Overview

overview

10

Static

static

10

d8c2a82c7d...12.exe

windows7-x64

10

d8c2a82c7d...12.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    17-06-2024 02:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d8c2a82c7d77e8b1dd9b831cc461d075d900153daa9682a5ffc480130f96dc12.exe

  • Size

    147KB

  • MD5

    c5a3588560d77a3db1da483df905b7d1

  • SHA1

    212fa66e44e2997552e88b492323d38f2f3f7ec6

  • SHA256

    d8c2a82c7d77e8b1dd9b831cc461d075d900153daa9682a5ffc480130f96dc12

  • SHA512

    046cf927424efb05a54160fe7de46faf81f5f153186a15148a8241cc06de946f138d90cf884b7145a1e64787b9f5429ce7231de3299770edab4bcf41946ae212

  • SSDEEP

    1536:oWwaMcKOER0m9mwWjAggupnhycpDnq+5h/tDSZ15WwdAx:pzKR0xwW0WnhFpDRzSZaCAx

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 14 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 7 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 7 IoCs
    evasion
  • Detects executables packed with MEW 22 IoCs
  • Disables RegEdit via registry modification 7 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 7 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 46 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 28 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 21 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 50 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 6 IoCs
  • Modifies Control Panel 49 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 21 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 7 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 47 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 14 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\d8c2a82c7d77e8b1dd9b831cc461d075d900153daa9682a5ffc480130f96dc12.exe
    "C:\Users\Admin\AppData\Local\Temp\d8c2a82c7d77e8b1dd9b831cc461d075d900153daa9682a5ffc480130f96dc12.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2500
    • C:\Windows\babon.exe
      C:\Windows\babon.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1596
      • C:\Windows\babon.exe
        C:\Windows\babon.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2136
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:324
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:988
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1100
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1500
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 372
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:3004
        • C:\Windows\SysWOW64\Shell.exe
          "C:\Windows\system32\Shell.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          PID:2488
        • C:\Windows\SysWOW64\Shell.exe
          "C:\Windows\system32\Shell.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          PID:2664
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2404
      • C:\Windows\babon.exe
        C:\Windows\babon.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2280
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:2864
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1796
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2936
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2676
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 380
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2324
        • C:\Windows\SysWOW64\Shell.exe
          "C:\Windows\system32\Shell.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          PID:2468
        • C:\Windows\SysWOW64\Shell.exe
          "C:\Windows\system32\Shell.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          PID:2132
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2660
      • C:\Windows\babon.exe
        C:\Windows\babon.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2256
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:944
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2892
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2608
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2444
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 352
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2704
        • C:\Windows\SysWOW64\Shell.exe
          "C:\Windows\system32\Shell.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Disables RegEdit via registry modification
          • Disables cmd.exe use via registry modification
          • Executes dropped EXE
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Enumerates connected drives
          • Modifies WinLogon
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies Control Panel
          • Modifies Internet Explorer settings
          • Modifies Internet Explorer start page
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:2492
          • C:\Windows\babon.exe
            C:\Windows\babon.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:1004
          • C:\Windows\SysWOW64\IExplorer.exe
            C:\Windows\system32\IExplorer.exe
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Suspicious use of SetWindowsHookEx
            PID:1008
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:1904
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2768
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2184
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 400
            5⤵
            • Program crash
            PID:1268
            • C:\Windows\SysWOW64\Shell.exe
              "C:\Windows\system32\Shell.exe"
              6⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Suspicious use of SetWindowsHookEx
              PID:2456
            • C:\Windows\SysWOW64\Shell.exe
              "C:\Windows\system32\Shell.exe"
              6⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Suspicious use of SetWindowsHookEx
              PID:2796
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1884
      • C:\Windows\babon.exe
        C:\Windows\babon.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2932
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:1728
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2452
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2588
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2328
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 388
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2516
        • C:\Windows\SysWOW64\Shell.exe
          "C:\Windows\system32\Shell.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          PID:2772
        • C:\Windows\SysWOW64\Shell.exe
          "C:\Windows\system32\Shell.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          PID:1876
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2308
      • C:\Windows\babon.exe
        C:\Windows\babon.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2992
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:1532
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2840
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\csrss.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2472
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2344
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 356
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2432
        • C:\Windows\SysWOW64\Shell.exe
          "C:\Windows\system32\Shell.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          PID:2740
        • C:\Windows\SysWOW64\Shell.exe
          "C:\Windows\system32\Shell.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\lsass.exe
    Filesize

    147KB

    MD5

    c5a3588560d77a3db1da483df905b7d1

    SHA1

    212fa66e44e2997552e88b492323d38f2f3f7ec6

    SHA256

    d8c2a82c7d77e8b1dd9b831cc461d075d900153daa9682a5ffc480130f96dc12

    SHA512

    046cf927424efb05a54160fe7de46faf81f5f153186a15148a8241cc06de946f138d90cf884b7145a1e64787b9f5429ce7231de3299770edab4bcf41946ae212

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe
    Filesize

    147KB

    MD5

    70e9aff82220c6da83983188e790b794

    SHA1

    43b28c1cd1cb352cb55b58e8b404383afd196914

    SHA256

    56fe5e832f1444396b28033b05b2e4bedbfb5e24e62252a3b55d723c8c695caa

    SHA512

    9583ef15219f5492efe8844f567e90612e045eda3fab5c854d0653611e5e280d6e6c8d8045d265e58029138a5134a95f72e7147e5a83e7e91b5ca1e25973551f

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe
    Filesize

    147KB

    MD5

    bdbe60a5c48a25f151e9f3d1f5b44261

    SHA1

    4697561c30a4de584b9540725ca3ec7d6e3cca0f

    SHA256

    c7eedac27e267db81adfb77cd267b1f0a45e9478675e10ea35273f80266ebe64

    SHA512

    e24fb08f932bc0fce30ecb28b32e31a7b0f9084be8f87a930e88b1064f5b12582e1e5c811e2c0c0efbdb812f9f01f9c165c1cc5e501c3c780b4095b42869ab03

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    147KB

    MD5

    58c6b8c0f663815be90f685193733953

    SHA1

    99bcb5f553e55be5aca582a8f5df5e13cf70a3fa

    SHA256

    aec4639c2938804c372f31fb0f8f636a9121d89ac5bdca950645c4b5f525e977

    SHA512

    ee8c8097ba674deea6ee57d2790a5eec0030d9e19c8f2646d58327e63593cbb8e25cca096ba13666c7764291145472e326845c8fd0cd08b4135b8f6302232f35

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    147KB

    MD5

    6de48f5a6a61a51f2d7e92e700bc31d3

    SHA1

    a6432252d1aed5bfd15aaabb61789176335fbe9e

    SHA256

    268497966315f457b79766854cd3ad240e04fc4f0f50be2b96f00b0391664c27

    SHA512

    2fd3045eb7c29c58d728b668ba0132418192ffbf32708fb00f8b4bed0ce93fb131ebdb75c6649b9c4a40e867c37dab79eee0fd40ec2f3c27e41d8ade670d46ce

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    147KB

    MD5

    799afb740aa83882f4e79801400b0d25

    SHA1

    4e93ffa4f9fd6b74f8918a87785d7805627f5fa6

    SHA256

    a89c58e0b7800ba333412ba9f6918fa6e57894cdf6241d799abc849ff7709029

    SHA512

    a00009efa74c5ea98f9909de8c10d01483d559c45503b60505b113855054a11bcbe7087c7930ab2412de68d87f650195ca8cc8c61b57ba11c371b4512c057a9b

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\babon.scr
    Filesize

    147KB

    MD5

    11d764f1b2986c3753e51f5b95277283

    SHA1

    3919a24553bf750e6dd3064ff9454ac7bfbedef7

    SHA256

    41bfa0132240af489db5e61568641c6ddc4ab8d01e308ced2808fe33fe580e76

    SHA512

    c810493bfa5d8ac6abb06a539f1d54de4e41da27d3df044e762c42a83107d173cd5b5269fdd5e8e41972538f8ee808bebb3ec35f1a0be5e0211352a318a0a023

    Download Submit

  • C:\Windows\SysWOW64\babon.scr
    Filesize

    147KB

    MD5

    1b3b71345a28cd3f4fa0af4d9aa89186

    SHA1

    3cee0e856604e5517bc356a0e0f7146904c1b03a

    SHA256

    9de28f5e93bde74a2029c6279c334da35b71ec62691a05eab0515b69561fe929

    SHA512

    dcd1e0afff0ba3cf6d80b854db1d31246f70f245335a991cf4c346bffbfc7a790f6ca0b508c8756cdc817578ec575c254e25d8d78d85d705599e2eec7feb4d4f

    Download Submit

  • C:\Windows\SysWOW64\babon.scr
    Filesize

    147KB

    MD5

    7ae4e2ba7386553f17d7a35252a344b9

    SHA1

    288f7d0749c4133c88a0c5382664cd53bb2a8a56

    SHA256

    d8f80f9c8233f092d0c069e3930136324b154125c0de1eea9a43485029d0a015

    SHA512

    b479ddabf77ab14947f014259a079e7155c32915216a6869a8781e90278e2acea27507836be944fe05f209b8a14e4ab72645963fc0d4cf626d8e92acd105a3d0

    Download Submit

  • C:\Windows\SysWOW64\babon.scr
    Filesize

    147KB

    MD5

    794b79b51cb35b9200c99da535b4649f

    SHA1

    6db0a0ea9e85f270f93d24aa9734c6ab80c07d81

    SHA256

    fc6e8b38e89fdaaf80b5952ab2528753174e51fc65ba8653b5de6a05fc639398

    SHA512

    762c6197ead17f9bcbb066421eb06e64b7c05e1eb5676e62b78ebd74e85d0d3ed84d36344d9abce8cb7b1ebb05796cd963e01983749d086aee4e7fa039d3a597

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    147KB

    MD5

    9c7487bec6bd7532e7e58784673d05d4

    SHA1

    75ddfb9de4003a3f15e87627e58f1eb7d429ad47

    SHA256

    d9aa1d3395682a6f365db6b985cc97a37be8d34de46fa29967783420db236a26

    SHA512

    3f66b66438fa3c3f90e22e37150e0121093cc8574adf967d487e1671d223a6eb1ff8ae026cd3677706dc1d5c8655d0959b12aacebfd8fa67a73be0ab826fd1bd

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    147KB

    MD5

    f31275ef82d305ac849203a4366613ae

    SHA1

    52dcaaa189aba50ee18d976e0a3a2a61ba56cb6a

    SHA256

    69af9b9f2c1f2a17732a1ee0a7728272de68168327fb791bf404d08cbb117628

    SHA512

    78a0a0c69f8e9810d0d4197596a2d5704f3e290ce7b92c11c34af8b2e67c04b2343c96bc87a80f1fad29683f8e82bb4013675b72a73528e58d65ccb6126dbef9

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    147KB

    MD5

    67c71f5f61d0a318dbd867656c768dac

    SHA1

    88751c49207ad745f1a591366d4b743bf0106ff0

    SHA256

    8a603049f2f3f5fb3ed3555c9af194ee61a47219679cfe860277ba540ae4208b

    SHA512

    f409e31ad97742e76f7f9ea7c45449cc44a07f7a3c7bac666a15b4fe8f4769217816c7a9e664869330bb3a55bd5305ac18a7d0a6369dbbca578dc9c2da0b2e84

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    147KB

    MD5

    ac1bd921d171399d9e51326e1d0a491b

    SHA1

    a9a5b172c94ed31c71568a2d77b96bbc2f528976

    SHA256

    68d39ffcd2149c82e71b952d67b78b6a76dda84fa8d1bc0fbcc4e9d4bc159acc

    SHA512

    6ae55fec40d115e0529c3a87c4db1457246c123f00ae33a9d1b0f9753627d8763308e4994eb690ed2ffafd46510f525187b250b99abb119b2ea7795a344b92d5

    Download Submit

  • C:\Windows\babon.exe
    Filesize

    147KB

    MD5

    614831aaee28de1282f295d4142dbd4d

    SHA1

    cd05c785392c916173deeb14939fb2278b942aa6

    SHA256

    a44beedc52f3963a31591d36ee83e7dd35152efb8f32540c02869eed47f11cc0

    SHA512

    ecd2f788dc76d849ec3f0a8b16387d86dbf0c7d4dfbca2a7fbe05a1a532d5d3d47a1e3209cf456dc3c864d6ac761f79c13bcd773168567b77352a523c20f52cd

    Download Submit

  • C:\babon.exe
    Filesize

    147KB

    MD5

    8c7495655e2172e2586bd6ed99e2f59a

    SHA1

    a7d5d9930c7c6cfd0f65051d03e3de3b4d7dfda5

    SHA256

    117431a62f5c22e7b4f64d04c380c1a7e67d5d6e3c8b6ed7b0c17e917988d13b

    SHA512

    5c3e076f1e7ed8580cc5b532e1e656febf78b58518ad4555be99221c076f260b89efee9e92298a654e6fbff5c45f2350454838c676f0fcb05e0cb4e28bd3702c

    Download Submit

  • C:\babon.exe
    Filesize

    147KB

    MD5

    2c5f19a2420bf9a1127dfc660b829649

    SHA1

    7d65768260c96a4a8a2ae0fd35d355cb26a579c0

    SHA256

    db7b7ab030617ac99eaa2f245e252581d85186a8a214de74fdb7db1922aa9091

    SHA512

    b465b9adbad925baf65e071d9d9b7912c17935f65e464b472eceb5ab3beffb9f5b06231952f0acecdd5a46412394313f43396f70e364bd537c1f569ff6693e05

    Download Submit

  • C:\babon.exe
    Filesize

    147KB

    MD5

    6894c9a196f7a362898c73a785575e11

    SHA1

    a1f3dffc69073e82fa9020deecd9072792adfb3f

    SHA256

    32f91f454cd5d81f79c1934b1ce22279d2801eb64973f8ec557be9baf5184b84

    SHA512

    b3f0117657d431810eb15095a12bcc680f3d3aad99fe88d16cac11bc75afe9429f8c1cedf6f9fcc40bd6ecab1f2d8b3a2b6c7e6eff384756248414e8a2aeb1a2

    Download Submit

  • C:\wangsit.txt
    Filesize

    359B

    MD5

    df2f3e6971a7548c1688706f9a9798a8

    SHA1

    e38539857523a1e7eb3aa857e017bf6461b16a08

    SHA256

    1fd0a101a74c19c0c9e287eac64ee506df3eebdbc11f12022dda94fedd123918

    SHA512

    d2d41257135381d7f4c4936139282a505094af7a8f9bc824ccc08d09da9ab010b6adf1460feacf5c0151cb9d4299b8bde934fd90904bb3c3ce6c396af449c072

    Download Submit

  • F:\autorun.inf
    Filesize

    41B

    MD5

    097661e74e667ec2329bc274acb87b0d

    SHA1

    91c68a6089af2f61035e2e5f2a8da8c908dc93ed

    SHA256

    aab4cf640f2520966a0aac31af8d1b819eea28736c6b103db16b07c3188ec6c0

    SHA512

    e90e678526270cd9388538246793534411c478b082ab914bfe2756b18771229f146c731c0f9c94ed59d8689b2ef77d25f7b22d3d6b8c2d439e5b3437f8dc649e

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\csrss.exe
    Filesize

    147KB

    MD5

    0fa767df37dcd675d44c0c6f4eeb2772

    SHA1

    f9e1af08b1eaa197b0d23a867751431a9176fd4b

    SHA256

    657212a2bb5d02ba09896d901d169fa1f5508f24683eddd3338260b5dcef0784

    SHA512

    b7df42f065f36767c7ec61c82745cb6123c578dcea5eba8e32303b284eaa823214b6ab55743401d7fff0266f3a0257940d63546d7ce1bb7246df54b0050cd8c6

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    147KB

    MD5

    0473991d7d04b1a79c68d43387891098

    SHA1

    e1c7f0dbae1eaa061653abe998bead91c9253f07

    SHA256

    9d1c9a147060e7424eea89f595bd1dc958797212d3b177b548665029925e5df2

    SHA512

    05c6232252ffd7c0705f6e5b6b0318c024721af58febd59a54b86b2cd2dec10661497b2650ac6e28d9fdde629eb4373d71c4390370b71f4932a1387bb4517b65

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    147KB

    MD5

    07370646e3ff68ce552a4bd37389263c

    SHA1

    ec10ac9e6a64f0853ad21314cfc909bc299ce095

    SHA256

    67c1db1ccd8dca37bb3d5bf59b1253edfcc4a95dc0e32cf98067cdbf3d723e64

    SHA512

    fe8cf726f56c68aa2bb5d081e660b2e24fc99dbc404c71a6db84ee8336deab3a9761d4c3e052516b5bb7e569bd0785a084746a7b471e86185094c999269771c3

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    147KB

    MD5

    c9a35816103cd83d6deb4c10d333e84f

    SHA1

    0f7f12eda62eb6f3a24ab931c5ac93e112362bff

    SHA256

    c52ea91a19bc7d1583b85a73fc45e91cdf7a3678ee1feb445988e6ec2c70b3db

    SHA512

    1e3990e25414174e6d7480c05e2a4b269bc1342807564c0725d9a2617cccc58c902cc93397d427ff3bc6df0c3136470b8020a3236a96683d3711ab1eba01002b

    Download Submit

  • memory/1004-411-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2136-209-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2256-291-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2280-245-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2864-255-0x0000000000300000-0x0000000000310000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2864-254-0x0000000000300000-0x0000000000310000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2932-321-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2936-329-0x00000000002A0000-0x00000000002B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2936-330-0x00000000002A0000-0x00000000002B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2992-326-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download