fc1efdb7a3b96c1c7b57613f874bc5351cf058713ef72be506fbab40bd4a3ce5

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fc1efdb7a3b96c1c7b57613f874bc5351cf058713ef72be506fbab40bd4a3ce5.exe
Size 1.1MB
Sample240606-1b7v2sdd54
SHA256 fc1efdb7a3b96c1c7b57613f874bc5351cf058713ef72be506fbab40bd4a3ce5
MD5 b828365da525b9511788fbc2c5e612d9
SHA1 3a3fa6e62574068119386b6df5b31d15e6b687a9
SHA512 6e617b4528080979b23508269f6564b4b6632d1ca77088d672f40b5ad3e1cd3984a12291a03e5abdb3e2a19280da601b37ddc323322a426592b6698f05b43bc4
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qi:acallSllG4ZM7QzMx
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	svchcst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	fc1efdb7a3b96c1c7b57613f874bc5351cf058713ef72be506fbab40bd4a3ce5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	svchcst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	svchcst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	svchcst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	svchcst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	svchcst.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	WScript.exe

Deletes itself 1 IoCs

pid	Process
4984	svchcst.exe

Executes dropped EXE 8 IoCs

pid	Process
4984	svchcst.exe
1236	svchcst.exe
3648	svchcst.exe
532	svchcst.exe
4272	svchcst.exe
4280	svchcst.exe
1364	svchcst.exe
4060	svchcst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings	svchcst.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings	svchcst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings	svchcst.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings	fc1efdb7a3b96c1c7b57613f874bc5351cf058713ef72be506fbab40bd4a3ce5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings	svchcst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings	svchcst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings	svchcst.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4328	fc1efdb7a3b96c1c7b57613f874bc5351cf058713ef72be506fbab40bd4a3ce5.exe
4328	fc1efdb7a3b96c1c7b57613f874bc5351cf058713ef72be506fbab40bd4a3ce5.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe
4984	svchcst.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4328	fc1efdb7a3b96c1c7b57613f874bc5351cf058713ef72be506fbab40bd4a3ce5.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
4328	fc1efdb7a3b96c1c7b57613f874bc5351cf058713ef72be506fbab40bd4a3ce5.exe
4328	fc1efdb7a3b96c1c7b57613f874bc5351cf058713ef72be506fbab40bd4a3ce5.exe
4984	svchcst.exe
4984	svchcst.exe
1236	svchcst.exe
1236	svchcst.exe
3648	svchcst.exe
3648	svchcst.exe
532	svchcst.exe
532	svchcst.exe
4272	svchcst.exe
4272	svchcst.exe
4280	svchcst.exe
4280	svchcst.exe
1364	svchcst.exe
1364	svchcst.exe
4060	svchcst.exe
4060	svchcst.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 4380	4328	fc1efdb7a3b96c1c7b57613f874bc5351cf058713ef72be506fbab40bd4a3ce5.exe	83
PID 4328 wrote to memory of 4380	4328	fc1efdb7a3b96c1c7b57613f874bc5351cf058713ef72be506fbab40bd4a3ce5.exe	83
PID 4328 wrote to memory of 4380	4328	fc1efdb7a3b96c1c7b57613f874bc5351cf058713ef72be506fbab40bd4a3ce5.exe	83
PID 4380 wrote to memory of 4984	4380	WScript.exe	91
PID 4380 wrote to memory of 4984	4380	WScript.exe	91
PID 4380 wrote to memory of 4984	4380	WScript.exe	91
PID 4984 wrote to memory of 1352	4984	svchcst.exe	92
PID 4984 wrote to memory of 1352	4984	svchcst.exe	92
PID 4984 wrote to memory of 1352	4984	svchcst.exe	92
PID 1352 wrote to memory of 1236	1352	WScript.exe	95
PID 1352 wrote to memory of 1236	1352	WScript.exe	95
PID 1352 wrote to memory of 1236	1352	WScript.exe	95
PID 1236 wrote to memory of 844	1236	svchcst.exe	96
PID 1236 wrote to memory of 844	1236	svchcst.exe	96
PID 1236 wrote to memory of 844	1236	svchcst.exe	96
PID 844 wrote to memory of 3648	844	WScript.exe	97
PID 844 wrote to memory of 3648	844	WScript.exe	97
PID 844 wrote to memory of 3648	844	WScript.exe	97
PID 3648 wrote to memory of 3732	3648	svchcst.exe	98
PID 3648 wrote to memory of 3732	3648	svchcst.exe	98
PID 3648 wrote to memory of 3732	3648	svchcst.exe	98
PID 3732 wrote to memory of 532	3732	WScript.exe	99
PID 3732 wrote to memory of 532	3732	WScript.exe	99
PID 3732 wrote to memory of 532	3732	WScript.exe	99
PID 532 wrote to memory of 2900	532	svchcst.exe	100
PID 532 wrote to memory of 2900	532	svchcst.exe	100
PID 532 wrote to memory of 2900	532	svchcst.exe	100
PID 2900 wrote to memory of 4272	2900	WScript.exe	102
PID 2900 wrote to memory of 4272	2900	WScript.exe	102
PID 2900 wrote to memory of 4272	2900	WScript.exe	102
PID 4272 wrote to memory of 1256	4272	svchcst.exe	103
PID 4272 wrote to memory of 1256	4272	svchcst.exe	103
PID 4272 wrote to memory of 1256	4272	svchcst.exe	103
PID 1256 wrote to memory of 4280	1256	WScript.exe	104
PID 1256 wrote to memory of 4280	1256	WScript.exe	104
PID 1256 wrote to memory of 4280	1256	WScript.exe	104
PID 4280 wrote to memory of 3540	4280	svchcst.exe	105
PID 4280 wrote to memory of 3540	4280	svchcst.exe	105
PID 4280 wrote to memory of 3540	4280	svchcst.exe	105
PID 4280 wrote to memory of 2716	4280	svchcst.exe	106
PID 4280 wrote to memory of 2716	4280	svchcst.exe	106
PID 4280 wrote to memory of 2716	4280	svchcst.exe	106
PID 3540 wrote to memory of 1364	3540	WScript.exe	107
PID 3540 wrote to memory of 1364	3540	WScript.exe	107
PID 3540 wrote to memory of 1364	3540	WScript.exe	107
PID 2716 wrote to memory of 4060	2716	WScript.exe	108
PID 2716 wrote to memory of 4060	2716	WScript.exe	108
PID 2716 wrote to memory of 4060	2716	WScript.exe	108

C:\Users\Admin\AppData\Local\Temp\fc1efdb7a3b96c1c7b57613f874bc5351cf058713ef72be506fbab40bd4a3ce5.exe
"C:\Users\Admin\AppData\Local\Temp\fc1efdb7a3b96c1c7b57613f874bc5351cf058713ef72be506fbab40bd4a3ce5.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Checks computer location settings
    - Deletes itself
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1352
    - - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1236
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        6⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:844
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3648
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        8⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:532
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        10⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2900
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4272
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        12⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1256
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        14⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3540
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1364
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        14⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2716
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Config.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
Size 92B
SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
MD5 67b9b3e2ded7086f393ebbc36c5e7bca
SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 0d005943e84cc69be85bd65f647db69afb666b534aa720ce76ef81e28c919103
MD5 db2a910708aa53d43ec6dfe78a1f11e2
SHA1 ebfa2d1710e36437167ad7c07ed4760fd835178c
SHA512 81774a83e342de562def533ac618f089ce6fb9c983585d55ff3200aea359339bf77f93e738b7458337fdfee678d6787fb9d4b924cb0f2609624844d4f90a5c2a
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 3eb2bfca11e83ada63c9e426764e07267c058964f959ca5e0c3f0f8933e40026
MD5 70e226fbd8b4b3f2ddf8a8753a77586a
SHA1 a81a39d08f77479d0ee65599dd2749031c32fc19
SHA512 f8c3f2f4172e8cabb856cbc2527dae48cba6d740a8ad9844bb32013ccba200b4c03dfdbe3713d9caa5f7416b8729cba4d516a73989b388c952ab08205b3cd4b8
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 004b640ccc72e36c16e85661847b12fff228d63de834042accadde333aa33e36
MD5 44c38fa25d3a9963483b583388b6f47b
SHA1 e9b37eb8bcbe2ddda96178ee7502616660cfce57
SHA512 c39bd240b263314169cef9af85a8e8a89146e96400026936b68a69a7c732d301c16561971dbeaee752e2618f2a592bff5a6a91ee75893522e77f574176887905
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 370d3f0009b4f5179e917aaf335aa8267dd7e03688f0fff18f72d7d7af43d55f
MD5 5200291c61f8a54498d5ea3882597c4f
SHA1 7faf4fa36d25b6e6a25fa637cd4d565bacfc98c9
SHA512 7fab6730403115fe4a56ca1d5d9056a0796ca40f75c0499cb0a1d7cb77ad696163f960414f3248c7893a1cc99dadcdb73251603bca50a54668b45b79bc62b06e
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 04a5abb92c689fa7b9d768a067b1d9bd16c0a5d856c67c7f7881d62662ae0911
MD5 3f88ed4a802ff96db44e34ad53ac06c2
SHA1 446fe4e265af02ea012b5a8d5d0e7a0c9867f1ed
SHA512 f1afaf53ee96969d58902836b841ca7feed9769c81d9b2d63b72db5d7cf04d6a659b50869f8dba0d650aa6833d892261c0c3dd918e8bfbed13237e6333c47fdf
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 205412cd3d890bd070295ebf41e4a831de855a2b755c1a583b4dd2df66d5bc81
MD5 95cbcc068b61f14455af7f3daea5c57f
SHA1 7121bec25241666a150cd1a58eb7efb0b26eab96
SHA512 5ae57031bb2ce71bf93c683f07f82b521918ef8a145a80f8e488e403d7ca97079cb305bb3f9ad93f2b3a99f44954063447a5f9a2c0f6f276a2ef84beff5674a7
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 7bf3fbb9962c054e651caf4e49fa468d5892cb0bf88f4bbf3fd85b372a7d173c
MD5 16b9011648a577741b7fb4a55f1eeaac
SHA1 b0d86d1cf62b882bf28f0897ddb610e41cc6814c
SHA512 1d8631904aa2df5a90aef858d4369ed53d0075f97b42361a8e05c9a64f8e6a786897b625b1230d20415f3923db8aa5d8f5f619b7b9084202fecf4e7cead4366d
MD5 SHA1 SHA512

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 eac2234fca1a5ee21e7de23f84bbaf190a12ab508a6c12f38b0b0dde7b4469e9
MD5 324ac9575f1d172380b9948c251ff8ac
SHA1 91ed334096916cc61f734d15aafb543c342a7a8a
SHA512 effb44f765f2f6de0d5e1a9dba9625449c2a89368e8b69a739c547538fc0e3dc8b493c977635f749d8eb409ee03aedde570f80ee8b3902f5117c1eb2a70f646d
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QZ:acallSllG4ZM7QzMa
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 a651082bc8c5ae9bbb4d416e56ed7705d58dfd125754e766695446f6900351bc
MD5 784e13c985e2a600a0190cfea13a1475
SHA1 91b562d7d1a1f736d0a53614bc9ffc34218241b5
SHA512 2df07bb9619854ad27b19b00c423b848e739a1131e01d6a4b4f3acdd7208f5948cc526a68cc7644581e3afe499eb96b1cbdd564d787426d1317d2ba7239c83ea
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qq:acallSllG4ZM7QzMJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 2e6ec45bd204cfee32ee16679350fbcda29b9c07a5a6a040d8c9406ef92b480d
MD5 ebba162f9f3ef830fe6429099cc75ed7
SHA1 9a54f10dbbd5365ac3021f9e95b5b3c0ed687782
SHA512 6fbb6c4493e52e0ad81d49153caa8bfecf6feb3fd25ae7672039fa2f79ae615616978c74df3ba4b47d370851e3c9c20c119aed5a1457072baa419533dbdc71bb
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Ql:acallSllG4ZM7QzMu
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 d3b4dbed9ef2be87fbeaf6f79c63db4af5cca1ca8a3123c9c654d6b998013d8f
MD5 76f436ca704f281c1b5ed02e90362c4f
SHA1 28ba86fccaaacad6872691baf1670e91ae7da144
SHA512 6d8623d1c1b9b6692368ca574693698859f3bdef2dfa9c9685a541536429d2c19ca8a1d039c50d8cf147503c9e865925756a570509fed072ad06a92863b03556
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qg:acallSllG4ZM7QzMX
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 23fbc1e59348c26f7b57affae6911d6f5cf197ad5d46750ef2fedfb000b46c55
MD5 0b57253aa971870104385858a8b22221
SHA1 361cf46618cbaa8fd0a050c4e97c1395cd6fc20c
SHA512 5bbceaba8a31f3f6dd7278b3ea50fd7969677a079dc32b5aa5201723f70776eea3af8d40fd918c8ea547aa803be2ae828f81cd414b38e3ec34b499d002e0b66e
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QT:acallSllG4ZM7QzMk
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 e928580c2fb2a00e8f184033be1f0e5c48709bc3df573a17528b3e8d395fa814
MD5 ca9c82c138c7e9c1eff8212466a2958c
SHA1 70899f885cedf88a9cbd0f3ea6670d01abfe206f
SHA512 c129c6a69b2ce8e0c70ec0313db1c91727a81c0ff0d1ac4c69b45330f502deb3a52247aaf8908cd0f3c5c0ed18b5e79781be249ac10f4509708a9bad920ecc3e
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QT:acallSllG4ZM7QzMk
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 94f742be6a7b79c0c418e00d9de477db271f8c63656e9464b11b0d26b364fad7
MD5 8dca6c1c911b9c22079f5d4e6b82485b
SHA1 579675852b98c47dacf33c19445c3e1b751719dc
SHA512 04f2f814c56d89e4a785561685c3ad713c104fc90d469bed13cdc424d6bb0934760a06195ce1958225a26e21fd77e766a1f0168e99cfd18b69afd2d2cc2a1caf
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QX:acallSllG4ZM7QzMQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/532-55-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1236-25-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1236-33-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1364-83-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3648-44-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4060-81-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4060-82-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4272-65-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4280-77-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4328-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4328-9-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4984-21-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4984-12-0x0000000000400000-0x000000000055F000-memory.dmp

Download