| Name | 4b3a000c1416d24e_9710-24515-9690-30722.vbs |
|---|---|
| Filepath | C:\Users\test22\AppData\Local\Temp\9710-24515-9690-30722.vbs |
| Size | 308.0B |
| Type | ASCII text, with CRLF line terminators |
| MD5 | efdcfebf0eb0b4c69915f588a9ac4609 |
| SHA1 | 136f5b10c159718263fc3dd4555d9886e9a85ee7 |
| SHA256 | 4b3a000c1416d24ef2ff27210a788b22fdc9c09110e2e3fe1d021a8b3d2a6f27 |
| CRC32 | 3E0B5BB0 |
| ssdeep | 6:jpN+gig5PmQpD1MgNXOLCY7vfLOL5avJVFYloSiLOLbGGRnidfvfLOLYc:L+tmHMgVO+gO9qrOhEdO5 |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | b7c225ef3cc3e875_d93f411851d7c929.customDestinations-ms~RF134af7.TMP |
|---|---|
| Filepath | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF134af7.TMP |
| Size | 7.8KB |
| Processes | 2888 (powershell.exe) 2980 (powershell.exe) |
| Type | data |
| MD5 | 81ca4510272caf505e8091e9a28cb716 |
| SHA1 | 71414aeec9f1e4a6f5a461b01700cc9cc992cd9e |
| SHA256 | b7c225ef3cc3e87506150eb140e7b9cc127a3469c50a808854acac71a53d98bf |
| CRC32 | FC31E90F |
| ssdeep | 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCwor/47HwxGlUVul:EtCgXoRtCgbHnorLxY |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | c2b6d480ec04ac85_start.lnk |
|---|---|
| Filepath | c:\programdata\start.lnk |
| Size | 1.7KB |
| Processes | 3068 (cscript.exe) 2724 (cmd.exe) |
| Type | MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=0, Archive, ctime=Sat Nov 20 18:24:28 2010, mtime=Sat Nov 20 18:24:28 2010, atime=Sat Nov 20 18:24:28 2010, length=302592, window=hide |
| MD5 | b8392efd184565f52394418a27bc8313 |
| SHA1 | 0dfc536553979fcaa107b05501859a1a60f9b7d0 |
| SHA256 | c2b6d480ec04ac85f7d842fc45c2a96737cfc510de855919f48b995ea428b63c |
| CRC32 | 74FC4C6F |
| ssdeep | 12:8WGr6U0CWwMKVe/KjekM3k4puRfa4jAILW+UcliuPBtvYNWQuqlDm/DmNz4t2YL1:8W6fHVQbk1RNAIq+/0otvYNWG4GBPyx |
| Yara |
|
| VirusTotal | Search for analysis |