24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ce,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.NanoCore Sample c6ad18d01c5e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c6ad18d01c5e…. Malware family: Trojan.NanoCore. Threat score 100/100. 22/27 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c6ad18d01c5ee9f6edbb8c79f8ff8786762eb63d1b341997eb39f51a67f4ae7b","keywords":["Malicious","Trojan.NanoCore","malware analysis","sandbox report","threat intelligence","c6ad18d01c5ee9f6edbb8c79f8ff8786762eb63d1b341997eb39f51a67f4ae7b"],"about":{"@type":"SoftwareApplication","name":"c6ad18d01c5ee9f6edbb8c79f8ff8786762eb63d1b341997eb39f51a67f4ae7b.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"c6ad18d01c5ee9f6edbb8c79f8ff8786762eb63d1b341997eb39f51a67f4ae7b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.NanoCore","antivirusDetections":{"malicious":22,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4ba,Found reference to "DESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "c6ad18d01c5ee9f6edbb8c79f8ff8786762eb63d1b341997eb39f51a67f4ae7b.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "c6ad18d01c5ee9f6edbb8c79f8ff8786762eb63d1b341997eb39f51a67f4ae7b.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "c6ad18d01c5ee9f6edbb8c79f8ff8786762eb63d1b341997eb39f51a67f4ae7b.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "c6ad18d01c5ee9f6edbb8c79f8ff8786762eb63d1b341997eb39f51a67f4ae7b.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "c6ad18d01c5ee9f6edbb8c79f8ff8786762eb63d1b341997eb39f51a67f4ae7b.bin") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "c6ad18d01c5ee9f6edbb8c79f8ff8786762eb63d1b341997eb39f51a67f4ae7b.bin") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "c6ad18d01c5ee9f6edbb8c79f8ff8786762eb63d1b341997eb39f51a67f4ae7b.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "c6ad18d01c5ee9f6edbb8c79f8ff8786762eb63d1b341997eb39f51a67f4ae7b.bin")26:T511," HTTP/2 200 OK Content-Type: image/png Date: Tue 07 Jul 2026 02:48:44 GMT Server: cloudflare X-Li-Fabric: prod-ltx1 Cf-Ray: a173882c290db873-SJC Vary: Accept-Encoding X-Li-Proto: http/2 Content-Encoding: gzip Cf-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=31536000 Set-Cookie: __cf_bm=OrZ8NwZ9tSRimYmA8BTBNzeMZkjVVQpo5wRfAdhA8VE-1783392524.1857574-1.0.1.1-9ueV.z1zTcxyfTKg1s_I9Q7vxDcY9op0cr.Poo0kl_3gR9Fc4VeLN7SAa7vY1i1nm2HA01aBb7kc7YI9vjEGHgURD0g2T9zWkI3vW_FulFQT0.JkGrU2dQZ5ptTUQwEi; HttpOnly; SameSite=None; Secure; Path=/; Domain=linkedin.com; Expires=Tue 07 Jul 2026 03:18:44 GMT X-Li-Uuid: AAZV/G3moM68HQVASprCJw== Nel: {"report_to":"network-errors" "max_age":1296000 "success_fraction":0.00066 "failure_fraction":1 "include_subdomains":true} X-Content-Type-Options: nosniff X-Li-Pop: cf-prod-ltx1-x Report-To: {"group":"network-errors" "max_age":2592000 "endpoints":[{"url":"https://www.linkedin.com/li/rep"}] "include_subdomains":true} Alt-Svc: h3=":443"; ma=86400 Linkedin-Action: 1 with response body ==>BINARY_CONTENT....... "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Date: Tue 07 Jul 2026 02:48:44 GMT Server: nginx X-Service-Version: v1 X-Served-By: cache-lax-kwhp1940042-LAX P3p: policyref="http://trc.taboola.com/p3p.xml" CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Pragma: no-cache X-Cache-Hits: 0 Via: 1.1 varnish Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Fastly-To-Nlb-Rtt: 43527 X-Timer: S1783392524.412361 VS0 VE46 X-Cache: MISS X-Vcl-Time-Ms: 46 Cache-Control: no-cache no-store Accept-Ranges: bytes with no response body "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 307 Temporary Redirect Content-Type: text/html; charset=utf-8 Date: Tue 07 Jul 2026 02:48:44 GMT Server: nginx/1.25.5 Set-Cookie: uuid2=7875475363421749623; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon 05-Oct-2026 02:48:44 GMT; Domain=.adnxs.com; Secure; HttpOnly Expires: Sat 15 Nov 2008 16:00:00 GMT X-Xss-Protection: 0 An-X-Request-Uuid: 727ab553-43ca-4895-86bd-9b679b2c9481 X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 900.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; *.adnxs.com Location: https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D Cache-Control: no-store no-cache private P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness with no response body "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2 Host: edgeassetservice.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/octet-stream Date: Tue 07 Jul 2026 02:48:50 GMT Last-Modified: Wed 08 Apr 2026 16:21:07 GMT X-Azure-Ref: 20260707T024850Z-176bd758b7bq2fmvhC1IADdrc800000012f0000000003vtc X-Ms-Version: 2009-09-19 X-Ms-Lease-Status: unlocked X-Fd-Int-Roxy-Purgeid: 0 Vary: Accept-Encoding Content-Encoding: br X-Cache: TCP_HIT Cache-Control: public max-age=604800 X-Ms-Request-Id: 798e159b-601e-0028-491d-08ab69000000 X-Ms-Blob-Type: BlockBlob with no response body "GET /mouse-gesture/config.json HTTP/2 Host: edge-consumer-static.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json Date: Tue 07 Jul 2026 02:49:04 GMT X-Azure-Ref: 20260707T024904Z-15ccf768744mcl7jhC1IADw4m40000000h80000000007q1t X-Ms-Version: 2009-09-19 X-Ms-Lease-Status: unlocked X-Ms-Blob-Type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id Server x-ms-version Content-Type ETag Last-Modified x-ms-lease-status x-ms-blob-type Content-Length Date Transfer-Encoding Access-Control-Allow-Origin: * Last-Modified: Tue 24 Oct 2023 08:27:00 GMT X-Fd-Int-Roxy-Purgeid: 83583309 Etag: 0x8DBD46AFE482320 X-Cache: TCP_HIT Cache-Control: public max-age=432000 Accept-Ranges: bytes X-Ms-Request-Id: 0d8905c2-a01e-0076-0db4-09383f000000 with no response body "GET /crx/blobs/AcPRoer2Zc8Cgsxh3W97Ool_-PGKhLaIiI3sel8eaYNhRISQxgF7RAU9V6yJvXw1e7sYHW2j6vqLEhEQKXjZoaglbnja3Q65AdkDVIKRv7wFMJgAqud8KltAaV-Hxvg30NwAxlKa5QTua4OZ5Ic-CUkgokgc_Nvmf1Of/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_107_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-Os: Windows Priority: u=4, i Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Accept-Encoding: gzip, deflate, br, zstd Sec-Mesh-Client-Os-Version: 10.0.16299 Sec-Mesh-Client-Webview: 0 Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-chrome-extension X-Guploader-Uploadid: AJ5rDhHg67EXtNoWPRGBkiXIlIX7kAdLLhT66tPbQhKwHKzZQEB_LOl9z0Lq13evVHZwe58 Date: Mon 06 Jul 2026 15:32:46 GMT Server: UploadServer Last-Modified: Thu 11 Jun 2026 18:34:52 GMT Expires: Tue 06 Jul 2027 15:32:46 GMT Etag: 0613766b_b05dde31_e4e6f0e1_316fbea1_6bb6e3e5 Accept-Ranges: bytes Cache-Control: public max-age=31536000 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 40579 X-Goog-Hash: crc32c=oht2/g== with response body ==>BINARY_CONTENT.......32:T16d0," \"{\"hash\":\"iN16VwTHejA7ej6Aa0v8rdlhV/A/Nij0jz//TDg6MBs=\",\"ids\":[\"ghbmnnjooekpmoecnnnilnnbdlolhkhi\"],\"protocol_version\":1}\" HTTP/2 200 OK\nContent-Type: application/json; charset=UTF-8\nDate: Tue\n 07 Jul 2026 02:48:50 GMT\nServer: ESF\nX-Xss-Protection: 0\nX-Content-Type-Options: nosniff\nVary: Referer\nContent-Encoding: gzip\nX-Frame-Options: SAMEORIGIN\nAlt-Svc: h3=\":443\"; ma=2592000\nh3-29=\":443\"; ma=2592000 with response body ==>BINARY_CONTENT.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a4c687768b661180c0981cd"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6a4c687768b661180c0981cd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"