Overview

overview

10

Static

static

3

975c84ef57...0N.exe

windows7-x64

10

975c84ef57...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    06/08/2024, 10:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    975c84ef579f0c7154001d28c343b040N.exe

  • Size

    351KB

  • MD5

    975c84ef579f0c7154001d28c343b040

  • SHA1

    1ff6a5b35b761a8bf4c504a3b2a829b59a135389

  • SHA256

    d3fb287c7ffb82ee613cdc9b502bdd4b763fe8d3a5323091b2dac22389a153d2

  • SHA512

    5bab9bc48c1f8d28bc7527080a76c2a5e7fb51a4a7e44d826bdbd48b812e895d1eed037f7e20b4dd26fcee2a9bd092a2d40103d3fb75c6862b8d7178ae4421e0

  • SSDEEP

    6144:V/OZplKYZplx/OZpl7/OZplx/OZplQ/OZplU:V/MKqx/M7/Mx/MQ/MU

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\975c84ef579f0c7154001d28c343b040N.exe
    "C:\Users\Admin\AppData\Local\Temp\975c84ef579f0c7154001d28c343b040N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2096
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1984
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1908
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2024
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:684
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1052
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:1668
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1696
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:672
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1788
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1488
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2332
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2936
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1436
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:624
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2068
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2888
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2216
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1192
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2628
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2268
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:1272
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2732
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:568
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1408
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2944
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2660
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2652
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1896
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2064
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2980
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:984
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3036
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1216
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2908
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    9189da89c5224e9763698a69774004ed

    SHA1

    a7e10d81cd5499f1e44eea3f75c2391027aede6a

    SHA256

    363ab665c290041cc4ddde1f179f7dd8f73603103d1c6e99bcebad9b64f9d58a

    SHA512

    74f9bd8b65c80e841d0bfc3721165303dffd2dd0f0aafe7f1cf49937685cafb4d7366749eed7f58e906e1417c78687d9e0a96ef6be4b7e66985c0907c78f3ba3

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    553202a90a12f5b4125a3400fa541daa

    SHA1

    86fa3901d8fca994e37a90291da208624f099f75

    SHA256

    6e98e4bed63e0fb7ea0b7a5001aafc477d976cf45458418793e95ca5bd3398c8

    SHA512

    c493c2c8252c5efd9b81c887586b9d9eb87eadc5c3c746f2770cc2f06c3f96c35cc9851ffd5ed33856b8b0bd2889c927659362d85c7cbb69d1635bc7b56ffa4b

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    335901069ac1965ee9448f5c51092945

    SHA1

    76e1b123be4a07ea734ade18dcc257a6539e873d

    SHA256

    11721c3ce08228d4a2d971d09bfb1b747e959ea0c598fc409fcb76f05005adf0

    SHA512

    a4700ae470bda9c838d560cddbbbefec2fe5a4b69702486aca495d8a4fbf621b70d8701ebc0661449b8a90eec97bd960edf10de9e64958fd839f1b58daa2515e

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    351KB

    MD5

    7f4e2e792261c87800f934d7212a17cc

    SHA1

    b188939fe2f3db27903010857c8a955b74bb4154

    SHA256

    32be74638ee76a08af5878d88f11d9547d5fa66b5bccb6cc11c0aafb4be80f87

    SHA512

    ad9a348c59399b7999307da5274911ac4e6639e645fd0c86d2682fd728f72c45ed1c2dddd1760d6f3f7f1b6c4de72da4bc4102dcd2dc076b1eb17cd801886f8c

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    351KB

    MD5

    f03391c812c802737bdc551d7fddc25b

    SHA1

    c8a6f0d1998a49a1eb9906f5d1a301a5db885f61

    SHA256

    f2af13d510e42496dacb7b1a46ac34f1c94214aec1a0fda35caad6586216e6db

    SHA512

    210cd84f0d4a4ff76dbdbb4bc95fd44399783eb3c80261764024284529165285859cb808c016b0c904f19e453b5b6934850531c4bf5eb9fde32522e6b376bf4c

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    04069eb8c9c8452532415727a754c527

    SHA1

    e5d507429239f794ab42f73cc2c1049833f004c4

    SHA256

    394322e820a44127c96eacd0d1dec3d23c8680c37fb15bb7b47ddb026d65521c

    SHA512

    722fb691a5a2f3c8b5e8bfdd19c5cbc06469b10c8459185bb07a0a70056caba20c577d77033f2373054d61d602c882f665035a26ebeed2466ea010245189bb08

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    6a05af9e4c589955a12f3172b1777f67

    SHA1

    41a0150b2c4075630bf214b865746baff12a03fc

    SHA256

    59eec78b49cd949a1ae4bbbf3e570e5d7c90927709e914fb771df558c31b9347

    SHA512

    4aba25ff32a64fdf26dc2022b0299d78ccb9ad20a8fbbbe143fe5a6fe2083885ea0df8b795c766c88bc8a063be5b98a642031d1473ed1c63a02cd80b7ebcd15e

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    351KB

    MD5

    38d64d18cc329701c9059afc68352bfd

    SHA1

    9384f8fbb9020a0b1c37e696e5a8d19b212d64a6

    SHA256

    fc2f15c68100952e8661ce55191adca15f86bcfddaa79f2d441c33c560c70634

    SHA512

    bd8071bf779aed4cf2a45d7fc3c927b0f359298b3944b64edbdcd96a750c697f1e8465cc5d5aceb4b93938f781de5db954fe5a3db5f4a1c771abe076cf91d91a

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    351KB

    MD5

    354b043a0cff49da496979018f244f0f

    SHA1

    6e41887bae2f21762480df7f957a369bf9c145eb

    SHA256

    737d6f8b49ea2a4af998b728b94ab548aff6c9a545628b8e89c68890800ec7a0

    SHA512

    3b57912da3cb98e4c3fc7b33f85df0abc685c2b2155f2b928ddf98d72d7a844ab9e8b841aee6b2ce637cc71bedcc608073cab2cd7d1a73ab0bd253f1e14c05e6

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    351KB

    MD5

    c06ad1b2c62e42a562ca301b55bee92d

    SHA1

    bee9965ce3f289eae83dd30288d40f6ab78fd021

    SHA256

    029249472074cc7e665ed0062d1184be7a7c8906a3bc6ff54b8e34317016184c

    SHA512

    110895b14da52de471b9024430ecb00d96c49a582f311463fb6854a442e83962968ac0da4fdc2414e973673a5cdc957ac508bf8eee2fce6cf47e7702f7b6ac21

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    4ea24e78d674a7f500267d2c259401e9

    SHA1

    21ee39701221dbe7254fd5e899b04a4930f7cce7

    SHA256

    f63fc96ed0d0a9efa39603c45eb6e0a517e162a75b9f8757a8177cc044f8b1a6

    SHA512

    74637da866230af3a46762ae326c0570a0313ad07eb6e6d65dc4c04ab351d9eeddbdedeead350dd80fdced5c613f8e1101935c6fb6dacf4031d3ac5c918ee42b

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    dc93bb01c81f07d589edd0748ac6a4e2

    SHA1

    5c7034d6e70fa4250e3c4594a64b8457e7d69af2

    SHA256

    48a445d83b16ce92ab296b8484f36052ead6c51c6815456e4e90725c6a785ecc

    SHA512

    4e6b91d7907b0332e71bc9259c3ce5c5cbcba2f2719a2290c0e59d19b5fef9a20b771dbb23aa796a134acfe4df5802e05a7ddffacff560098d50bbb27c71d437

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    975c84ef579f0c7154001d28c343b040

    SHA1

    1ff6a5b35b761a8bf4c504a3b2a829b59a135389

    SHA256

    d3fb287c7ffb82ee613cdc9b502bdd4b763fe8d3a5323091b2dac22389a153d2

    SHA512

    5bab9bc48c1f8d28bc7527080a76c2a5e7fb51a4a7e44d826bdbd48b812e895d1eed037f7e20b4dd26fcee2a9bd092a2d40103d3fb75c6862b8d7178ae4421e0

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    351KB

    MD5

    7f77c9894abf2aab1259c01861420057

    SHA1

    eb5e16e45570922548cfd8d4c00499b75d0512f8

    SHA256

    a095c877087e1e25606faf785708b2b6ef8760c5bbfdb8e74f80e2c2d23fa3ec

    SHA512

    47c9694372c9f500930d3a08d4c766312b8ffe544abe4589752baa666617ec6188d5b4960f44bca5c67272a2f99415f70b7b37c617ebf371f033b05bff909ceb

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    351KB

    MD5

    1032853c62751920d1c89162350f827c

    SHA1

    1d57c2558edfcc86a4a055dc7f6ea94b68796155

    SHA256

    9fd85add8fe0885605d9f2cb6e3352f2f7a2a35d82a5feba12bd1bb891cf853c

    SHA512

    31d7722f306e81ad8f663b8df3fe663d6afcd24a45af30f4330d4d193cfd619808167514e89fdb3fcf0e8f0cea3110d2ab42ee9829cb88b3c315d747fbbd1ef5

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    351KB

    MD5

    97039e88b1feffff31895ebdc3a22726

    SHA1

    c8192203bc3a476f8cdedaeaf493ab1dce0a4c5c

    SHA256

    9121cc289e501e8702169d78cebb541f65bde26f4f17366d57de0106b5daa56a

    SHA512

    00629d92584b257a54b28fafc81137342355062f8392ae58311e8b140a3fb158cfac1da752ad3eda3626e783de6cf91981e9dc500b52ca3a09a4dce045565444

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    351KB

    MD5

    84b0e2700254052c74b2876eb3ee1884

    SHA1

    376d6be24df17c5af2b00d9cffc44e130aad6547

    SHA256

    01829a664af45fea35e9a3051d4de46b77f129954d04f745f61422f58fbd21aa

    SHA512

    567e869c2bc2e9900c82da8ea2768d5c533b93a1a9d19f98aa7d3ea055aa66571625d4942f322ce6e755a17496a1a9f1323d149be5a5918428de8c0f8d7e3e40

    Download Submit

  • C:\tiwi.exe
    Filesize

    351KB

    MD5

    14b5d4151a5d0a786d3bf314eec37768

    SHA1

    03462a0de08ba4159b6370315a92ef8594a26317

    SHA256

    504660b21f3331775e6701fed2a895f8f63491fd925bef3a3219003000a40397

    SHA512

    3c7e5ced0921d17bd8a3507556cfab0635d6503667130e6c0d359a556566f5b8703543af804d48789ddf096b12e72ae7274b8161bbdbd5575d4c47c9cdbfddef

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    351KB

    MD5

    813661f311619d6afa576247fba6181b

    SHA1

    fd90a483c171cabc7f9a53b54aab1aa154a0eaa9

    SHA256

    bb38d9f627ee6f691b90ab3116ade9a7b3b32728d63be50e2e7cf62b90647f36

    SHA512

    a713e1dc2e4e7d370364bcafa160787d90b591dfd49b2ef80038b39d5ccbc51ab76195eab050270223dc7a89355ccb12eaf18871889eaaf077829fd56dd0943d

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    351KB

    MD5

    b01fdb0d0c94f743a0c75f946beb11d2

    SHA1

    11a570b3d53bdd8e76fdde92db5cf1d71507903e

    SHA256

    61c7de3a6ad0304bc6b56ca6155a0a2cc3558b971608e1dd6b21c963ad9a9995

    SHA512

    64404fda11a8749ac14c15fd578e98d54866c1056b443cdddb4eaecf3e5794b52882d2102a32f47277660f012f35a909373380f1abe9fd82f5cd2664ae95373d

    Download Submit

  • memory/568-405-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/624-290-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1216-436-0x0000000000260000-0x0000000000270000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1436-286-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1436-287-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1436-275-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1696-441-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1896-165-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1896-220-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1896-221-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1908-269-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1908-270-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1908-216-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1984-461-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1984-464-0x00000000038B0000-0x0000000003EAF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1984-278-0x00000000038B0000-0x0000000003EAF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1984-99-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2064-222-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2064-277-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2096-98-0x00000000036D0000-0x0000000003CCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2096-219-0x00000000037D0000-0x0000000003DCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2096-110-0x00000000036D0000-0x0000000003CCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2096-109-0x00000000036D0000-0x0000000003CCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2096-217-0x00000000037D0000-0x0000000003DCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2096-456-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2096-164-0x00000000037D0000-0x0000000003DCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2096-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2628-446-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2732-401-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2888-403-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2888-404-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2936-268-0x00000000036C0000-0x0000000003CBF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2936-462-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2936-463-0x00000000036C0000-0x0000000003CBF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2936-111-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3036-407-0x0000000000230000-0x0000000000240000-memory.dmp

    Filesize

    64KB

    Download