Overview

overview

10

Static

static

3

babe7bfdc9...0N.exe

windows7-x64

10

babe7bfdc9...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    02-08-2024 16:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    babe7bfdc9a39e618fb957c857bcaf80N.exe

  • Size

    351KB

  • MD5

    babe7bfdc9a39e618fb957c857bcaf80

  • SHA1

    b86a8c81d603f1511e523bab8db0419b8b7a028e

  • SHA256

    302c738e05e78a786a1d6b6fcdbe12ce0c118ca2d64dcc4b4c37a1f8298ab02d

  • SHA512

    5bd6d28722e9534f6d7789f6b8153d334d7970913f92ba6c895925892280455a0d3ddc523bbfe2e3d19da8341124d104aedb1d46dd22d0d2371c600ee05d0127

  • SSDEEP

    6144:V/OZplcYZplx/OZpl7/OZplx/OZplQ/OZplU:V/Mcqx/M7/Mx/MQ/MU

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 38 IoCs
  • Drops file in Windows directory 24 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\babe7bfdc9a39e618fb957c857bcaf80N.exe
    "C:\Users\Admin\AppData\Local\Temp\babe7bfdc9a39e618fb957c857bcaf80N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2064
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2724
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2032
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2188
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:396
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2480
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2096
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2732
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2112
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2432
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:560
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2144
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2884
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2640
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1628
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2616
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1352
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2556
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2172
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2492
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1876
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1972
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:344
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1772
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1412
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3000
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2092
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2808
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2728
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1528
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:520
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2120
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2068
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2828
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2652
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    702db07bfd8e4e075a994472b3c1f6b8

    SHA1

    549593e979fba0751de5d5eb0796219810212fde

    SHA256

    db3989c5c458aa58873887b2231c5e7693af3a7709eea29e7ab98738baa03b9b

    SHA512

    bf49fb4b7d8f3b31747f57ef22f06f40b3ee917d60dec104caf6a2ee7eab28541d823cc8a69f30c56562a3cf2686ac07dea48ab6ddda38c2eaa1e7c9d4e36f2a

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    6b57a1f894579207eeda65da2e2ea71b

    SHA1

    d336df025200b3bbc38edd166e2abbbe3bed35df

    SHA256

    467e31d50863a659da5af86899036f1bb35393c8b96b518da6f2778507177331

    SHA512

    9ffb910a25cbb1eef88f181abb3011275f7e94ec4dcae73d51386419c35c0462e045a82645162d0046ccf534a3a808a12b606fe390c5343278d259906c2814b5

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    6c5ff376f64889d51515f3f5506b2345

    SHA1

    c22870407e36e4781467dbd88f1a68094fafe861

    SHA256

    06811aa06862f95df297851eae653376f8d1199bd9e293e07d54fd6470f877c2

    SHA512

    82d58f39cb534b9fb6fdc87af91714f6c19cdb8117bce4cc956fc8c4c5b833f402c5cc172539e08295f87faac6309cba65ebe33264ea9f3d69fab4d549768ad5

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    f8caabd630fe6179d22ff0b68a1afe69

    SHA1

    64e2f80cb66b277d81246c3b9a481d008d4f4286

    SHA256

    4153b4c2a3ef676d18020dce2e1192b57b48ac66d82f86d1a6348acdb0f56040

    SHA512

    b7337556d3335c4c7d1fc03bc029fb328d4b953052d0451c9d032c911f91b703fd8eb7866a9b8d3628508a361502c1a28130e7a946098b8b23455ac8f03b45be

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    351KB

    MD5

    ab6de9af0bfdd17cc0bb7793f6e25283

    SHA1

    bbd4c99a1008562ff32db03f4577d3b604145948

    SHA256

    c518d16c5daf6c85e617980c50c2bd835d9cb48ddb2ac85b5855e881f01331e3

    SHA512

    c8259680ab01061380148af17d8b80aa84f039d9432210a3b629c750ea6857c9fdc1b9af6e29a92a337deb7b1861a1794bbdd9bf332b1e43ab882df6780fd159

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    351KB

    MD5

    cfdf8c90a55938b73d95334fde61bb3a

    SHA1

    506428341e0d361e199bbd603522a05bf28d7eb6

    SHA256

    da99c663839b2cbe1363a246a132c6f5ccbc743f2b8adb715fe21a9381f95a15

    SHA512

    4a368fcb8e57923fa2f0141da7281ca11f248adf8cb4ff17bc0b3408dc54b385cea7776701797e493fe085389536b309bf05d5cadf43b6c8a5e3f37f0f58417e

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    351KB

    MD5

    77f665457545a435a10a63b8c2de0d8b

    SHA1

    2e640c04a823d43ef66af9fe876bef4f0a5fb9fd

    SHA256

    f86b76f8747e17cec22e925588e2192aa3ec28e32b6197ad290082222bacdde8

    SHA512

    3ee7034417b167dd97667ea5f39bd2506a0a24611902089accdc1836dd88e3171bd8e87bda075c153e472ccfcf08e1c9a1eab2d3cd885c30e6b9b9928f891cc0

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    d87afb3f339c9c0032fae40ea85fde53

    SHA1

    f8c1c6d384f0208098d32ef4ac16e8d01f314681

    SHA256

    f6b909aeed000a2f370441aab9ba4fc10bb65f26ccf3e8826be28cb688b36eb4

    SHA512

    407136b0c28c8848bab89f8b891c85b69bbf1f07f79e7f74894123acbe7362ac798384a6caef17f82fa53c1945432a3da9e446bc83e22f795c05eb3e4404912a

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    5f2f014246f6a9983fdd037984a3b75e

    SHA1

    6ef363dd6973d2706f5246a7fc300a33ee180632

    SHA256

    8ade05bf10846ca2e4e4336b717dda14a963e1b49ff1f7f0985abf756aa9b2d5

    SHA512

    197e332df08c0b82244bec18f86e69cb56660a1a4aa4aa869f3f5251cb5692662761b6e43d08b1533d6073e696118dd92040a7a5bbf9a33608adc7b805917783

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    351KB

    MD5

    f0b48fa4d4d00403a4265535fccea8f8

    SHA1

    6928ad4884c271df1b531bc86f0affa45d7880b2

    SHA256

    deef0de62b1962434d580aa09e4db0f3ef6d3d75a836ba499067a96973c348fa

    SHA512

    1e3907c2c80e0f566e312815059d8b561baa95e7853d05f301e2b70df8df66541982377f8490bee2a89d49cd55724314bb9c0154616efd2d04d921798e98b156

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    351KB

    MD5

    1d19ab453f1c337669fec0a78a814da7

    SHA1

    d621f84a371df1195072e10634b2e44a49bf28c9

    SHA256

    1f781728ff83c6849fc1f10f815156d1ed9cdfc608292a36c787b63e0d14cd1d

    SHA512

    39d4f5b1b3e60afd25ea5db97a82fcb4438bb9060c07ce91803ef2b10eb3c6830c2aa0c57e8cdc6b77fbda3ec9a49b6581c9487927edb1cce2d036c4645721c0

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    351KB

    MD5

    4da87602678a5c88bf66dcbe6f7b01bd

    SHA1

    f515eff79ca0dba9249e674dc8e3b602ad851b25

    SHA256

    1aee3c760b4c7cbbdfc396e23cfd381695fd7b6475eb469cb8cfa8cd548c520c

    SHA512

    7194b281620eb7aff52dd49cb7182109746dadd643e1cdd654092153d70f2b8d7172367e93e5a3747c220131c54ab5031386336f808f5cfcc46687f9acde4fc7

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    7a719e0382c96feb358cb0ada9a1d8e0

    SHA1

    a982ccfbb04547b5932b3bae912142f3f34e9a0d

    SHA256

    10ba4101a37f00497492644504e428ac05aaae09999f8a6345b069ebc012ac8a

    SHA512

    ca8773ea62d29fe42352202283562b47100e2447f375bd3b01964af7caa94adcde4a09f45d769703e7ddddd263161b2a2e6c33c92476d63337631faaad77441e

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    0685eedea1f6753a9b33ee41ac664493

    SHA1

    44061ab69bb6b45b788c350269890266a8584daf

    SHA256

    862d1d8509b32eec4ad2c4ddf8fa3a8bbe78f945410b761ccd5a722a368f5b8e

    SHA512

    1f5dd84ac1132f221100aa698f51e463dfc533da1f2eac17bfd2ef86b72bdc9a7603f5ca40cc7cc8f960386530bbade60e074c49d9bf260f2814f83c10737d3d

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    f9cd4099ec986173ba79563c47365f4a

    SHA1

    4a0f6297bbca6c010f5a69e44df3b1562387b73f

    SHA256

    62df6d342a8a1419f5003c7ae4adccb9c733bb0c7766042f273ef17b6588ed62

    SHA512

    4ec60beab0d8dbf6a24af75bf171b657e648ce42f93a66b75dda7f44407507d6d771c2e6ac8c5eeced5bb9c0d6b54518f8848a5f9cfddb0cd5eb3f21b207a7e4

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    babe7bfdc9a39e618fb957c857bcaf80

    SHA1

    b86a8c81d603f1511e523bab8db0419b8b7a028e

    SHA256

    302c738e05e78a786a1d6b6fcdbe12ce0c118ca2d64dcc4b4c37a1f8298ab02d

    SHA512

    5bd6d28722e9534f6d7789f6b8153d334d7970913f92ba6c895925892280455a0d3ddc523bbfe2e3d19da8341124d104aedb1d46dd22d0d2371c600ee05d0127

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    351KB

    MD5

    0dfc83d2aeeec60d393db7bf9f523602

    SHA1

    ad9638380a963ff44cf9901fc56deaa0f7b624a3

    SHA256

    1d165e886018ad24f86ba5db0565e07598b10fc91ae7a86927828de687ed8228

    SHA512

    ba514dbc82e90ddd15c9fd5984c1f637aeb7182cac7b6f5ffd695723b7322823dc7c90612b980020f7be064ac6da6f4b89d7a4166df572252bedb8915c540e07

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    351KB

    MD5

    d868d290c074b7da14c65f321d8c5d37

    SHA1

    f5baefd6710e3cab1e63155daba14539cb868fea

    SHA256

    c35747ade76372d22f0a46982b673aedf084af16501411facc06fd512f7c2fea

    SHA512

    c87a60b5d68e04c9f673f49be8305ddfd9b662fd07482a8fe380b619cb90caa89ac23e0bf35c5274a9e26303acd42fbd95e3d6c7f2b6508466f8e7efc2e267e2

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    351KB

    MD5

    ffd3dcb1c0ca84f7a146ca8cef63d07d

    SHA1

    960097637e6be67c6a4efd305b73ab0344a256a2

    SHA256

    160ef63f33de3df136e091943f73f63ca56a0f89a020287a9a625d0da276f80c

    SHA512

    cedf77683c0b2c4bc5c24d864f87e4298ca213016df91748cf282f66ae134d1154d905adfaed946dfd873b5b01becb670b7a9b6f6bb816f5c9cf410c05c673b2

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    351KB

    MD5

    e9beac34cebc5215eeb70b99f1afd52a

    SHA1

    a68ec304ff7948a094d2457757f5aabe0c0309ce

    SHA256

    aacd90cc0334a3192c2c01ed3fd4ad3d932052e292f4dadf46abe90acadba1f1

    SHA512

    a38004c542137fd4424685a0c0f1cb05a5d5d98b11c287dc86d4754abaea0f0d8874233bd5b7c4b2220146ef4cfcc7b2ea8d97451156687df951eae9f32bab78

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    351KB

    MD5

    b9feb3d7ebc484791fb2e792b7c55181

    SHA1

    20dca96eb90801335163d405b68da6e534ca5f02

    SHA256

    883c2043fb8b7cb258a70340958d7783d0015f658759e2877952de8adedfb886

    SHA512

    cbf1ffb54b55446edc28fca18752f1758b94f06768e7f4be4d0ce61f0eeb6dfef2eaad3783801d4aad96efdd585094b75b587306e5f52b0886fc2b599203ea25

    Download Submit

  • C:\tiwi.exe
    Filesize

    351KB

    MD5

    ba0c876a4350a184b3cd639bcd495f02

    SHA1

    b2df692356f1b7f8c850fc890a39fb24e120eeea

    SHA256

    d4e4988e09450c616cd2cf3bd4d6867e0aa22b529e0b5118bd89e69932878438

    SHA512

    27211e5a69e75aeec72c36a695bca0aa651dcc90083495f1585a953cc4fb1716499c60b22f6defe9f29cbd509b4414ff3795dd6bee65fc1baaa5ce73bb11c9dd

    Download Submit

  • C:\tiwi.exe
    Filesize

    351KB

    MD5

    4d517ea09355591f09eda94271e82306

    SHA1

    5ed6d129ab5c5352fb80db0cde82f6ee589d6831

    SHA256

    2d163307747116327cdba959b3fdf74d709520f6ddc8ced29dc602d1f3bd2572

    SHA512

    182c078570645b0d5d7f94a8df3866c667578e1ed5e3b3585cba4ccf71847cae3f51d87c86dfffa526be0ca5fdd47af84c35ca84a71ed649c5505aade6fb7387

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    351KB

    MD5

    13592fe8ac9897bd8d5ab33b94afdf6e

    SHA1

    a6a5231e19feb01c95a262517290bc536c74a491

    SHA256

    7ebd502af23e6af69874adc92be127319040f99ce8a1d479350f51c731179409

    SHA512

    23b6e8495adc110c8bbd514c7e9b44ec6e6b4a636ce49e2ed934c6fc85756fbbaae27f51c0dbcb01265071413e25fce27b14bf1f1f6f5024ec8802f55d84e044

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    351KB

    MD5

    3a318b37ee1bb07e59df9e759ffbebab

    SHA1

    9fe216c3adcfa26b8c3f2667cb4a7caf06eafe5a

    SHA256

    171789dc0d64a68ae4036eb7fd432181358f7e8a9fdd4fdaa69dfc5a12723ce1

    SHA512

    50fa1894e72a3e3f86cb1e67a40b718f2aeaaf14d9abca57262a4e561608c753348dc6c78907bb9940f607d2e9f801f3a362851061d391313f9df1fefcdb2638

    Download Submit

  • memory/1412-322-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1528-261-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1528-268-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1772-125-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1772-431-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2032-250-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2032-169-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2032-251-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2064-109-0x00000000036C0000-0x0000000003CBF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2064-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2064-258-0x00000000037C0000-0x0000000003DBF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2064-420-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2064-98-0x00000000036C0000-0x0000000003CBF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2064-123-0x00000000036C0000-0x0000000003CBF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2064-110-0x00000000036C0000-0x0000000003CBF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2064-122-0x00000000036C0000-0x0000000003CBF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2112-269-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2112-255-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2112-270-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2172-415-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2480-325-0x0000000000230000-0x0000000000240000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2724-256-0x0000000003840000-0x0000000003E3F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2724-433-0x0000000003840000-0x0000000003E3F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2724-99-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2724-257-0x0000000003840000-0x0000000003E3F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2724-429-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2728-385-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2728-384-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2732-430-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2732-432-0x0000000003780000-0x0000000003D7F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2732-253-0x0000000003780000-0x0000000003D7F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2732-111-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2808-364-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2884-383-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3000-330-0x0000000077070000-0x000000007716A000-memory.dmp

    Filesize

    1000KB

    Download

  • memory/3000-329-0x0000000076F50000-0x000000007706F000-memory.dmp

    Filesize

    1.1MB

    Download