Artfiacts

vbs script, looks like copied from:  https://gist.github.com/wpsmith/6066530
discardScript("C:\Users\user1\AppData\Local\Temp\Sub.eb3.dll")
Function discardScript(execFile)
Set objFSO = CreateObject("Scripting.FileSystemObject")
On Error Resume Next
strScript = Wscript.ScriptFullName
 Do While objFSO.FileExists(execFile)
  If objFSO.FileExists(execFile) Then
     objFSO.DeleteFile(execFile)
  End if
 Loop
 objFSO.DeleteFile(strScript)
End Function

from memory:
username=<name>&getOS=<OS>
\??\Pipe\AsyncAnonPipe.00000440.0000020C.00000001
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
RASTRUCTURE_MSGWND-B6D42D77-09C5-48f6-B1A5-26A59F1D74FF

HTTP/1.1 403 Forbidden
Date: Mon, 23 Apr 2018 20:19:33 GMT
Server: Apache/2.4.7 (Ubuntu)
Content-Length: 424
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

mutex:
230420181251