945F1D799C845408522E372D1DBD
SHA256:61E9D5C0727665E9EF3F328141397BE47C65ED11AB621C644B5BBF1D67138403
1840WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1840.40100\NanoCore 1.2.2.0_Cracked By Alcatraz3223\NanoCore 1.2.2.0_Cracked By Alcatraz3222\client.binexecutable
MD5:906A949E34472F99BA683EFF21907231
SHA256:9D3EA5AF7DC261BF93C76F55D702A315AA22FB241E4207DC86CD834C262245C8
1840WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1840.40100\NanoCore 1.2.2.0_Cracked By Alcatraz3223\NanoCore 1.2.2.0_Cracked By Alcatraz3222\ClientPlugin.xmlxml
MD5:5D0381A56563B1CA8928E3CF087F1625
SHA256:0497B92461C2A9CE3101D9397FB3079F60979164336A16653D282273D3085BCC
1840WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1840.40100\NanoCore 1.2.2.0_Cracked By Alcatraz3223\NanoCore 1.2.2.0_Cracked By Alcatraz3222\Plugins\DucPlugin.ncpbinary
MD5:5ECA68A8368E0E144B7016E30B85515C
SHA256:E2CE89B3E68B003CB27E2C5652CCBA073C8938BEF194E51830539B2464A3F676
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
10
DNS requests
9
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3012
NanoCore.exe
GET
200
104.197.246.62:80
http://lazyshare.net/PluginStats/Functions/getPluginName.php?PluginID=FAD00979338
US
—
—
unknown
3012
NanoCore.exe
POST
200
104.197.246.62:80
http://lazyshare.net/PluginStats/Functions/checkInstall.php
US
—
—
unknown
3012
NanoCore.exe
POST
200
104.197.246.62:80
http://lazyshare.net/PluginStats/Functions/newLog.php
US
—
—
unknown
3012
NanoCore.exe
GET
200
95.211.117.215:80
http://survey-smiles.com/
NL
html
473 b
whitelisted
332
opera.exe
GET
200
93.184.220.29:80
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl
US
der
564 b
whitelisted
3012
NanoCore.exe
POST
302
212.32.237.91:80
http://nimoru.com/nano/submitFeedback.php
NL
text
11 b
malicious
3012
NanoCore.exe
GET
302
95.211.117.215:80
http://survey-smiles.com/
NL
text
11 b
whitelisted
832
svchost.exe
GET
200
2.21.38.54:80
http://www.microsoft.com/
FR
html
1020 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3012
NanoCore.exe
104.197.246.62:80
lazyshare.net
Google Inc.
US
unknown
3012
NanoCore.exe
212.32.237.91:80
nimoru.com
LeaseWeb Netherlands B.V.
NL
malicious
3012
NanoCore.exe
95.211.117.215:80
survey-smiles.com
LeaseWeb Netherlands B.V.
NL
malicious
332
opera.exe
185.26.182.93:443
certs.opera.com
Opera Software AS
—
whitelisted
332
opera.exe
93.184.220.29:80
crl4.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
832
svchost.exe
2.21.38.54:80
www.microsoft.com
GTT Communications Inc.
FR
malicious

DNS requests

Domain
IP
Reputation
lazyshare.net
  • 104.197.246.62
unknown
nimoru.com
  • 212.32.237.91
malicious
survey-smiles.com
  • 95.211.117.215
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
certs.opera.com
  • 185.26.182.93
  • 185.26.182.94
whitelisted
crl4.digicert.com
  • 93.184.220.29
whitelisted
www.microsoft.com
  • 2.21.38.54
whitelisted
nnnmn
  • —
unknown

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
Process
Message
NanoCore.exe
Trying to load native SQLite library "C:\Users\admin\Desktop\NanoCore 1.2.2.0_Cracked By Alcatraz3223\NanoCore 1.2.2.0_Cracked By Alcatraz3222\x86\SQLite.Interop.dll"...
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NanoCore 1.2.2.0_Cracked By Alcatraz3223.rar