Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    06/09/2024, 20:29

General

  • Target

    ad14753bd99ca2c16558a7ecd91b5291cbf48e5b23b2b50596d24e7ad8d63cd8.exe

  • Size

    1.1MB

  • MD5

    8b7749318d787392fa03aef03729187c

  • SHA1

    1d92d7d5df694e1a9c1cdeb014d409d71cd2adf2

  • SHA256

    ad14753bd99ca2c16558a7ecd91b5291cbf48e5b23b2b50596d24e7ad8d63cd8

  • SHA512

    dccdf4f52be724590b62cc0e28569c4b1f40cea76930da62c3d103a2d5036807984e7ac8010461bf5aed4b7f1876d07e3b835e43f15e7fa69184de57b5bb8c55

  • SSDEEP

    24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qf:acallSllG4ZM7QzMo

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 33 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 48 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad14753bd99ca2c16558a7ecd91b5291cbf48e5b23b2b50596d24e7ad8d63cd8.exe
    "C:\Users\Admin\AppData\Local\Temp\ad14753bd99ca2c16558a7ecd91b5291cbf48e5b23b2b50596d24e7ad8d63cd8.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        3⤵
        • Deletes itself
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2596
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1516
          • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2884
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:904
              • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2476
                • C:\Windows\SysWOW64\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:2924
              • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2084
                • C:\Windows\SysWOW64\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                  8⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2012
                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:1500
                    • C:\Windows\SysWOW64\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:1732
                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:1584
                    • C:\Windows\SysWOW64\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                      10⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1576
                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:2508
                        • C:\Windows\SysWOW64\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                          12⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:1664
                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            PID:872
                            • C:\Windows\SysWOW64\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                              14⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              PID:2264
                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:2644
                                • C:\Windows\SysWOW64\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                  16⤵
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  PID:2632
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1820
                                    • C:\Windows\SysWOW64\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                      18⤵
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      PID:2948
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2680
                                        • C:\Windows\SysWOW64\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                          20⤵
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          PID:2456
                                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1784
                                            • C:\Windows\SysWOW64\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:796
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2008
                                        • C:\Windows\SysWOW64\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                          20⤵
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          PID:1016
                                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2104
                                            • C:\Windows\SysWOW64\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                              22⤵
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:2408
                                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2508
                                                • C:\Windows\SysWOW64\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                  24⤵
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2384
                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2876
                                                    • C:\Windows\SysWOW64\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                      26⤵
                                                      • Loads dropped DLL
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2436
                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:860
                                                        • C:\Windows\SysWOW64\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                          28⤵
                                                          • Loads dropped DLL
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2584
                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2480
                                                            • C:\Windows\SysWOW64\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                              30⤵
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2500
                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:1140
                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                  32⤵
                                                                  • Loads dropped DLL
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2852
                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:296
                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                      34⤵
                                                                      • Loads dropped DLL
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2448
                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:1012
                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                          36⤵
                                                                          • Loads dropped DLL
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:1924
                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                            "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1648
                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                              38⤵
                                                                              • Loads dropped DLL
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1556
                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:2212
                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                                  40⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2428

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini

    Filesize

    92B

    MD5

    67b9b3e2ded7086f393ebbc36c5e7bca

    SHA1

    e6299d0450b9a92a18cc23b5704a2b475652c790

    SHA256

    44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d

    SHA512

    826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

    Filesize

    753B

    MD5

    3ef2902a6cd218032fd5616372462e9f

    SHA1

    bd1e4005f827ed6e1868fdeb65ee345e997819fc

    SHA256

    f8b4d383d559a61239ab0ba0a822c2a2ba6f45b22f1d1437f5d23e7b617af5f4

    SHA512

    21bc2d1ba8e9749ff07211ec2ad81b3bf8ae7af42d6aa3ae0bb07c5a7711b34f80b8eea1d49b7e7946cd4fb75b3e234664dfaf1e4a1dd6f2edab6591ca284563

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

    Filesize

    696B

    MD5

    6491ffe6ef75436d9e660280f5c7fa8f

    SHA1

    aa563dfffa849153924e8a50f5b562663d1549b5

    SHA256

    61926578340a542bb64c6abd62437790f27fe9f3c91f6e7bc3268fe318333382

    SHA512

    7caf0a3528181a867f6a7d1e705531db6eb12a82faa881fde4693b6d1f57be05e589c9276fc6364204494cd9c65f355a35d1dafb0d02582346057b5c4b8c2193

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

    Filesize

    696B

    MD5

    f2d2f31794455ef80ea8a41b0b218045

    SHA1

    926c4e45922f43c6afc2cb31d96b5b35d4db3cae

    SHA256

    698e3bc7681704e68728030dcceb12377aae02f71e91a5fd15c12b686ba00141

    SHA512

    36cc2c9bd29c6bd97c2bd7eef7b9bffc512ebabf43d089a2866a66efc4f4f3f7d92b2d0719ae61ad07c38b89b1c0a4b59df57f84beef76c88bd376125048d714

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

    Filesize

    696B

    MD5

    840853c0aa5a4d702a8110a0cb763b4b

    SHA1

    58d028e09818c3fd2a9d521c26772cf4d1a9072a

    SHA256

    4438df44bf53668a332407b1c60d745bd1293a3f1acab9953b1d77e5131d2728

    SHA512

    f2b044e4710dadb03164bc78519207bd8d39d2cf9d4568fc11c38271eabc3e57410083b1cf29e40b1f6119ffa33ed4784ef652f112e50b554c2983755a606b6a

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

    Filesize

    696B

    MD5

    f988db0382571319f9b0af53097c2376

    SHA1

    fd83936b61f5d4256a899610d5c13c5a9b24e625

    SHA256

    8557443470cff4b30c533603a8e73dd9b9c55af2bae1ed0a7ce86d860fe4953c

    SHA512

    8f0df896cf7432ac5248f1149a79cc721e40e80dc1ced770f830725c00e64bb96944bbdd375aa25587e0574dba32375934cbf99bf99f33267296c1e605ac8703

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

    Filesize

    696B

    MD5

    f3159db8bd483868144429c5909d280a

    SHA1

    a3698b1ebb0e43a564357bb77c3462539a114f87

    SHA256

    f31b8921a342ba1eecff8852bd1904a17e94e544a1975106b9b5533155ed044c

    SHA512

    328e166bbd706c7e6848c246909d96779ee2efcdf7bdb0ff47eed24e0267dcca005bb41651b60393ffafbb7b7467d94b22454e8c4be57108ffeb6238e88db916

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

    Filesize

    696B

    MD5

    c94fda6716d92036e02a0e70b433735f

    SHA1

    eb4e57b1461e03a201dbfd20dd308ca88694e55d

    SHA256

    ca8d32856a5ad76e2bf41249ee83a498c238f51d9d3addbd5ca456ee6a6108ba

    SHA512

    bf4b3613a4d6d2854f7750a73f84579a3022c2aaae770c392c3d4b273cbb2b493028f8109856ba66ee4636bcfac53b61b7f9b689002858a040b62b47d097d24f

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

    Filesize

    696B

    MD5

    ae75c3a96c26ddc15e3c678434b18374

    SHA1

    7abb4cd173f5c8565c891bc5305922439e880fed

    SHA256

    1b84f073d7c021672b1951a420b183f570b94f4d7c14c86698b22bbd353bf965

    SHA512

    e817ab91d4d73840a290ff2e999a5136328b315afa16ec831b6ddabea08cf07d8dd61b332cbeded13bde712e7c87538228ff8d163c0f659da84134f04e5a3b7e

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

    Filesize

    696B

    MD5

    6e11da1c8a05db963ff0dda7c43866e0

    SHA1

    e1343d4a94a629047631b0c53a0501eace14d2a9

    SHA256

    2605d23ba5b4a9fc117704a99d9351dfffc81f22681becb9aa59d72a64a6a8f6

    SHA512

    74be18fd41e091762e317fd4565c13d36832ca7d8fbcb60631c8e818c25f447db2ed4b3bc20e4a97da5efeb3ab66dbe815f34776b3db338a1e7d41abc57c99ac

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

    Filesize

    696B

    MD5

    73dd42e0ba8cff47f0542d7d8aa40f90

    SHA1

    ffbb1b56415be5abcf4613aed3136768f2edbc38

    SHA256

    c73b4e554a4ae515ae3aa320a19d752e3d848d00ed0cd8f084081ed530b8fc3d

    SHA512

    efd0075f9e70dd557271bdbcd782a083ae2cde8cd5674bf7f8cf63064847951adfcbaa9c9cff91c57d19c7308d0b7bf4754bfbe8fce6ec0e41d920bde7f5a67e

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

    Filesize

    696B

    MD5

    99c82369839776d3d954a85361e76565

    SHA1

    fe01d71a20a80f468e5fa4df991eacca97e650a1

    SHA256

    ecfe1904a389f25b460a8eec64349498fde06733fa12cd5ae8e0c49a9699154f

    SHA512

    5deb6fd1534298cbc80f4653e60b9dcaba6cfd4af1f3b1e5369929472ab4f8cba7d50d3f63d7154170b5ea84f40f7511f1839f2e89340c6942fede255c93b69f

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

    Filesize

    696B

    MD5

    75b8f60cfe6895a93f2d8f1b5568af94

    SHA1

    b80485bc82864b4e1bf0bcc44579eaa01776b1fb

    SHA256

    6ff47f7681e8f497470bd11b2cfd8156c5d8f1b01f48bfd89037cc4bfe0f34cc

    SHA512

    089e237c5309d36058e036f69d78deb4144749e91b3a8a8383f817af051a3452acfdf42227cc721517e93428cfd5d48b42e9750e9548762609e81917a4de29c2

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

    Filesize

    1.1MB

    MD5

    4e2c24462e3e49dbe6ba884911b2e79f

    SHA1

    42a6fca7f5606bfd523449eca459c2cb3d3ea216

    SHA256

    719d2dc0b52b3435b2974a01174535329dec4f7a130a1127a6d6d181d682ec52

    SHA512

    689dc0a33fc815b84c6e08e930cf0dd7f1a19c6f600ff4d545de7a0a6620530c8054c58a800002993c8fe508a72d483ad008b995bfdb9d1a594f9a7d3d38900f

  • memory/296-212-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/860-183-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/860-190-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/872-101-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/904-50-0x0000000004870000-0x00000000049CF000-memory.dmp

    Filesize

    1.4MB

  • memory/1012-213-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/1012-221-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/1140-205-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/1500-71-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/1500-62-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/1584-81-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/1584-74-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/1648-229-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/1648-222-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/1664-93-0x00000000048F0000-0x0000000004A4F000-memory.dmp

    Filesize

    1.4MB

  • memory/1784-156-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/1784-153-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/1820-117-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/1820-123-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2008-145-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2008-141-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2084-52-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2084-59-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2104-161-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2104-164-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2264-10-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2264-0-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2384-174-0x00000000048F0000-0x0000000004A4F000-memory.dmp

    Filesize

    1.4MB

  • memory/2408-165-0x0000000004A10000-0x0000000004B6F000-memory.dmp

    Filesize

    1.4MB

  • memory/2448-214-0x0000000004720000-0x000000000487F000-memory.dmp

    Filesize

    1.4MB

  • memory/2456-148-0x0000000004BF0000-0x0000000004D4F000-memory.dmp

    Filesize

    1.4MB

  • memory/2476-38-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2476-47-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2480-191-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2480-198-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2508-170-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2508-173-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2508-91-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2596-15-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2596-25-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2644-113-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2680-127-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2680-135-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2876-182-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2876-175-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2884-28-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB

  • memory/2884-35-0x0000000000400000-0x000000000055F000-memory.dmp

    Filesize

    1.4MB