4c6e3040d0830419bbd71eab76dbfdfed3a7d7725767abecc925bc9386437192

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c6e3040d0830419bbd71eab76dbfdfed3a7d7725767abecc925bc9386437192.exe
Size

1.1MB
MD5

af79f57a7ba2da15c0501e3b3e4081ab
SHA1

b16a393c30f792c9d50e754907c6f4805dab7102
SHA256

4c6e3040d0830419bbd71eab76dbfdfed3a7d7725767abecc925bc9386437192
SHA512

677a1b6fe577bdeb75140f1098a3600a52ae6631806b2e214d6ab9ba85c7d231c6fad02c589e6ddbd1266f60ec1ad43bbabe4a09f2f494ef080d97185c1b1eff
SSDEEP

24576:CH0dl8myX9Bg42QoXFkrzkmmlSgRDko0lG4Z8r7Qfbkiu5Q5:CcaClSFlG4ZM7QzM6

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2996	svchcst.exe

Executes dropped EXE 10 IoCs

pid	Process
2996	svchcst.exe
2984	svchcst.exe
1100	svchcst.exe
2224	svchcst.exe
2868	svchcst.exe
1928	svchcst.exe
2380	svchcst.exe
1964	svchcst.exe
2556	svchcst.exe
2548	svchcst.exe

Loads dropped DLL 16 IoCs

pid	Process
2032	WScript.exe
2892	WScript.exe
2892	WScript.exe
2032	WScript.exe
2836	WScript.exe
1684	WScript.exe
2068	WScript.exe
336	WScript.exe
336	WScript.exe
336	WScript.exe
3004	WScript.exe
3004	WScript.exe
3024	WScript.exe
3024	WScript.exe
2816	WScript.exe
2816	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c6e3040d0830419bbd71eab76dbfdfed3a7d7725767abecc925bc9386437192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2324	4c6e3040d0830419bbd71eab76dbfdfed3a7d7725767abecc925bc9386437192.exe
2324	4c6e3040d0830419bbd71eab76dbfdfed3a7d7725767abecc925bc9386437192.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe
2996	svchcst.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2324	4c6e3040d0830419bbd71eab76dbfdfed3a7d7725767abecc925bc9386437192.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
2324	4c6e3040d0830419bbd71eab76dbfdfed3a7d7725767abecc925bc9386437192.exe
2324	4c6e3040d0830419bbd71eab76dbfdfed3a7d7725767abecc925bc9386437192.exe
2996	svchcst.exe
2996	svchcst.exe
2984	svchcst.exe
2984	svchcst.exe
1100	svchcst.exe
1100	svchcst.exe
2224	svchcst.exe
2224	svchcst.exe
2868	svchcst.exe
2868	svchcst.exe
1928	svchcst.exe
1928	svchcst.exe
2380	svchcst.exe
2380	svchcst.exe
1964	svchcst.exe
1964	svchcst.exe
2556	svchcst.exe
2556	svchcst.exe
2548	svchcst.exe
2548	svchcst.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2892	2324	4c6e3040d0830419bbd71eab76dbfdfed3a7d7725767abecc925bc9386437192.exe	31
PID 2324 wrote to memory of 2892	2324	4c6e3040d0830419bbd71eab76dbfdfed3a7d7725767abecc925bc9386437192.exe	31
PID 2324 wrote to memory of 2892	2324	4c6e3040d0830419bbd71eab76dbfdfed3a7d7725767abecc925bc9386437192.exe	31
PID 2324 wrote to memory of 2892	2324	4c6e3040d0830419bbd71eab76dbfdfed3a7d7725767abecc925bc9386437192.exe	31
PID 2324 wrote to memory of 2032	2324	4c6e3040d0830419bbd71eab76dbfdfed3a7d7725767abecc925bc9386437192.exe	32
PID 2324 wrote to memory of 2032	2324	4c6e3040d0830419bbd71eab76dbfdfed3a7d7725767abecc925bc9386437192.exe	32
PID 2324 wrote to memory of 2032	2324	4c6e3040d0830419bbd71eab76dbfdfed3a7d7725767abecc925bc9386437192.exe	32
PID 2324 wrote to memory of 2032	2324	4c6e3040d0830419bbd71eab76dbfdfed3a7d7725767abecc925bc9386437192.exe	32
PID 2892 wrote to memory of 2996	2892	WScript.exe	35
PID 2892 wrote to memory of 2996	2892	WScript.exe	35
PID 2892 wrote to memory of 2996	2892	WScript.exe	35
PID 2892 wrote to memory of 2996	2892	WScript.exe	35
PID 2032 wrote to memory of 2984	2032	WScript.exe	34
PID 2032 wrote to memory of 2984	2032	WScript.exe	34
PID 2032 wrote to memory of 2984	2032	WScript.exe	34
PID 2032 wrote to memory of 2984	2032	WScript.exe	34
PID 2984 wrote to memory of 2836	2984	svchcst.exe	36
PID 2984 wrote to memory of 2836	2984	svchcst.exe	36
PID 2984 wrote to memory of 2836	2984	svchcst.exe	36
PID 2984 wrote to memory of 2836	2984	svchcst.exe	36
PID 2836 wrote to memory of 1100	2836	WScript.exe	37
PID 2836 wrote to memory of 1100	2836	WScript.exe	37
PID 2836 wrote to memory of 1100	2836	WScript.exe	37
PID 2836 wrote to memory of 1100	2836	WScript.exe	37
PID 1100 wrote to memory of 1684	1100	svchcst.exe	38
PID 1100 wrote to memory of 1684	1100	svchcst.exe	38
PID 1100 wrote to memory of 1684	1100	svchcst.exe	38
PID 1100 wrote to memory of 1684	1100	svchcst.exe	38
PID 1684 wrote to memory of 2224	1684	WScript.exe	39
PID 1684 wrote to memory of 2224	1684	WScript.exe	39
PID 1684 wrote to memory of 2224	1684	WScript.exe	39
PID 1684 wrote to memory of 2224	1684	WScript.exe	39
PID 2224 wrote to memory of 2068	2224	svchcst.exe	40
PID 2224 wrote to memory of 2068	2224	svchcst.exe	40
PID 2224 wrote to memory of 2068	2224	svchcst.exe	40
PID 2224 wrote to memory of 2068	2224	svchcst.exe	40
PID 2068 wrote to memory of 2868	2068	WScript.exe	41
PID 2068 wrote to memory of 2868	2068	WScript.exe	41
PID 2068 wrote to memory of 2868	2068	WScript.exe	41
PID 2068 wrote to memory of 2868	2068	WScript.exe	41
PID 2868 wrote to memory of 336	2868	svchcst.exe	42
PID 2868 wrote to memory of 336	2868	svchcst.exe	42
PID 2868 wrote to memory of 336	2868	svchcst.exe	42
PID 2868 wrote to memory of 336	2868	svchcst.exe	42
PID 336 wrote to memory of 1928	336	WScript.exe	43
PID 336 wrote to memory of 1928	336	WScript.exe	43
PID 336 wrote to memory of 1928	336	WScript.exe	43
PID 336 wrote to memory of 1928	336	WScript.exe	43
PID 1928 wrote to memory of 952	1928	svchcst.exe	44
PID 1928 wrote to memory of 952	1928	svchcst.exe	44
PID 1928 wrote to memory of 952	1928	svchcst.exe	44
PID 1928 wrote to memory of 952	1928	svchcst.exe	44
PID 336 wrote to memory of 2380	336	WScript.exe	45
PID 336 wrote to memory of 2380	336	WScript.exe	45
PID 336 wrote to memory of 2380	336	WScript.exe	45
PID 336 wrote to memory of 2380	336	WScript.exe	45
PID 2380 wrote to memory of 3004	2380	svchcst.exe	46
PID 2380 wrote to memory of 3004	2380	svchcst.exe	46
PID 2380 wrote to memory of 3004	2380	svchcst.exe	46
PID 2380 wrote to memory of 3004	2380	svchcst.exe	46
PID 3004 wrote to memory of 1964	3004	WScript.exe	47
PID 3004 wrote to memory of 1964	3004	WScript.exe	47
PID 3004 wrote to memory of 1964	3004	WScript.exe	47
PID 3004 wrote to memory of 1964	3004	WScript.exe	47

C:\Users\Admin\AppData\Local\Temp\4c6e3040d0830419bbd71eab76dbfdfed3a7d7725767abecc925bc9386437192.exe
"C:\Users\Admin\AppData\Local\Temp\4c6e3040d0830419bbd71eab76dbfdfed3a7d7725767abecc925bc9386437192.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2996
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2836
    - - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1100
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1684
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        8⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        10⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:336
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1928
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:952
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2380
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        12⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1964
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        14⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2816
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2556
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        14⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3024
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini

Filesize
92B

MD5
67b9b3e2ded7086f393ebbc36c5e7bca

SHA1
e6299d0450b9a92a18cc23b5704a2b475652c790

SHA256
44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d

SHA512
826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
696B

MD5
3f88ed4a802ff96db44e34ad53ac06c2

SHA1
446fe4e265af02ea012b5a8d5d0e7a0c9867f1ed

SHA256
04a5abb92c689fa7b9d768a067b1d9bd16c0a5d856c67c7f7881d62662ae0911

SHA512
f1afaf53ee96969d58902836b841ca7feed9769c81d9b2d63b72db5d7cf04d6a659b50869f8dba0d650aa6833d892261c0c3dd918e8bfbed13237e6333c47fdf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
753B

MD5
dd637af32153b4fe00f6aa94a3f9c145

SHA1
171b1befbb50e59394eeacba3c1d33e59e7dc2ab

SHA256
39f9219a534375ba6971f46b0c4d6c33da66a2961c9b6e8af012b104704e0e27

SHA512
852f3a620a9ba7cb71b4faee24dd1d073b9103a89d8f409b4811ca77136c51344e63424458a328878fbf58da3e2cb3531c47014e6322c4e18f400a8f444c9b30

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
696B

MD5
2af86d83545125b952334759f8554ae3

SHA1
ddfef7be6fbd8d8185c772a9a78eb18617a9637b

SHA256
7dd3660d7e87e64f451b4d1882d07c1733ce38d828770910453cc1b7f457d11d

SHA512
38d2854f941ff77a2fec871ba6513df9862fe4f86778b22053b4c3e25995b192f4ab943051a2c613cc3e78d275bc543b0dff09149cb4620e307809d20beae17b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
696B

MD5
10ffe941ac3b45a1b27eaab090d03e3b

SHA1
4f72abac858bc7659692930176f0cd4f18e354f1

SHA256
b2a27182b84ccf59736264c5fc788f96d92a2d3a14fe7c964e0976af00956144

SHA512
638a48fe06a5e0c47e50ac67e0df2d6952e5e39620a585e5fb086d40ff61cff9bee6a6cfda6582c54e216f052dc6ba4ce5d742ae5174a987701701e67dc65544

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
696B

MD5
73dd42e0ba8cff47f0542d7d8aa40f90

SHA1
ffbb1b56415be5abcf4613aed3136768f2edbc38

SHA256
c73b4e554a4ae515ae3aa320a19d752e3d848d00ed0cd8f084081ed530b8fc3d

SHA512
efd0075f9e70dd557271bdbcd782a083ae2cde8cd5674bf7f8cf63064847951adfcbaa9c9cff91c57d19c7308d0b7bf4754bfbe8fce6ec0e41d920bde7f5a67e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
696B

MD5
910e8b4a682865877d5b4c6b32ac2db3

SHA1
7df0ffdcff6b2f1d51878af2ca989990c399c005

SHA256
0eaa114fec2febec98337efcccfbb2863979005935decd44f9cd7db110b33b9f

SHA512
eb3e30e57f8ae59dc62d7c7f6c20296c7105a3fead464229b7b037924a20127266c0f09a6090cdeae4bea0f728f6213b2da67b44c3cd85a662c6b0cdf34c24bb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
696B

MD5
2c6490a42a6a0c40ff0c4e23b3e1aa2f

SHA1
673399038e095a86936267b5014fc7d216ee5c0a

SHA256
4b5b75f23c5d2765bccf9691327947fcdd4e1e17e6da73c1b1c47dab8db99b3d

SHA512
8ffd13c3e9ecd8c522703bf13f839b3925bf3dd0418c33e8b4edc5cd07ca53d76d21e3d8f2e47622d51cc73ac3eed7dd2f7308bb332cde1bd1e6f1cb8f8bb8d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

Filesize
696B

MD5
ae63ded87a90f9812749cac189d07a57

SHA1
5a37ba565ce8c2445ff71f7c3d7adc38cb68627f

SHA256
6251cc562aff44a7222fe555019800d44c515c0319748fae595621d92f5d9236

SHA512
293cf9a753b1456071db8840910ec3ee7a0a00342caeb27a3bf7c150b54e51a22673e8262fd4376bad6c29eff3b3a77c1c47c1e10c49abffaba899b9193d9429

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

Filesize
1.1MB

MD5
41b5433baa598565b8216996bfc95951

SHA1
14f608b4e3ce1cc870088ecd25cca7f16d244542

SHA256
c59bc0b27ffaee7b51000e7c2d546d42686f37725cb3ae547e3a0c06e8a7070d

SHA512
d1faed70f710418c27fdaa81152ee944c722a1989120858d213a2afa71cc0f374d6ceea8ad505fcc3d9b1f015a74b5ba8ae4f0bfb44180ffbccd6a62c4a9c265

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

Filesize
1.1MB

MD5
7bc111036d700c2810420bdb03ad1241

SHA1
ee1cc9143b78eabf9619dc6ef9fa866f7dd97986

SHA256
1da2051868184d61ba429965d03f728f076b22380036892d28d70593897f96f9

SHA512
8573a8007b695aab2ebd863a87addf7055e7520a3beaa8bd07af05de7c306f93de514dd46f3482fc009b2e35b60c408a5eeb41039871f73effcb9309cd3d7fda

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

Filesize
1.1MB

MD5
f6835450fc315634e880e10f840f7a84

SHA1
a158574eeb19cc9ba9ea4de50bec56fc989c7ea1

SHA256
cf97f2a4cede2742f1610373a1a2f6a8b6da4eb6e3958b5dfdb49112d8bbffb7

SHA512
a4b8b2f93062d2f765d8a4142564a0a3770de626dd069c9bcf185450b1b28ca264267b3bcc2507cb5636836d5ea2047a159b81886fa77d2cf84b1be2feab177a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

Filesize
1.1MB

MD5
10a0309ac8b78800a16f7360e003bed5

SHA1
49408ac24b8b97a7432a2e7d6c661443333436c9

SHA256
504c4c62b9d3f952cbc6774baf95dabfff525007bb46df7638b77bceab76ab19

SHA512
0b0a063fe35f2420c5bb0b5e1deaa2788a60e0b23e974eb5f40e1f4f9f4784053111e7e0de960a5cfc1d3f437981eb7b18c6683f6ebf14b423cffc588f8925c3

Download Submit
memory/2324-10-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download