Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
11/10/2024, 15:49
Static task
static1
Behavioral task
behavioral1
Sample
code.vbs
Resource
win7-20241010-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
code.vbs
Resource
win10v2004-20241007-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target code.vbs
- Size 1KB
- Sample241011-s9dqvsvfpp
- SHA256 a7e0361d293c68159a7d48b5cfeef5804ba938df7e6e0dfbb1e6ca200bcfd037
- MD5 f005bdca84c5bb5ec73a58ffae84a477
- SHA1 87ab175ea3905dfd6b857ae2e95c8c7dbcf41813
- SHA512 0bca32222e61bc0cb8807c30abbcb06c5aaa7de9407b50ceebc089c622188997650ab1d00497ff888c77b71f6ee8b5f3acf3e107756b6692692396fd081f8bf6
- MD5 SHA1 SHA512
Malware Config
Signatures
- Renames multiple (24552) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 64 IoCs
description ioc Process File created C:\Windows\System32\drivers\es-ES\vhdmp.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\fr-FR\srv2.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\UMDF\de-DE\WUDFUsbccidDriver.dll.mui.bat WScript.exe File created C:\Windows\System32\drivers\msiscsi.sys.bat WScript.exe File created C:\Windows\System32\drivers\xinputhid.sys.bat WScript.exe File created C:\Windows\System32\drivers\fr-FR\mouhid.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\ja-JP\iorate.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\serial.sys.bat WScript.exe File created C:\Windows\System32\drivers\en-US\sdbus.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\es-ES\mshidumdf.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\fr-FR\fltmgr.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\dfsc.sys.bat WScript.exe File created C:\Windows\System32\drivers\scfilter.sys.bat WScript.exe File created C:\Windows\System32\drivers\SgrmAgent.sys.bat WScript.exe File created C:\Windows\System32\drivers\it-IT\sdstor.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\mslldp.sys.bat WScript.exe File created C:\Windows\System32\drivers\de-DE\disk.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\en-US\mountmgr.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\vwififlt.sys.bat WScript.exe File created C:\Windows\System32\drivers\it-IT\usbstor.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\fr-FR\BTHUSB.SYS.mui.bat WScript.exe File created C:\Windows\System32\drivers\fr-FR\qwavedrv.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\it-IT\wacompen.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\UMDF\it-IT\SensorsCx.dll.mui.bat WScript.exe File created C:\Windows\System32\drivers\dxgmms2.sys.bat WScript.exe File created C:\Windows\System32\drivers\KNetPwrDepBroker.sys.bat WScript.exe File created C:\Windows\System32\drivers\de-DE\iorate.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\UMDF\ja-JP\idtsec.dll.mui.bat WScript.exe File created C:\Windows\System32\drivers\null.sys.bat WScript.exe File created C:\Windows\System32\drivers\de-DE\sermouse.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\fr-FR\rdbss.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\es-ES\tsusbhub.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\fr-FR\agilevpn.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\fr-FR\synth3dvsc.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\UMDF\RdpIdd.dll.bat WScript.exe File created C:\Windows\System32\drivers\mshidkmdf.sys.bat WScript.exe File created C:\Windows\System32\drivers\raspppoe.sys.bat WScript.exe File created C:\Windows\System32\drivers\en-US\scfilter.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\de-DE\sdbus.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\es-ES\wfplwfs.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\fr-FR\sdbus.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\cldflt.sys.bat WScript.exe File created C:\Windows\System32\drivers\usbd.sys.bat WScript.exe File created C:\Windows\System32\drivers\en-US\luafv.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\UMDF\de-DE\wpdmtpdr.dll.mui.bat WScript.exe File created C:\Windows\System32\drivers\UMDF\es-ES\SensorsCx.dll.mui.bat WScript.exe File created C:\Windows\System32\drivers\de-DE\sdstor.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\fr-FR\ndisuio.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\it-IT\fvevol.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\de-DE\rdbss.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\it-IT\wfplwfs.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\fr-FR\hidclass.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\ja-JP\IPMIDRV.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\exfat.sys.bat WScript.exe File created C:\Windows\System32\drivers\iaLPSS2i_GPIO2_CNL.sys.bat WScript.exe File created C:\Windows\System32\drivers\fr-FR\afd.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\BtaMPM.sys.bat WScript.exe File created C:\Windows\System32\drivers\ndisuio.sys.bat WScript.exe File created C:\Windows\System32\drivers\rfcomm.sys.bat WScript.exe File created C:\Windows\System32\drivers\smbdirect.sys.bat WScript.exe File created C:\Windows\System32\drivers\it-IT\mslldp.sys.mui.bat WScript.exe File created C:\Windows\System32\drivers\UMDF\es-ES\UsbccidDriver.dll.mui.bat WScript.exe File created C:\Windows\System32\drivers\HdAudio.sys.bat WScript.exe File created C:\Windows\System32\drivers\hwpolicy.sys.bat WScript.exe - Possible privilege escalation attempt 2 IoCs
pid Process 3244 takeown.exe 4412 icacls.exe - Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
description ioc Process File created C:\Windows\System32\spool\prtprocs\x64\winprint.dll.bat WScript.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation WScript.exe - Indicator Removal: Clear Windows Event Logs 1 TTPs 64 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
description ioc Process File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-VDRVROOT%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Steps-Recorder.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-Scheduled%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Audio%4PlaybackManager.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Audit.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Application.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-WinRM%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Audio%4CaptureMonitor.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Restricted.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Admin.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-UniversalTelemetryClient%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4FirewallDiagnostics.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Audio%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Security.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Internet Explorer.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-MUI%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Privacy-Auditing%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-WindowsBackup%4ActionCenter.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Audit.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Diagnostic.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-VHDMP-Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-PnP%4Driver Watchdog.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-Time-Service%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.bat WScript.exe File created C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx.bat WScript.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 3244 takeown.exe 4412 icacls.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\Dism\fr-FR\SmiProvider.dll.mui.bat WScript.exe File created C:\Windows\System32\en-US\dot3api.dll.mui.bat WScript.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-MFCore-WCOSHeadless-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat.bat WScript.exe File created C:\Windows\System32\BackgroundMediaPolicy.dll.bat WScript.exe File created C:\Windows\System32\KBDBE.DLL.bat WScript.exe File created C:\Windows\System32\de-DE\SCardSvr.dll.mui.bat WScript.exe File created C:\Windows\System32\DriverStore\de-DE\mbtr8897w81x64.inf_loc.bat WScript.exe File created C:\Windows\System32\es-ES\dot3cfg.dll.mui.bat WScript.exe File created C:\Windows\System32\MdRes.exe.bat WScript.exe File created C:\Windows\System32\Windows.Networking.Proximity.dll.bat WScript.exe File created C:\Windows\System32\DriverStore\ja-JP\netrtwlane.inf_loc.bat WScript.exe File created C:\Windows\System32\ja-jp\ngccredprov.dll.mui.bat WScript.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\Modules\NetLbfo\MSFT_NetLbfoTeam.format.ps1xml.bat WScript.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Http-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat.bat WScript.exe File created C:\Windows\System32\en-US\eapsvc.dll.mui.bat WScript.exe File created C:\Windows\System32\it-IT\shlwapi.dll.mui.bat WScript.exe File created C:\Windows\System32\ja-jp\vac.dll.mui.bat WScript.exe File created C:\Windows\System32\uk-UA\twext.dll.mui.bat WScript.exe File created C:\Windows\System32\it-IT\activeds.dll.mui.bat WScript.exe File created C:\Windows\System32\it-IT\VSSVC.exe.mui.bat WScript.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-HypervisorPlatform-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat.bat WScript.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ConfigCI-Onecore-WOW64-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat.bat WScript.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\prnms007.PNF.bat WScript.exe File created C:\Windows\System32\C_10003.NLS.bat WScript.exe File created C:\Windows\System32\es-ES\smbwmiv2.dll.mui.bat WScript.exe File created C:\Windows\System32\ja-jp\PresentationHost.exe.mui.bat WScript.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\SendToOneNoteNames.gpd.bat WScript.exe File created C:\Windows\System32\ja-jp\NgcRecovery.dll.mui.bat WScript.exe File created C:\Windows\System32\de-DE\w32tm.exe.mui.bat WScript.exe File created C:\Windows\System32\Hydrogen\BakedPlugins\Animation\preseteasecurveinoutexpo.hbakedcurve.bat WScript.exe File created C:\Windows\System32\migwiz\replacementmanifests\iis-sharedlibraries-rm.man.bat WScript.exe File created C:\Windows\System32\migwiz\replacementmanifests\SettingSync-repl.man.bat WScript.exe File created C:\Windows\System32\wbem\ja-JP\vsswmi.dll.mui.bat WScript.exe File created C:\Windows\System32\FXSTIFF.dll.bat WScript.exe File created C:\Windows\System32\ja-jp\Windows.Devices.LowLevel.dll.mui.bat WScript.exe File created C:\Windows\System32\wbem\NetTCPIP.dll.bat WScript.exe File created C:\Windows\System32\nltest.exe.bat WScript.exe File created C:\Windows\System32\de-DE\SettingsHandlers_Geolocation.dll.mui.bat WScript.exe File created C:\Windows\System32\DriverStore\FileRepository\netnwifi.inf_amd64_a2bfd066656fe297\netnwifi.inf.bat WScript.exe File created C:\Windows\System32\fr-FR\mfplat.dll.mui.bat WScript.exe File created C:\Windows\System32\de-DE\eapphost.dll.mui.bat WScript.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fssystem.inf_amd64_89e15d7e662d6584\c_fssystem.inf.bat WScript.exe File created C:\Windows\System32\ja-jp\pcwutl.dll.mui.bat WScript.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat.bat WScript.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Common-RegulatedPackages-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat.bat WScript.exe File created C:\Windows\System32\IME\IMEJP\IMJPCMLD.DLL.bat WScript.exe File created C:\Windows\System32\TieringEngineProxy.dll.bat WScript.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WPD-UltimatePortableDeviceFeature-Feature-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat.bat WScript.exe File created C:\Windows\System32\es-ES\lpr.exe.mui.bat WScript.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-ClientEdition-WOW64-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat.bat WScript.exe File created C:\Windows\System32\DriverStore\FileRepository\wfcvsc.inf_amd64_dfe08f401a2eedbc\wfcvsc.inf.bat WScript.exe File created C:\Windows\System32\en-US\FirewallControlPanel.dll.mui.bat WScript.exe File created C:\Windows\System32\zh-CN\quickassist.exe.mui.bat WScript.exe File created C:\Windows\System32\ja-jp\upnp.dll.mui.bat WScript.exe File created C:\Windows\System32\Speech_OneCore\Engines\SR\spsreng_onecore.dll.bat WScript.exe File created C:\Windows\System32\wbem\msv1_0.mof.bat WScript.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SMB1Server-D-Opt-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat.bat WScript.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-StorageService-Package~31bf3856ad364e35~amd64~~10.0.19041.207.cat.bat WScript.exe File created C:\Windows\System32\DriverStore\en-US\hidserv.inf_loc.bat WScript.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsier.inf_amd64_3ae2ea3a55ec0279\mdmsier.inf.bat WScript.exe File created C:\Windows\System32\DriverStore\fr-FR\wvmbus.inf_loc.bat WScript.exe File created C:\Windows\System32\wbem\AutoRecover\D6E15C5FE0484F1B1192CEC9DD7DCE6A.mof.bat WScript.exe File created C:\Windows\System32\fr-FR\appmgr.dll.mui.bat WScript.exe File created C:\Windows\System32\ja-jp\wbadmin.exe.mui.bat WScript.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133731353600722318" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4032 chrome.exe 4032 chrome.exe 2948 chrome.exe 2948 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3244 takeown.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe Token: SeCreatePagefilePrivilege 4032 chrome.exe Token: SeShutdownPrivilege 4032 chrome.exe - Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe 4032 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1516 wrote to memory of 3144 1516 WScript.exe 85 PID 1516 wrote to memory of 3144 1516 WScript.exe 85 PID 3144 wrote to memory of 3244 3144 cmd.exe 87 PID 3144 wrote to memory of 3244 3144 cmd.exe 87 PID 4032 wrote to memory of 3476 4032 chrome.exe 92 PID 4032 wrote to memory of 3476 4032 chrome.exe 92 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2212 4032 chrome.exe 93 PID 4032 wrote to memory of 2412 4032 chrome.exe 94 PID 4032 wrote to memory of 2412 4032 chrome.exe 94 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95 PID 4032 wrote to memory of 3860 4032 chrome.exe 95
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\code.vbs"1⤵
- Drops file in Drivers directory
- Boot or Logon Autostart Execution: Print Processors
- Checks computer location settings
- Indicator Removal: Clear Windows Event Logs
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32\* && icacls C:\Windows\System32\* /grant everyone:(F)2⤵
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\*3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3244
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\* /grant everyone:(F)3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4412
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcb6a2cc40,0x7ffcb6a2cc4c,0x7ffcb6a2cc582⤵PID:3476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1936,i,2246984266791491869,6793076274077975382,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1932 /prefetch:22⤵PID:2212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1836,i,2246984266791491869,6793076274077975382,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2512 /prefetch:32⤵PID:2412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2036,i,2246984266791491869,6793076274077975382,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2624 /prefetch:82⤵PID:3860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,2246984266791491869,6793076274077975382,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:12⤵PID:2676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3176,i,2246984266791491869,6793076274077975382,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:2644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4596,i,2246984266791491869,6793076274077975382,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4620 /prefetch:12⤵PID:4532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4528,i,2246984266791491869,6793076274077975382,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4740 /prefetch:82⤵PID:1748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4580,i,2246984266791491869,6793076274077975382,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4848 /prefetch:82⤵PID:2184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4804,i,2246984266791491869,6793076274077975382,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4932 /prefetch:82⤵PID:4636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4848,i,2246984266791491869,6793076274077975382,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5068 /prefetch:82⤵PID:3056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4896,i,2246984266791491869,6793076274077975382,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5156 /prefetch:12⤵PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3332,i,2246984266791491869,6793076274077975382,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4860 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2948
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:3060
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 cbde966e852a2718f035655406f1a0ccd83d5ee1e6cc1e635532cec678661752
- MD5 55c07df4802e15ee32d3590c5dbece82
- SHA1 a14a7487da2985e874562d988dc105fa925beff7
- SHA512 8f8659b7906d5bbcfb6cd6ee5487df3e54ea3d076639c54009543f0ad684f222826d7bc10f830ad9c3ab97ab5ca55be57ba0f906cc3da3779a1b57f35e02120b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 356B
- SHA256 776f36bebb89f3e962dc5f322531a6fc732e21e83cce0a1ffc42beb31470a81f
- MD5 8dc7a58daa4edb23a1d05ec1e85418f1
- SHA1 8f591d48a440a33c33b5659accda39384cdead23
- SHA512 c4362300d338adcdab000c56b291dcef6e4a53616960a5282e94038da3a86b6eb1633b50a8fca093a3d8924d3c71037ccc971eef641006ad11f79eed124b83aa
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 8KB
- SHA256 08392953b24864e0bf0a57a1b216fef5b4681710f09111c62cfa38a23b0f63cb
- MD5 05fcc4f6a6d3291b41cdd5f8b64c4756
- SHA1 96a975526e27573ed92f609b358ed1f54eb443c3
- SHA512 6ea3ff6815f61d703a47d0173409b993decba41287c75fc5c075694272093f5458cb78a21c4e28fcec9bb3fcde79b39b4eb8e439d5376bbdef82dbb7971a13de
- SSDEEP 192:v675RGN/XXiPekhHV+FR2evPo6yIsnVdg4:v67u9itZGRZ4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 8KB
- SHA256 399f694a4774d092532eeb96a382ad83f8d4a16ee5b68fc1d8883e43d9e9be4a
- MD5 b93d3379261be9a5e53feea427f78239
- SHA1 005588cebd35cbf8bdb95aca892bfc1464d28efd
- SHA512 1afd22694ef0396e4932691f3e4e0f03701a8fc9b6ce32eaaa35d7af29636a7d5a835dbd09ba03475c690003187bb0a8bbc0c2fe553e65c188969428ff41b105
- SSDEEP 192:v675RGN/XXLPekhHV+FR2evPo6yIsnVdg4:v67u9LtZGRZ4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 8KB
- SHA256 3fbc562004b44eb8fd8fe3ff385eea1d3a8ac65f484d68a961f2068ba36b7e9c
- MD5 5764b984d408362de20042178c7211fc
- SHA1 b960a42ebaeced3da9dec8600bb586d46e0a3599
- SHA512 335def9170c660aa90414a67091eadcc46f90399c690041a5f2e77b8eddd691f13664e58a3f67cc28d5fa521ea5cfdb16ad997acb2d6ca73a376708e6fe7f3ea
- SSDEEP 192:v675RGN/XXkPekhHV+FR2evPo6yIsnVdg4:v67u9ktZGRZ4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 8KB
- SHA256 52b2c376bcae00a1142f0f9c004171ac5465847cd15f8a3efcf6d5f8bfcb6859
- MD5 6b6171558f2e964f967c566337b14b7e
- SHA1 03d884e56f45d684c7a07b6fe5acd6920380a5d2
- SHA512 504309fd3cd3c341485f9356441badcd7281d21809187cad7fc1d3376cdd111b830ad0571598ea5d3027fc965a1927b744a89f68e79064a294ef9cc0b792ad98
- SSDEEP 192:v675RGN/XXiPekhHV+FR2evPo6yIsnVdg4:v67u9itZGRZ4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 8KB
- SHA256 d6be5ba8a76eb63ad5317dc6667f396a43079c36dfab1cf16c38717d202950ef
- MD5 ff7e07784f9366656f4cde5cf74fd0fd
- SHA1 98e0a749f7bcd9fc4172b3d424eb131cb744d9e4
- SHA512 98e33549d4fc136a02a1f0432d3b789cdd7210b4f3c88d1cd693ac3794055b2f6360ae3f3bdf15efe670deec0c250b9f8e836e147ac66dd0232fbb7c12e0be2d
- SSDEEP 192:v675RGN/XXjPejhHV+FRgDe8Po6yIsnVdg4:v67u9juZGRi4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 8KB
- SHA256 1169bb249e27652711facaaee1d3a8c8c280018760bda947bf181ef2fe5e8810
- MD5 2133332b284d8d332c9188a251f7ee9a
- SHA1 18891ed2e304c7a6126d10c5331c11d7e8075428
- SHA512 321115b9e9662904283b209eb74551eb75df6c13c51a02461c91d22cecbef01d93279b63b30ecbdf0d5d27875e4467578e03643c790c667cd68bef36502d86b0
- SSDEEP 192:v675RGN/XXSPekhHV+FRgDe8Po6yIsnVdg4:v67u9StZGRi4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 8KB
- SHA256 532e5674f88bf0895132aabbc959e32f2f6171ee8c24ef8c007830e5a7d334c4
- MD5 bb9bd786cd0f91601db6c062210f1b8b
- SHA1 32710aa98c02ee950aa313e14645a1dd4d06c908
- SHA512 7c1616f14f04384fef1004f9315fca89aadb321935aafd1b208ce72cccc6d18d5b1288ed3c6ecdf70cad78dcc4520904bc29eb9f5825b4b11421f5fd5eeafbaa
- SSDEEP 192:v675RGN/XXAPekhHV+FR5eJPo6yIsnVdg4:v67u9AtZGRi4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 8KB
- SHA256 9e0982fb6235328fa1efbe8b63ca02e8652b5b70a9796dcdc4cb6888aa8f8903
- MD5 51c4553059afd6f433e03c597b8ee382
- SHA1 a30b986b0eb1d2949bffa13bb777cb85f94aac7a
- SHA512 1276a1902c3fcfce1af1d917a233b31c24f308ee880754a8ff7bfe3e5924302ad3a84637fdfbe530ee0f95cb6ec9979926484796c7466d34116ea9df745444b6
- SSDEEP 192:v675RGN/XXBPekhHV+FR5eJPo6yIsnVdg4:v67u9BtZGRi4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 8KB
- SHA256 771ad117cd4694c64a0ba8f523f490c22e78a94f7b7a177f13d34c0065d5b4ab
- MD5 fedd79e193f65b681163bf92818b042e
- SHA1 c4f81bfdcb31d875c7d123464c8632307fa753d1
- SHA512 a53a5ebcda10b7eb404775dbed4a64070480a685a8f8773213bf835ba63f5cef401da423b561c254f2f1846f390a4291476cc62da0f196d4dd3d1da68218d16f
- SSDEEP 192:v675RGN/XXcPekhHV+FR2evPo6yIsnVdg4:v67u9ctZGRZ4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 15KB
- SHA256 4748a554e80a64c845fe1c55117caafb9d0e9be035409739350268471d75a204
- MD5 f7cd7926665d78feb46e6d409e18efaf
- SHA1 88e22c27176e3f9b8be42fe0a9c00f3673b8f086
- SHA512 1aecf6551597265e06c71048ff1e7fe2ceb6a224d04c8c287ce5d790124ef1a66b1cb0acd4d241ce0bf5c141f9d862c8046e82e87d4c73986c0c60a20912b4be
- SSDEEP 384:B1QrPA7pLhLcGQZcXy41kXqKf/pUZNCgVLH2HfS5srUxBHGKjX9J3v:Bco7pLhLLIOy41kXqKf/pUZNCgVLH2Hq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 228KB
- SHA256 794578f02594831b54ad81aa581a43262601a04c56b25abe5a5f95c26cfded10
- MD5 10aa12608772778c7750ccbb0f36c47a
- SHA1 afb59c3b902d59d53e0f605047cae9503149bf55
- SHA512 5750adb6b0e6f953d5b0a29435091144591aa6904b1abf6253c725b9f28215131800222f678eed197d8126ea5c16fbf3761aa28c1ad51dac40b1b18f5c3a62bc
- SSDEEP 6144:yzIc2MarpIt6F7IGS9fJANUZt46Jlxse6HWNj6YHgta9eA:0arpgBJKNY46Jwen6qgtaB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 228KB
- SHA256 264649a741e54ecbbf8d2db336bd031d9e64aca0bfff19c3bdf3af9f6c703a0a
- MD5 693c9daf41305cca6ba09b4114a00164
- SHA1 0e9d0911b397e49bc52f077d5224862a7c7af821
- SHA512 768422b800796a858fb24ed488e2ccd04fd68a7fb2628d23a8842537d2fa27d2cf5c9e8a0057a25c40459354f4c0def6a00f4c11f74cd108dc9e4bf974f2bb08
- SSDEEP 6144:3zIc2MarpIt6F7IGS9fJANUZt46Jlxse6HWNj6YHgta9eA:darpgBJKNY46Jwen6qgtaB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\whysoserious.bat
- Size 89B
- SHA256 81544f6c725f842b68f7bcbeb26525f701293d3d2281dd64dcad1e9d2dfc398d
- MD5 3dfc9ee09967df4e049864cf81d9588b
- SHA1 bd5840c3cec86b04f8e8dbc0ddf5eb1754d346ce
- SHA512 d55ed377a577bd9ecc3af2753716f8e145da79207e3435bccdbd377ffdeda6ac691f93ebcf3158c1450aaca429dda8f91bc6e4d2e608cec562dd7fe9cfb76708
- MD5 SHA1 SHA512