Overview

overview

10

Static

static

3

cda8200019...bd.exe

windows7-x64

10

cda8200019...bd.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/03/2024, 09:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    cda8200019a81510328408e8a75949bd.exe

  • Size

    137KB

  • MD5

    cda8200019a81510328408e8a75949bd

  • SHA1

    7db2c6da2dc1ac2608af06b7e262bd5ff0ba59fa

  • SHA256

    d94b482329b31cc52a7262afc09a005b8f3923a719821c7d6febeb477431e1d8

  • SHA512

    9c9602e3d8b0bc656e9c725e59f084bf9f55a7d1cab2b543334abcfde9530570e9edb5b9c3d6a14e87de7fe22cb714f8838ac88fd2395f0353472794e8395351

  • SSDEEP

    3072:IpWC4YgBPlGiyllnpWC4YgBPlGiyllfpWC4YgBPlGiyll6:2WC4YgB9GiyxWC4YgB9GiypWC4YgB9Gu

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 6 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 14 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\cda8200019a81510328408e8a75949bd.exe
    "C:\Users\Admin\AppData\Local\Temp\cda8200019a81510328408e8a75949bd.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2480
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3372
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:1624
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:2268
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1052
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:5024
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2952
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4424
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:4056
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:2916
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3540
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:684
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1504
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4508
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:1956
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:4472
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2176
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3016
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1856
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:3500
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      PID:1160
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2256
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2968
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:4480
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:2592
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4556
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3208
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4952
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2444
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:940
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:3088
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4376
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2512
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4724
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:944
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1780
  • C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    1⤵
      PID:3540
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=3136,i,3192284747741020952,1225278682167953346,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:4444

      Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Replication Through Removable Media

            1
            T1091

            Execution

            Persistence

            Boot or Logon Autostart Execution

            3
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            2
            T1547.004

            Event Triggered Execution

            1
            T1546

            Change Default File Association

            1
            T1546.001

            Privilege Escalation

            Boot or Logon Autostart Execution

            3
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            2
            T1547.004

            Event Triggered Execution

            1
            T1546

            Change Default File Association

            1
            T1546.001

            Defense Evasion

            Hide Artifacts

            2
            T1564

            Hidden Files and Directories

            2
            T1564.001

            Modify Registry

            9
            T1112

            Credential Access

            Discovery

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            1
            T1012

            System Information Discovery

            1
            T1082

            Lateral Movement

            Replication Through Removable Media

            1
            T1091

            Collection

            Command and Control

            Exfiltration

            Impact

            Inhibit System Recovery

            1
            T1490

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
              Filesize

              45KB

              MD5

              e804612b15961a8825c873822da010ac

              SHA1

              894e9fddb3c92bfe7f1265ea82195f6003ba192e

              SHA256

              e84bb382fd761d0301f2178184dda13c4d569c527a7c360fed516c6623739d13

              SHA512

              9078945d4e2fd8b5834e8ef7894dc3e9d2511232537dbee52d007c8f8d8e3386ff3474b9fdd242e72d8816ce414c760dda2bd5beffa32749a630057a1e674427

              Download Submit

            • C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe
              Filesize

              137KB

              MD5

              08d4bbb7db0859116955616f21305592

              SHA1

              ee4c0fb57abe97c7a790a8bfea613f87e8512647

              SHA256

              2e4f9345674fd878deefc912489082064ad3a1f2b9cbeba66e628f5f354ad3c6

              SHA512

              1d91638ac971f117dc980c1342810684b15f4841305f0c70825911cec77bbbf639f5273053540a1f12759c63bd155a8aec91bda84af48bad2b2116341984eff4

              Download Submit

            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
              Filesize

              137KB

              MD5

              26e7d4cb58da3d8aaa1fd2021237056d

              SHA1

              4ba8eba56afad1476e900528308aa0edb07ebd83

              SHA256

              29533a4d65835b46bb9bd6dec9defdca4a53abc3aacd03abec60fda5a0f9b213

              SHA512

              2f7d134baa57fb698e8bf1e7c233034f89efdd05ec8bcf0fd4c5f6fd06c2c0f565cc30296cb64c74bb19e51a32cbc1e0f5041bd0428eaafb1af310e9472fe4d8

              Download Submit

            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
              Filesize

              137KB

              MD5

              f7534c9361d9ca946399a7074d08b734

              SHA1

              50c623d1dc42f58e56720e50aecc09cc07ba2894

              SHA256

              21e1aca71f2180fc34658cdabea10a4b2cebbbfc1bc7726d0b85c9ff71c5609f

              SHA512

              c2cebc0828a42937ab9d64ece2900290946bf004d2c9d2d922c017328efd326fe7949a0d3793ceb97b9ba6cb1b428b42317d8e6d0995ed9871f37e41ba8dad0e

              Download Submit

            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
              Filesize

              137KB

              MD5

              910f2196d56c0b2243e30c74f87f5f65

              SHA1

              d9a7d78bd8116000a5820cc5e859e93b227644bb

              SHA256

              19a16894ce95715069b674f243a18fb2ce0228d7194807817425b9907002f688

              SHA512

              3e4ffb03e4c32e1572e641cf553d1751859fe0cf4186b4d9f0cad29129ca7742e6e38c1f170cdaa84e9c26695be5617ba2f6a1c8f91f779ef6a53164b26a6867

              Download Submit

            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
              Filesize

              137KB

              MD5

              056aea0cf9f2100c39c9f165da9fab58

              SHA1

              5db913084b20624469ca3f2a92a50eeff882d7d8

              SHA256

              ab224e49ca4ce5dd20c2e77c7801741684c87d4d16c1df92297db2c6af17bb50

              SHA512

              c6bd25bd2cbb7be249b4fa7c0178c8400f005cf3ef0828a898690fdeab73db8af36912b8d5f7eb0d778069308b2228fea2dc3e6e413b8a57f6a19ec67692a6e9

              Download Submit

            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
              Filesize

              45KB

              MD5

              276dc17c84c051c856cad3bc5a0a6de2

              SHA1

              1f2c6d59e3f4d54df552695aba1cbe2ed41de6ac

              SHA256

              ceec36775ed47b400eaa7f847fef18be04006c7814ad4b58d71e3a044aba30e4

              SHA512

              ff97b712dc7a264a9149b4896afabd2cac0d58471b5bf5f1b0b1e4f716dd5408eac0ea94a1b5f83fdb4a720e70a03094b72469b970f8c6d8f0b13c4549a23982

              Download Submit

            • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
              Filesize

              42KB

              MD5

              ee5211a5e351cf6a0550c46f500397b8

              SHA1

              e05dbfa13c59e2610194365637b2974f8c6ec5f3

              SHA256

              9d50c511934478603f996221f92979e85578fa7b6ae385b67ef6730cc4c12d36

              SHA512

              e1849a01266a643462118b1bb2bc9074623e66e7a80234661082bf8736fb3bdd41eebff91446cb759fbede9f3179fa95a3ea7fa3e5059e4717392cb02fb29b37

              Download Submit

            • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
              Filesize

              137KB

              MD5

              8455e485b7f9c812310f6b4195b7a83b

              SHA1

              f0843911b493935be9173ff965c4b5d4850faef9

              SHA256

              9ad989c23af18089cf07e58801582230555914c92f6151ce189cecc843f419ad

              SHA512

              cb0d4ddcf9b854537c492afbe09f1aff5bd0adc68838cc9318abc4144254fece4fa92e937ee3af39446a72b2d650cebe511e0da81c7eb6094a904ed8359ac79d

              Download Submit

            • C:\Windows\MSVBVM60.DLL
              Filesize

              1.4MB

              MD5

              25f62c02619174b35851b0e0455b3d94

              SHA1

              4e8ee85157f1769f6e3f61c0acbe59072209da71

              SHA256

              898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

              SHA512

              f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

              Download Submit

            • C:\Windows\SysWOW64\IExplorer.exe
              Filesize

              137KB

              MD5

              84b6c9eebbf9b01c888158ceb60e77f3

              SHA1

              d448420ec80177c0edcbe5d720d58edee174c434

              SHA256

              488caa0854ebd99545b7a26dc78c8f4dbbf1578ae321dd53d2123c095fb07000

              SHA512

              938da9b4b8998e3d56a0a32d56f5f745efd95f45bd8bb293c4d2b4ff0306fc6ef1b0826e24631f0d9e91f6bd12eb9f23551fda167ed733c11cb239259e89d24c

              Download Submit

            • C:\Windows\SysWOW64\shell.exe
              Filesize

              128KB

              MD5

              9561255ba8e28c3c904e4cfb5ae5b09f

              SHA1

              8f2b15768f02be44b7803f674da8df2c946ac2c9

              SHA256

              0bf836d9f8e1abbb50dcfe9c73050f2c3699d976838ae6eeab83058d4ea6a3aa

              SHA512

              65399f9a67ad584a783f71903d909e0088255e0b59b2466d562dd4ba5902f54bcf13d795bbaa202f5c6bf196c6011725ad8d574f9f70a55442ae1d33260415a6

              Download Submit

            • C:\Windows\SysWOW64\shell.exe
              Filesize

              64KB

              MD5

              9e2bd2d7e52d3588b3e7a58612994633

              SHA1

              e3587ad13c3faa3ce8113ca444c3aeae9ebbbe65

              SHA256

              e81b2e9d9345b5a29948b9bb5c0003a8756185fd37f3a80bedebb85e803cbf33

              SHA512

              4aa67417e672df8f0da76bf2e351a8f62767adeed612f34aefb65305e70bdc90aa5b2c846ad00fb607aed8fc9b1c117641e1f859451e038faab18bfcdd66fcb0

              Download Submit

            • C:\Windows\SysWOW64\shell.exe
              Filesize

              137KB

              MD5

              cda8200019a81510328408e8a75949bd

              SHA1

              7db2c6da2dc1ac2608af06b7e262bd5ff0ba59fa

              SHA256

              d94b482329b31cc52a7262afc09a005b8f3923a719821c7d6febeb477431e1d8

              SHA512

              9c9602e3d8b0bc656e9c725e59f084bf9f55a7d1cab2b543334abcfde9530570e9edb5b9c3d6a14e87de7fe22cb714f8838ac88fd2395f0353472794e8395351

              Download Submit

            • C:\Windows\SysWOW64\tiwi.scr
              Filesize

              137KB

              MD5

              389ff457abe840abc7a97ee65eeb49c9

              SHA1

              2733fbda3fcda425aecbe43b6094f790d05b5f42

              SHA256

              30072934e0fb1086464deeca5cd8f9e4c7322e1635326181b5174119e4b20d3e

              SHA512

              48935454a1ae891c94da115c74cf3b3c63ef7ec256155fa511ac0649226e93a22672c6ecf80683a1c525c73394324670d7857926c80e4d0806af0516d949b40e

              Download Submit

            • C:\Windows\tiwi.exe
              Filesize

              137KB

              MD5

              1f2470b399ca0ad46e6e3b9cb435c44c

              SHA1

              f421268154bc60a8f05b1c4ff952dee8e4d0eb26

              SHA256

              e41bead1395bc640a42c1990d7d1597f08b85400d4768953f0a98ee3e4892236

              SHA512

              2ef105a6cbd446068000b07a358c8371463c12fb9acc7e1c7d68fc1ad6002073be91481263b34040206f41f534fa808e7141a444cc963d5ee5449a6849d35ac3

              Download Submit

            • C:\present.txt
              Filesize

              729B

              MD5

              8e3c734e8dd87d639fb51500d42694b5

              SHA1

              f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

              SHA256

              574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

              SHA512

              06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

              Download Submit

            • C:\tiwi.exe
              Filesize

              137KB

              MD5

              42f85737fa0998102a6bbaef623b6c8e

              SHA1

              0a3a6f9d8c1812f6fbf53c275757d8ea1f60e018

              SHA256

              256621c3e7e542216ee1b5cfdf987fc4061e3febd0d7c406a376fa91012f5640

              SHA512

              53576e184ed5d6af438bbf42d4997a825780407812f19c29c115bf6312bb492fdd27d0cb458756d108c9dff8a74e828878e0e9a7d348634e02f26abc7825ad9d

              Download Submit

            • F:\autorun.inf
              Filesize

              39B

              MD5

              415c421ba7ae46e77bdee3a681ecc156

              SHA1

              b0db5782b7688716d6fc83f7e650ffe1143201b7

              SHA256

              e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

              SHA512

              dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

              Download Submit

            • memory/684-314-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/940-424-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/944-383-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/1052-297-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/1160-189-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/1160-174-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/1504-345-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/1624-270-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/1780-386-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/1780-392-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/1856-319-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/1956-273-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/1956-262-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/2176-295-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/2176-290-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/2256-259-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/2268-283-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/2444-444-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/2444-296-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/2444-396-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/2480-0-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/2480-271-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/2480-393-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/2512-436-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/2592-394-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/2952-321-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/2968-443-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/2968-268-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/2968-320-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/3016-302-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/3016-311-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/3088-430-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/3208-421-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/3372-95-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/3372-440-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/3372-284-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/3500-173-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/3540-307-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/3540-300-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4056-282-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4376-433-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4424-441-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4424-289-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4424-101-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4472-281-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4480-382-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4480-387-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4508-109-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4508-442-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4508-294-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4556-403-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4724-439-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/4952-429-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/5024-310-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download

            • memory/5024-304-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

              Download