Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    23/12/2023, 04:56

General

  • Target

    b8742f158f278f110137656560770f386466b918d2872a33f705dc5067c79ee1.exe

  • Size

    1.1MB

  • MD5

    b8a5583e033a5078b919cd82115ed3bb

  • SHA1

    7f9307aa4c0e99204ca594e5b07dc11c4446d3a5

  • SHA256

    b8742f158f278f110137656560770f386466b918d2872a33f705dc5067c79ee1

  • SHA512

    fb292aaf107894815dc5d2269a30d2de97aef7fcf297aa2050b641f1126f21c7fcfe1d9db5f9c6552edc6bf8ec2ffd03e8e98238ef32e98040cdea994be90241

  • SSDEEP

    24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Qz:CcaClSFlG4ZM7QzM0

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 50 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8742f158f278f110137656560770f386466b918d2872a33f705dc5067c79ee1.exe
    "C:\Users\Admin\AppData\Local\Temp\b8742f158f278f110137656560770f386466b918d2872a33f705dc5067c79ee1.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2932
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Deletes itself
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2800
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2660
          • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2860
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
              6⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:2076
              • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1984
                • C:\Windows\SysWOW64\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                  8⤵
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:768
                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:352
                    • C:\Windows\SysWOW64\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                      10⤵
                      • Loads dropped DLL
                      • Suspicious use of WriteProcessMemory
                      PID:2120
                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:2836
                        • C:\Windows\SysWOW64\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                          12⤵
                            PID:784
                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                          11⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:1848
                          • C:\Windows\SysWOW64\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                            12⤵
                            • Loads dropped DLL
                            • Suspicious use of WriteProcessMemory
                            PID:1756
                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                              13⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:1564
                              • C:\Windows\SysWOW64\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                14⤵
                                • Loads dropped DLL
                                • Suspicious use of WriteProcessMemory
                                PID:3036
                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                  15⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2256
                                  • C:\Windows\SysWOW64\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                    16⤵
                                    • Loads dropped DLL
                                    PID:1612
                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                      17⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:3000
                                      • C:\Windows\SysWOW64\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                        18⤵
                                        • Loads dropped DLL
                                        PID:2088
                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                          19⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1336
                                          • C:\Windows\SysWOW64\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                            20⤵
                                            • Loads dropped DLL
                                            PID:2716
                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                              21⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1668
                                              • C:\Windows\SysWOW64\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                22⤵
                                                • Loads dropped DLL
                                                PID:2296
                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                  23⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2904
                                                  • C:\Windows\SysWOW64\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                    24⤵
                                                    • Loads dropped DLL
                                                    PID:2448
                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                      25⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:600
                                                      • C:\Windows\SysWOW64\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                        26⤵
                                                        • Loads dropped DLL
                                                        PID:996
                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                          27⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1828
                                                          • C:\Windows\SysWOW64\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                            28⤵
                                                            • Loads dropped DLL
                                                            PID:1960
                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                              29⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2488
                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                30⤵
                                                                • Loads dropped DLL
                                                                PID:1972
                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                  31⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:2796
                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                    32⤵
                                                                    • Loads dropped DLL
                                                                    PID:1520
                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                      33⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:2916
                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                        34⤵
                                                                        • Loads dropped DLL
                                                                        PID:1540
                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                          35⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:964
                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                            36⤵
                                                                            • Loads dropped DLL
                                                                            PID:2780
                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                              37⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1980
                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                                38⤵
                                                                                • Loads dropped DLL
                                                                                PID:1336
                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                                  39⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:2500
                                                                                  • C:\Windows\SysWOW64\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                                    40⤵
                                                                                    • Loads dropped DLL
                                                                                    PID:2044
                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                                      41⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:2716
                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                                        42⤵
                                                                                        • Loads dropped DLL
                                                                                        PID:3024
                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                                          43⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:1312
                                                                                          • C:\Windows\SysWOW64\WScript.exe
                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                                            44⤵
                                                                                              PID:484
                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                    23⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1928
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                        17⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2656
                                        • C:\Windows\SysWOW64\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                          18⤵
                                            PID:2672

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini

          Filesize

          92B

          MD5

          67b9b3e2ded7086f393ebbc36c5e7bca

          SHA1

          e6299d0450b9a92a18cc23b5704a2b475652c790

          SHA256

          44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d

          SHA512

          826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

          Filesize

          753B

          MD5

          b4b0a35a27754471bd4c0737c8a4ed65

          SHA1

          fef3c44530313b03d9ec49ff6522428d6a4c2c85

          SHA256

          0e58c3d8ebf0a7ccad0c5af90962806a2e09fd7b5f34a85004d5d35e5571ba65

          SHA512

          a250032e020ce62c1ebc2827dd809a7486a693291c711a0d4d70b4d4978768a078a5c81fee96dc11747c7fdd945bec6c06fccf0b4fc48135a71f8ceaf1c4f9d9

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

          Filesize

          696B

          MD5

          e0e0a1f6d22e3905753a9c1ed053cbff

          SHA1

          52c11b8049f4015d7825fc1fcbd0d5eadb29a6e4

          SHA256

          2eca9ba67f160c00268003e7239f9cfc5da0f10b6a0b3c82538ef2a0874b871d

          SHA512

          3eb98287cc8115cb648626272eaa6cc77cb57fcd614f0e969d3af3977a8e09e0f7f6f3ee6ef9322e096bf0cec546f681a6983030a10e972b538d42e2bd17740c

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

          Filesize

          696B

          MD5

          faa8ef2e758448ccba58a486794e0699

          SHA1

          85bd05023b75335ca0ff084efcd02e7e9e447e88

          SHA256

          f4c0222febb3104b66ec8578be36697e28bc8956d3606e711c39b3ad7fcf6b8b

          SHA512

          8a1074670bbf7942ba1cef24d474aa26b9a66c378cc790a5577bc3d487f7174dad7890d2fdd43eccad42c4da28e282e5909a8f9de120a3ba81ee2847b44a328e

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

          Filesize

          696B

          MD5

          fb757130836576e5f952cb011021776c

          SHA1

          68f6351ef6dd363f67e76b91e7d8150050948698

          SHA256

          2d8143967be00cc4d6f3a1b8671885498b80e57ec52a84e19eaf136e64980e5b

          SHA512

          6f7311c6964be509733152377344d37f311021a6638946d275d282aa1b0212d8d790175b8c4e61fba6f5f4299c0e5da3307b69b03f619273462edd5c3cfce0d8

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

          Filesize

          696B

          MD5

          463784728a0ab2b8cc52ee1ed0e5258e

          SHA1

          620a618c31439d36e8539e50359713befcc28e92

          SHA256

          a34e1ed304dca4f58275bdd5daaf071d1767db7bb7ccc6bf2aea2df5e2be023b

          SHA512

          52f9736297fbaf65179d35e01c7a15d516d2ff8b5c949a45046bc668bbe94b5da63aea4d5920ebfc1a884721f16fdcae75ea08ca9a6aa78297a44051ed979c7f

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

          Filesize

          696B

          MD5

          e5bba46683440caa1508061b6e638120

          SHA1

          538ff5b7cb3ca90cee3e60bae0b487f4b78912de

          SHA256

          9b324dbd185a14c0ebfd2cd2731f6bb32c501dfefa7aef4f65b137357502c65d

          SHA512

          466f00fee10e323273e5d1151062e9fcc36f5657a404c6dd3c0c9ecb56e5205930087e612b13a9c6d1a56df7e05a2bd9c14e95debd5e5aed96ad2ef867e8de4d

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

          Filesize

          696B

          MD5

          4d8de8aafa7849de2f40f61eb205cc42

          SHA1

          67decea42f8c2ee805e859a898922c90ae105cdc

          SHA256

          44a2def2aab8221d4302282a111d1b9592b8828363736aa27a3343836817d2e2

          SHA512

          a44c1b2e8bc3b432daac94073c22e3b93ee412e345f4b2037586fc178fc7909f9360c2ba0817d7648d0739aabf51c6533e87226bffcd7109974e561d901610fc

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

          Filesize

          696B

          MD5

          7a01dad1af2b3e0327e1d352436bbcd7

          SHA1

          10612930777b11e8edeb9bd33c74a6a2404c9d6b

          SHA256

          185fe22d4d1af7aee3fd8cf94dcfe20c5daf320764d2c96c2ad5f2cff4cd1655

          SHA512

          1fee128690213b1ffd6c1f95d9894f52c2b0374ca99b16795028fab6b364298c1d678c3f92775c410c0fe7a1a71a33d3db5635e5bb6c71449feb60c9f5316616

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

          Filesize

          696B

          MD5

          0297693238c8d2753940dd61243ddfd8

          SHA1

          c5e61e727061ecb2475cfd052102d1ec3f837ad8

          SHA256

          2c553c736dbf82875ba83b712b4d0a0e5b63b0e4089f0882755bbf078c22c0a5

          SHA512

          042527b1ea8d7e3cc25f8cc72c357e39ef822e78eb9c5802613ff806f9869fff49e63ebd0d8e52754c5a918fd76640dd0bc7a1a1dfd5e82cecfcfcc13c8579cd

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

          Filesize

          696B

          MD5

          6cc9dd78b42e2ca0e1deb237988b6ae2

          SHA1

          6ec16a7e43a4c558a19f125758d56ed9a180e6ee

          SHA256

          11367ac6f6a1b237ca69aeeb571a435181256f8836d6910f036beb90e160f7b2

          SHA512

          331f0ae896c0fb9906dd2fc2e3d58860073af97deb31cdb2184cc4bd104e2e066bfec6bdef0e16a8eda3d5605875fe7c03480b1e2d68bc9d7e3a2b237a3020a4

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

          Filesize

          696B

          MD5

          2551ae733b39ac9061a9d5ebd2f29d98

          SHA1

          08247d27dd5bf959db0b29d3e5b0551dc47c9d02

          SHA256

          c69ee4a632cc1c351d5fa930d42546923a4125e7d9cbccb2ad9f9e3318be2b77

          SHA512

          a1c669cb87194c2b496a7131f7f2920b6c31156f88d6c1140e79f3b83fbca3785cd57fea2d47cb951ed576e69a1240e81746a5bc5444e65fd05fa5234125731c

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

          Filesize

          696B

          MD5

          298f56408ef5bfe14b938d85e57c843d

          SHA1

          691d78c4c4887333b4679d3e340a7a04caad13a3

          SHA256

          b5738b726b24c9d220bd7256e4abb2e97215d50416bf67983cc82dc83b46298a

          SHA512

          227bf6d7e70568144112dc142ef60fa38f2b5f39196e3d3377a120b78fa86382726021f024bf5413548df0ce1734bb905d28e56de4dd80c6f21c05ab2a5ef83e

        • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

          Filesize

          696B

          MD5

          75b8f60cfe6895a93f2d8f1b5568af94

          SHA1

          b80485bc82864b4e1bf0bcc44579eaa01776b1fb

          SHA256

          6ff47f7681e8f497470bd11b2cfd8156c5d8f1b01f48bfd89037cc4bfe0f34cc

          SHA512

          089e237c5309d36058e036f69d78deb4144749e91b3a8a8383f817af051a3452acfdf42227cc721517e93428cfd5d48b42e9750e9548762609e81917a4de29c2

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          190KB

          MD5

          550498355386bfac99bcf1c96151441d

          SHA1

          97025ee359c1afe428afaee75b5fcc877e71c64d

          SHA256

          ecb1ce83da0f1324a5bacb405b3bebb420508590231da0995635e4448f7168ea

          SHA512

          da904c6030212ca9639bc072af21307ae3a46f0cc104dde80e6fca7136256b3e0f71de22b5837ff7b64d2b5da4e05aa55957d2a73cbde49a9aa053c9db95d251

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          428KB

          MD5

          134a2f3221fe9357ef66e7f7b1137de9

          SHA1

          8a396d7243831842e245ac2bcf94894db6daafd3

          SHA256

          07c615e0c6fd569ade0100cfce58020b05a235037fb47b8da710257dbd2f5f63

          SHA512

          80b0bbf908c4d6c047978bbd266ad67c74dedbc8c10e950421de90df2223eeb7dc7fbbfaab1a35fb43639a1a5b1430150c486b30aee7c864e13135fc38716fe6

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          471KB

          MD5

          a31e50f33d3efe148d344d59f85c5bf5

          SHA1

          9a724737f39fd6dfb4b6974648026a421a1984b1

          SHA256

          01052567f0896338a76acceb1645fb97c26a36fe91e664c014eff6f244a008f7

          SHA512

          ef807090f9a1dff4f2363470fbd251adbe9f32e53a5450349f520e351f4e111be29eef502e1e90397e88d0f2dccf86a6f7d8cf0a45d10668908b07f2f243673d

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          532KB

          MD5

          a7fafed2b41a648a8c9040ca0909a827

          SHA1

          918efdb698d64c26136607756ca601b99148333e

          SHA256

          7da069133002d5406cf43448275410a459592bea8c1c16996544820552ed41d0

          SHA512

          7150eb21976369d4fd469d7ccb097699bce61b415563d432ee326a662f6d1fca3cc0ed5f74edc05a0b8957d18162e64a3fea068a523ee8bdf2936dbc0834cb86

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          237KB

          MD5

          7d3d0cd8ced4b0cf510b4b2ced595ceb

          SHA1

          6b081ac60011e915f3dc9ec400325f0e293cf851

          SHA256

          0bad6c0d14e5171d21ee70ab1e16563b7d5e89309cd229ec46c089e054bd63cc

          SHA512

          f05f414b709672f0e7b5cc6b6e054ae5ac11d74dadae6ba3d022b9d346ff8cc05b992d61b4c1e826f0520fde2f47160db5b5ac43746475b2ea301f30414fb8e7

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          157KB

          MD5

          2ec9929548b3360b3d1e57e6940c8b81

          SHA1

          cec0e01a94182c3997b16fbb596c72bb9d46db14

          SHA256

          46e3114f5fa4051a05b1b2cd0d01811460440643a1237418942f6681066e7b42

          SHA512

          ea0b2149993dc468289e89d7c7b724bb13183539374ae82b02c6f66f6b302e9d0a170a2a7d4f01b74bbec1cdc76a45a6562879bf78dfcbaf0b1fa3fcce24efeb

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          370KB

          MD5

          f62acd9219bea02bf22051e33490a309

          SHA1

          d0a761553ac3a451168494c412174e640afa1667

          SHA256

          6e077721051db9d08ffe0fd8e4887fee43d1cf33afcf8d53b82ab2f3d867b35a

          SHA512

          a5de79b3f57588e460a856e647c307eb19f1379fd0500c0a8aa33af788d91a1b6f840a5efacfc82762a29f89febede9203630f38b1ade6adb87aaa00001ed281

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          303KB

          MD5

          8fb3876d6661ca0d4e4ffa26cc2c1b01

          SHA1

          47a828dd513b43e5bb880cc1580474f76cb769c2

          SHA256

          9155c5dc090007293e2a747b35a68d7255f5785feed436aa6d74a66ee46f79b8

          SHA512

          59aea62e5bf22cf4d02a05450f21348a54492cb969a00ea5c4aab1748bcde4698a5a81d8e7b06c62afeb3f2dfbac9f52e2ca23fd20d22c98f2c2406a54cd3dce

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          302KB

          MD5

          b989ae35a5572fb942d5d93403634497

          SHA1

          8d41d33d15e600096f2d8efc2a6dd365fb5fca64

          SHA256

          90a770fbf3a92efb53067a64203834eef7ab63363a8989e9972e2c80b49a6854

          SHA512

          2bb0e962869bc5ea4e38463f6ba2c4d0c26e346a0354c8efa449552072fb13fd6decf21ca65dcb2b8b955eecda1cb300ddbeee59746372a6994cde37a6e5e8af

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          260KB

          MD5

          8c2d28c3a61209defb73cc2fb9892bb2

          SHA1

          644e25af4bb7b9e9f501f1c4695970eefb5db860

          SHA256

          48d60b6df7d0029d568dced0d192981817be098952999b6def57a76d0f758b62

          SHA512

          a0f77a8a5e9ea601672ae87a5a7d30935fb6a677875165be46de689f8acf300ff23da1ef932ad86d847aabb503185f6a776b8de467d1ee6edd6220d886969cb6

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          258KB

          MD5

          717a0ddd3c9c0ec3b1e2fbbdb5c48288

          SHA1

          61418e90b6e1264a04bb1a987aa30a831bc375b2

          SHA256

          74608f78b54278ff515a77a6189d0f652502e3b56bbe0d4a68ffdb1d1cfba818

          SHA512

          bdca45c8607e5b04b5e27fe8f619f668341e74f5f3cfac2c28d26c61780bb2eb38ef42217d10c8a061daac8601e85e7aea9963af2eb82a8605b6c917347d37c5

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          400KB

          MD5

          19d4b1874c0e5164e25dbf42d7d321ec

          SHA1

          4321478d641389ed17d452124aa77199f58a89e3

          SHA256

          9f797a0907cf8de64012f3b8705e2d4d620ad86e0991ffc49a8f432047c98942

          SHA512

          832365b8dd415ed27d7cd618dc66ef8e74a9f58fa4315f4bcead85e87d9a2503f709f785faededf03b66d21045ae5ba81f1bef7e7c29d9a6ac94676f7d99980d

        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          460KB

          MD5

          13a1ef34c62da9a881e6fe1ec08185af

          SHA1

          3ce7de00be94c835acb0a1ef75090a4b602b83d4

          SHA256

          16e59e1d22c8c4188e7ac04ac581ca6d26ff42c9ed6529d2ff28035d8c6d1b45

          SHA512

          29b7eaf199d2f220a8517d613a1a3fa10c90bded257dc57dd4a92d239fce26812c4a8af67c2410639fd180cab23a6c12b099c92d118aa77749db955b6337ab9f

        • C:\Users\Admin\AppData\Roaming\svchcst.exe

          Filesize

          600KB

          MD5

          a03aea97d869d270393028e3c49d1c75

          SHA1

          73f83670e6db7478844b49cc71d13e2814ed425e

          SHA256

          261c0f2e33c87e08d2b91e94bd6621f05a8709b4dc9c467511dd6bb5eaf27594

          SHA512

          da08b70cb334f4742479dd3a1502fbd076c770c09a98cc5895abe79c81a6627f138589a84e0732b1df06398875e5e04a419e81e49a6b63c897c94a85d7232603

        • C:\Users\Admin\AppData\Roaming\svchcst.exe

          Filesize

          443KB

          MD5

          8ee8162fbbbf668da1a852ea916d3020

          SHA1

          4bbd75ce2e21a8beb1a22bea3e4e73d9356d821f

          SHA256

          45d10a7e6f0ad6ab233bea110bf82bb2c56e392162a5cc4f11cdb2a5f0b5fd1a

          SHA512

          931a95a0822d5be3f7798cf58692716f84c46890442c95767d1b6fa29a8a9cac0f1f8ee939314d67d2e0122a1d346e3d4304803c09d4a256bb41e4dae29bf58a

        • C:\Users\Admin\AppData\Roaming\svchcst.exe

          Filesize

          298KB

          MD5

          71ad10d4bda79c3baa67eefd1c933160

          SHA1

          55a5728a9cabfb69f13a47dc9ea8e244d0a38028

          SHA256

          0c805db903bc8dc60f51e9326f87b14ffa8671ebd691956f203bb6db910ca11c

          SHA512

          f7793a0d2f8933aaff19f182a0dc84027847107b7ec5c166aded7167a9dcb357c9bf0aa6b954ff6a0997e2a8113fb3bc2d60e92400c5ec81d0816a6b71be18b4

        • C:\Users\Admin\AppData\Roaming\svchcst.exe

          Filesize

          163KB

          MD5

          2fc5308315cc359c7a0288c82d7c792e

          SHA1

          948959085499b606bf91187baf59ed743bb96684

          SHA256

          8f34d3e1e62e56fd5747439ab4b7ce6d624545e665705c98d5a02f8fb52863eb

          SHA512

          14b293687d99b46c86e1a15afc021153aebc1c816a55411d98abf8b38af78c15a2f8f0ffa81d390c2bb2c549b408d9395d856de35c728a6f4968edc9b110d79d

        • C:\Users\Admin\AppData\Roaming\svchcst.exe

          Filesize

          448KB

          MD5

          c63fce96e2ce896cfe1da02f3a5481d5

          SHA1

          5af39b2d610ef9c459cb6114938a0b75179c7382

          SHA256

          cf32bb786ed5523c06a21b7fbc44823e96179c7316649c5879ee9c853640685a

          SHA512

          ee1db71918ac288ff5f288d3e17472102e44965136e70dc891e68b7e9c8ba8e45f9dc1c8a1fef2d99dffd5a67f05f7cb17336c71ab6bdf09ab13c195a54fef7c

        • C:\Users\Admin\AppData\Roaming\svchcst.exe

          Filesize

          191KB

          MD5

          95d30c471f3ffed8fbc861b790e6b3d5

          SHA1

          11f120dec1ab9fb302c392ce95456890652da54f

          SHA256

          1929c14c2dd65bdf36e47f92d79060446bb8688e6464de0fafe3a4284294a958

          SHA512

          69e89773fefaae8377bbc4b81be157738b029d3e102ae845d96933b3a98e0840707217d3f1fd982c61cfffdaca91fde2e41b06a230275893eb85a057e3c49fc0

        • \Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          325KB

          MD5

          f9d7a91c7c66caa09d1707f4572c6b0b

          SHA1

          03f65cca8f359e92118e6b1651f55e76613ebee9

          SHA256

          b2c95fee44cc36f7f3870dac775851f374333669becaac90543fb0a4ce35a169

          SHA512

          76fc6894bb57b3b26138f350f6a4d59df009f58bff04ad07117a4e34437087c496837c908dd65c2414a6d274b3892e9471ddc24907cefb0b698370b0fe4304ba

        • \Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          104KB

          MD5

          3f7a0e19ac9f1d7e2e7e8fd5f6254410

          SHA1

          a989ae89eb5ac219da7319cf3efe0c3c5b9a8fc0

          SHA256

          335d95f0526a581dfb3a91056aa4e0d3d679fdf41999168b722c182df2b5b2e6

          SHA512

          e91b7feadaffbba4d33151c4d8fa9572afb973484d0fea797bdcc1ec12ac7bb950ced9cf4a12bfd6885c6c577789a3ef8f1c2b22a59e065119a95cbe9ffd6016

        • \Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          414KB

          MD5

          d4486787b58b23c80df403949b9ac42c

          SHA1

          5db265b2155250bd4d38a17063dcc3da24a45afe

          SHA256

          5b99114a787d3c05e4465aabe560703e2986c51183ca25593a8dbacb65c9bdd0

          SHA512

          19ec0c2355637cc69173ab9e03f2b6880e741c04c7b53df23e0fd6a5afbeaaa93e2d63d072580cb09e8919086fffe55be3d4efcfccf16fed83f26051e6161e7b

        • \Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          896KB

          MD5

          7a4f41632753226eefd2438e628b53f8

          SHA1

          67f178cda2ea2cafd1a1bb43c4feec0b08757d59

          SHA256

          64eec299d04a63f574d531297fb123c2e8b3f334e6ca95127907d48aa3104104

          SHA512

          033a11fe67f04eeb46d698d6be69f07b7dbf5eb223cf5e28fa813de769b543aad3d9136b88fcbb8637a6ecaf311e771c6d49a32a4c57c4ec5148854d4c4bd918

        • \Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          336KB

          MD5

          e3a83e7f0d7f88065d2b32326924e758

          SHA1

          22080ceed03c82f6bb71b7ca67b6e4580d453717

          SHA256

          a35ad215a864e85ef328b75b1732fcf58f168ceba2fff72b81edcf48531f866c

          SHA512

          a8451fc0a17810e8a362d2df3616f7e874231d096609818720a2c13c960ee69b7fce90968e6bfc1c1d72d5ea41a66f9c5290eec522e2d97e66d6ba53b7fbfe98

        • \Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          1.1MB

          MD5

          cbec7ee1ec900d406a3bf5dab648751f

          SHA1

          5c0e06a632683378ea15c117cb4a607556b8167d

          SHA256

          b0f5135751469f210066157e7a77cd03ec3baefe3098f84ba993f754005589ed

          SHA512

          4641bdb3e69d3f23e729c994fab0cd0b0296ad808a237c3ed0dcebe7f178e12ecfa7fd525614fb3957584d248f2dcedd080beb1eddb168975ecd9b69492fc57f

        • \Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          154KB

          MD5

          9ef79ce332b3da85d6d91cf1e4001d2f

          SHA1

          685a06db12da913ba7dc748f5b6d83e55171374e

          SHA256

          ecab786b083f4df7329e108bd934a2be05a64ee791f046cca58d1b16b7ac8993

          SHA512

          ec600d314b385a09421a96daf17182374ca7b64f50cd446e6c0e1f4eb5e551e51b55ff1886c2964df901840c00d6b4d4278e36b52fc8ba71ffbcdf2ab45c93fc

        • \Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          269KB

          MD5

          f1757a7bf2f1d0b042edb909d548edaf

          SHA1

          c331a18aeafeb001349d1fd2f518ac786f80aaa7

          SHA256

          f254b58f36e5451dfc32cc3da3d4fa8ea7d5f4429a55bcabacd9a5243e1096d7

          SHA512

          50f00d3e6217dbfba394eb2946ae1a76670f7bf2d4c3bd9ed9a4a2b4dfc8e21bbb790583f2a62962f8e8ccb6c3084455a58b652d9b9a380a363a411385718448

        • \Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          366KB

          MD5

          6fb4904bea5714a8bc811ee6c0279446

          SHA1

          ec40017aa624fdf5c03fb89b1e81d42dcdbeba79

          SHA256

          b8e26da3c808f50b39261648d6cd7fdb5fdb43c2f2b1faaf41613ec4b0e03abd

          SHA512

          35c54948e8381a169e6c3240081c6164aba5e8abb9b76ddc4823047d088b48416e1c66c94420aa478451f902f1325331b5cd9f51de2db613bf47e17a7d2d7122

        • \Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          241KB

          MD5

          c374020bbdb94f46cd12bf14f26cf26f

          SHA1

          c41d9281ec2a662fc621b917b5d936129e76469e

          SHA256

          d77f8e8c6d53df9ab3fc6fb4fe68bb975a8555eba776d3e459a8db7ec78f5af8

          SHA512

          a00068e02298d8ea078fae5fcd76ad6c7344e28a65bb79697b8aa7c2d250a47a4c41daa27c922def79cc60a1b3b3cc08d916faa6cf8a0842f636eb52cfa978b3

        • \Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          231KB

          MD5

          04818d336852fdbdc97caf08ce965a5d

          SHA1

          c2822e321b178ccc2d146cf2ace5a1bac69c2e33

          SHA256

          96441ef67e0d30f841c1f516d02a9c545ef1dd7ca2b698c0532b33f333d28454

          SHA512

          8fbb636a05640cbfd9d1222c5b7dc095b279bd1a53eb9a22689110f7a2fea5361ee715464ce21bb3b66f418fcff0610e2722bdfe9da70d46fab5f71a3cb01767

        • \Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          281KB

          MD5

          266bbd86667a389d7c859db84201969c

          SHA1

          b304640bb440984df64550fbd62fb734131ee7b5

          SHA256

          88e53f1968fca0610aa290e0321875921291ebd5aa6c7a0f208e1a37a7c8b989

          SHA512

          caaa70191d9b55ec0f7f4bf8ba78bf18b778c8382d8e1707fe4c7c67ef74ea4529c28e2b6a5d4fdf3e16c17a2e8ca70cd47e2a76b75183ee5eb98b4dd3a78d7d

        • \Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          480KB

          MD5

          9b294ad6ae4c2b6e84949534b8096afb

          SHA1

          9d0728cb5197a14838cd2882e132e5865fee4bc8

          SHA256

          0c87f7c8cedacbfd942be7d87140db1890b8f14c346d7aac7f585753c5f9c264

          SHA512

          14ca48e5bdcac985a269308994c460a3cab72e8692dfc62a776f4eccc75c96a2b3eeaed157cb1891493106b75a739771e398a118f5302d9660795e42b1ba9ca1

        • \Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

          Filesize

          959KB

          MD5

          5287648716e7a42d894985882d7c2407

          SHA1

          a202773ae1c420204adbb6abd28557b2d4bf2fdf

          SHA256

          def45996867f64e805a0aab8cc5d06cc333fe41c0bd04a3b59b20e134de71441

          SHA512

          33792b8a2af1736734139d2222d439ee49e922a5fa95234e396198bb51cb07a4402e58fad685e97e4730ad22fa439888ea400b520e1bec30f2a3df2a35c395be