Overview

overview

10

Static

static

3

e57e5d01d3...0N.exe

windows7-x64

10

e57e5d01d3...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21/08/2024, 20:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e57e5d01d303e506a2ae30da97014570N.exe

  • Size

    488KB

  • MD5

    e57e5d01d303e506a2ae30da97014570

  • SHA1

    b2335afa47a698e1d2fa3f5b95638d3e8177984d

  • SHA256

    b9a04095299998dff70917a88ac84ad63d7c2edb786aa2730b81efd719434eb8

  • SHA512

    8e74228839ced84ea77bc891bd3a7e258ea94596ecb6ba25211331bcb7d0afd84c20ad243ebb9d058cf8f4f417d6791ac6f4aca953793283e62042fe648460c1

  • SSDEEP

    12288:V/Mz/MP/Mx/M7/Mx/M4/MpBE/Mk/M2/M1:VEK2O2HIBEd7M

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\e57e5d01d303e506a2ae30da97014570N.exe
    "C:\Users\Admin\AppData\Local\Temp\e57e5d01d303e506a2ae30da97014570N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2528
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2624
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2148
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:852
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2276
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1776
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2772
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3048
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1008
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2220
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3016
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3008
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:688
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1852
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3068
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2488
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2136
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2808
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2608
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1352
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1864
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:3032
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2668
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2044
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1080
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2032
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1408
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:1632
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:828
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2152
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1204
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1536
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1708
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2964
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2784
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    069bbc2836d159a02a80e6f1d181f390

    SHA1

    abdc3fc2578c1dc875532b5f8fe603080232e633

    SHA256

    06084ad497f92fe371953e7b344e64b098fec36355516b1251a4f846f66a7064

    SHA512

    20f597d4225b76c5f95a3e28b9d3548891ea6a8b524b5177561fb35db8106e8affa59c6b8dab0753458146624d013970d084e44e7c4b79a8f3f0567b62c55d43

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    9b15ba8a83b9f99a695f3333a34a823e

    SHA1

    6349e33d6bfcc9ccf5c0f52973bc19f3e04f7af7

    SHA256

    18ce90e452310b29b4bf84bafe279a5f446a3d4322e51299c2967994bd4ec1a1

    SHA512

    c11162ae236d0a9912fcfe19518873cda4235285a22a20c72233699bb8dae0cedf9e5e20bcfe28c8cebea8303ff42a38da32f7a429962bebeb2d94ac54e7d3f4

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    74e25ca4f64e6fc34c3a0607475fcf8b

    SHA1

    198dac970b1708ffc77ac130e4bc5eb7074ad07b

    SHA256

    f495a862c773b7e320d410d04ae1c5af6c1b2ffd78c96c4721bf7471687531bb

    SHA512

    e28f8d3b6bd331291d0d9554be4c9bfaf28ff21583424831a461c615aa6f25fe8160b7be9bfc05ee76ecc49939d3617b48f3aa9ca98b7047c11bb5f516e98122

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    22c9e862cf9949bd4f17e0058bca4a60

    SHA1

    a50d69d892bd897acc5e0ca5a4dc8ad704866992

    SHA256

    717358743ff858cfd07e3f93db069f16245d363e646bc142cc586351b4eac95f

    SHA512

    20de669040f20252e962928e6f13e79d4b7a02f619a70133971e058d45d74a6c3c1bdf921ae79c047c3ca1444a5ee58833b8435188c3ede52637d01fad31b3ce

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    b57a77508923ab0f62f60692b3c29f47

    SHA1

    59242bd390aa25805ccf2fd44c16fcbd40acd37e

    SHA256

    6a16d14a12c9a67a61f303af7095e974e297eef0ff591ef4688fa8859cc1c1a3

    SHA512

    db123e49c926fd34ef533fae69560df24edc6d8d0eeb9573f57315fac629d6fcd9d16b73adff7df989681404e69e8f970790f09f5aba9696532f74ee33e4100c

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    91a6370bd5ad64867fd9c8758f959bf1

    SHA1

    5358a189d070b5a33022ca7dcfb64a5ce2c84d08

    SHA256

    ff6055f2a61e76d64f80f64d2daae8fe18f4e59127a4a2771e65446f1a2fc760

    SHA512

    a2ae4914ddc62d19b3ec6528d5ae5a7098c052944d85e37da2ca8d90fc459c22cde7054e86391c81c018f018f3ee5b382991eabb76a85f2f2e1784a50618eb50

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    488KB

    MD5

    a2780a82394e493cfe4ebaf346b9a6be

    SHA1

    f4da547f093719a93618bbf4940cd8b54aac3be6

    SHA256

    3ffbf887859dc5b5425918751d93df974efcfd7067b6abb13f45968d65f9998f

    SHA512

    570e3aefe51d531592253b50c214a5661fb1f25e7118ce3634d60fa4d66e5726d5748ee34bcd9b8354ff36cdb27fccc567773b08df22ac128a100a78846b3266

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    ed6ecad21fdd983f4211cab5deefe47c

    SHA1

    544279e765cafd8fa9175a840592973fdd974c13

    SHA256

    f4169f1610fe44c2e79380a6f624b6c169b091af633c5a936128bc6371d4f04b

    SHA512

    e2d8fa5ca80e1a0f2c3c7f949d37b35bae8a18b32b0dcec523380ab7a1b41187c55cc080ef72662a927370b119703c4a6cd8f4bb27d9dd9c28ebaca8f43733fa

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    0b00153c2f2d3e9a6d8e6ac98c1ff087

    SHA1

    8e840754115eac87155fd730bed3556d117afe1c

    SHA256

    691e8fa47c088e3e0d0934ccdae98d5ec82c7a7009ae988ef6b917942341cfa5

    SHA512

    cce9ceb3442b95409ef9a2c8adaa19ae268e42ea6bfe246f46d35004ca3f404644b3e9133885847ee509028553fadbf25a7706c56b299912de375bcdf8ac59cd

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    af695efa2a5abb76e44ee554eecb4304

    SHA1

    cbe0e13ca4097e8c058be91375d8cc7a8b5204a1

    SHA256

    55a7dc2ca8f00f79887275461ca45986bca467713468f31eb816bcca18ef0e3c

    SHA512

    67ca02f08228ef90b97eca703071e852a668afab949e836a0f6ccfd00525cf837c9a3974cfb5e15559f296025f3d696653b6c0eeaa40f63f80522fd391a2aa09

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    7632e710515a98d977ee44647c9653f2

    SHA1

    2b3df5c6c1fd25c1494bb11de7fa04de3f5130ce

    SHA256

    c861ae52b97ceb3fa4df4f1a24e7f785e6f74fd2e4573e913f55a641ec4ede1d

    SHA512

    175a90b0fef3c5d51e8e3c28d0463bc68451fbfde46438937359cc9ffd67dfb311fbcf86d3402ffa52d8b8414bf59f8440223c655eaf2fff284ef15d1ff5a982

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    e57e5d01d303e506a2ae30da97014570

    SHA1

    b2335afa47a698e1d2fa3f5b95638d3e8177984d

    SHA256

    b9a04095299998dff70917a88ac84ad63d7c2edb786aa2730b81efd719434eb8

    SHA512

    8e74228839ced84ea77bc891bd3a7e258ea94596ecb6ba25211331bcb7d0afd84c20ad243ebb9d058cf8f4f417d6791ac6f4aca953793283e62042fe648460c1

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    dad85cf92f9826dfd6b20dfca551ebeb

    SHA1

    b72ddee4493007dcc46d32500b9dac3d2a9d7868

    SHA256

    54e781a044bd0b237a4e89d1f3b6679d9165c090f0738e23402978a700b2400d

    SHA512

    550b4299a181d77099440541872c8da4240716c2550622b7616b42a80b4830a70ce5d209a871826560f4aa279a816a0b2e5fa6792587bbbe15788722ca556674

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    b48225bc36b85862b95829d29d60f083

    SHA1

    f622cf414122aa3b225746153a93c2d13ca7162a

    SHA256

    43b598d14225dc14adac2e361e52535f519dcd5107972d039990a05d909f99da

    SHA512

    33498eaf155e067bdae5fd0c3bbd26188f8404dfdf2b19614feb531f25bab69d2c0f1491b7c98f703c2c15648e3d30e4b68f4285b6eec389bf7804de8f9e97f8

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    ac5339428db29f5ac0e63e57ac63deb5

    SHA1

    ade79f78d217e0e396ec7d85a4bf854129889ba3

    SHA256

    60b329d4c4c4938024e33f08c03b054914824e34d82b87961e4f40f41f3eea57

    SHA512

    3bd41c8b0c68e48f8f8b2f2e9a363101a15f590eab2414cc5e56a1bc4f2108a51482c535d9835e8f46efab4d7e9e53b1c0e5658e8f8217473d754a21a5761b4c

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    488KB

    MD5

    1bf9d16b0d2ab99351e16a4e97b06f50

    SHA1

    663f968c3fbf5c94967b7f8be59a010a230d671c

    SHA256

    7e0ab35c40ffe2f22ece44be5a369525c3c571c7e1b0edb351b152ba0ee135d1

    SHA512

    9c8edec52c341e254bde555149810fb5f6875e111e508f37c8939a9f73a6b7eb603b1a3ae98aa1c0be3b6c9c883dd9444f3cb62912b0ca9109adb743ed5d2073

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    85abb0763bbfcd265e866b0548fdbe85

    SHA1

    ad5b62e23d4582a4ad32e93abfd6d57fdb719762

    SHA256

    af4cb877a7be2721001b8c60ac2d2f335c1c29bd080db3d46c47a012dd126285

    SHA512

    a5f2fdb0b58246773f5ca9e0520513b864304376301c869df3ceb835a53e4a6d2f338c6bc7e8f3948be1e90377c04a80bdf6325b1ed45d51130ab31c360f215f

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    488KB

    MD5

    5bfdd2dd74232ce1961f814ffe6705f1

    SHA1

    b4971edeb85561a69784237233741fe11d166c9a

    SHA256

    6fbe7aec3d554994c82dee8fd50405a04466a9054688f34f7cbef95f66ce4a17

    SHA512

    f69d3794702afae77c402d28807de53e0350aca336a9dd20af907b63c0df20cbc927ec68deee1c6dae72f5bf86d944b5fa5a2166feaa3fa01b926c6ae4d2f45d

    Download Submit

  • memory/688-381-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/828-434-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1008-292-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1008-293-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1008-275-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1204-442-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1536-447-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1776-346-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1852-219-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1852-220-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1852-165-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2136-355-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2148-271-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2148-272-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2148-216-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2528-99-0x00000000037F0000-0x0000000003DEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2528-218-0x00000000038F0000-0x0000000003EEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2528-164-0x00000000038F0000-0x0000000003EEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2528-278-0x00000000037F0000-0x0000000003DEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2528-110-0x00000000037F0000-0x0000000003DEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2528-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2528-440-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2528-109-0x00000000037F0000-0x0000000003DEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2528-217-0x00000000038F0000-0x0000000003EEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2528-223-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2624-455-0x00000000037B0000-0x0000000003DAF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2624-280-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2624-276-0x00000000037B0000-0x0000000003DAF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2624-98-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2668-427-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3048-352-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3048-454-0x00000000036E0000-0x0000000003CDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3048-111-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3048-273-0x00000000036E0000-0x0000000003CDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3068-285-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3068-222-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download