Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

04fe04aed1...e4.exe

windows7-x64

10

04fe04aed1...e4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    23/08/2024, 18:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    04fe04aed1226c37d5c8eec2e52f4866a7b836f28e8300dc36c2a936158ab7e4.exe

  • Size

    488KB

  • MD5

    628921281af57fbdd02384411c342f0c

  • SHA1

    4a1e9e114248c711bcce05d99044849f4577d7ea

  • SHA256

    04fe04aed1226c37d5c8eec2e52f4866a7b836f28e8300dc36c2a936158ab7e4

  • SHA512

    42e05b80a7342965643be17cb325857141787d6c910777476dd9f5eb9731317fe15a832973a92f109143ff744bd37043232e162fce0ecbecaad125809f65ee3b

  • SSDEEP

    12288:V/Mi/MP/Mx/M7/Mx/M4/MpBE/Mk/M2/M1:VVK2O2HIBEd7M

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\04fe04aed1226c37d5c8eec2e52f4866a7b836f28e8300dc36c2a936158ab7e4.exe
    "C:\Users\Admin\AppData\Local\Temp\04fe04aed1226c37d5c8eec2e52f4866a7b836f28e8300dc36c2a936158ab7e4.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2172
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2740
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2520
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2244
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:580
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1380
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2564
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2744
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2968
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1396
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2944
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2736
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2760
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2764
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1784
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:924
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2544
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2644
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2868
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:588
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2728
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2596
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1368
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1944
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3044
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2752
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2704
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1364
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2436
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1816
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2556
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2832
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:392
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2804
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2924
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    7e340a6a89dcdbe1c59400931060f47f

    SHA1

    204b391e96e472a3290745b1fa3bae35dd83d13d

    SHA256

    db64b591b609213ac6e878728b8375fb426bf992885adba40e3ea11cbdb99dee

    SHA512

    3e119da174406b137fa3c09eed70426e5eded066467e8e25395f6721b6baf375857f9534bfb2366ed6fb65e5b192c9da80fff068bed1df1e18e855a097b05848

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    488KB

    MD5

    de9bbb468a059f91e45f7bcacc7f28fa

    SHA1

    45c60680b5e1ed4d82077fc92da8afe42d19e1ce

    SHA256

    dcb506f659ebdcd1b9fc59c54c5fc7a0b8a503926b1418e75fd9ee5a5d894854

    SHA512

    86281b874f450cb992e89cc8ebbfa594e044524afdf0deb657b64b95daa3870c63eff6b40631187cf9cc977a44fa06915e6ecada2ea2f13e36d03b77b92272fc

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    d77f6ba2f09cc6ef33585edb09957c00

    SHA1

    3950b1c49616169e4d04e761a63a41636d0a3c4a

    SHA256

    fb4c2cf0f5c0f8d4556036b23669ccdfc861e542f01fd29f0e16b95caca9b0bc

    SHA512

    5bfeea28aac89f87545c71b9a633a66c916f8ce92d64bf6a8a932331a6bc1e9b43777d77ba4438455ba19ccdf05db9250d79aec7cb870af276a7f363145275b6

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    cbd1fd8e303d9d7775509a461284acfe

    SHA1

    827beb3a91d880f5f440edd243964ec8dbdcb470

    SHA256

    d73c86186432d634082121bc790e0a6b667c648af7519358c6f031f6884ce701

    SHA512

    327ae1adf50e60eb4b6fe32c070cda380395ea5b3844c8e5a3f178631a581f073ffd950312669eea4997b7738f8f383b0da3539d3b487c9eb720007b415e333a

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    6d34f34bca836a806d7831dfab981811

    SHA1

    27c3ff1dbba4cab85c46e48c02c33e40236d85fd

    SHA256

    b340127deb72251c197c45c1f213bf227842d6fa59860d5a9c34ba541fd3ac57

    SHA512

    76721ae4f5d26889d7661d00d352b5a8cd9b64997ff910d8b138662b7de15365fc1db35b2ad292e48195f5589bdf9537cdbe50cd1639dd23292274e0747f51db

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    ee1c57fe293dcfca2e30a4377ffef930

    SHA1

    fdf762668802c50da34977b9ff7fd84f142579a3

    SHA256

    802dce8f5c5fea5258827caaec9f12a1fabcbade77345029a7041174c16c28f0

    SHA512

    d8a03c2ce12d15d007a621106300d75b4de65ca72101a8720b7d7255b0d92b2806f4c67aff4109029f026557d82eef8cc3c3e357d566a6393f43d2944505bd18

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    d907d40781a111bce05bbed62573c965

    SHA1

    ba3d4f7857bff609c8c1f3d5fee893ba4d115e48

    SHA256

    663e48eab03ebc556c8b6a63439cd804a86237bde50d7b09c18a5f0e14f28bab

    SHA512

    192c589516ab6edebc37997ec191e28ed728f8766bd8fa375d31325d47f11a83f9349dd2bd24605fce13a2db711dfbbad55b8f9f2bebe7aea9287c6e73ab2d28

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    f0149cfd622ac5cfbc69d2928654c9c2

    SHA1

    02e46ba64a398a3e0bc35cc9a8daf5701fee3f3a

    SHA256

    b1d320cc08cb7f5b2507b586a570188bfff9faa32356122f0fd336fc17e39e42

    SHA512

    6394d21b29f4b9a214aec72d7a67e2b26477d74ea9745a35ac0b73545ec83adcb9c7446002a7a00367383137a472a90855715d2207e7237669c89ca3cc194abb

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    7ce4adc725b2e544db55d99979e1ec77

    SHA1

    cda843b70b05e36e3e69e7e65a5ec0c11257770c

    SHA256

    476f7b35d87b1cc5d8eb75f96a784b23a4c5063a206ad36c1628fc193a2bd4c8

    SHA512

    1f81e99310349485f960e271263ff25672a8bfb149659e2a79d6e1cd792496f3ae77cd2b2132630fbfd30dbd3d3a621a6365a10962457e22a81562a8ed143dc4

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    488KB

    MD5

    a4553bf86acca01d1901aca127939014

    SHA1

    5b967bfa55471f4e4f5599e228ec17ddfdf7d376

    SHA256

    20f2e512c405ecb5691bd814460b2410c1c400858ab6409d709683392d8d70b2

    SHA512

    0989d7226743091b2222cd11ae3a639a2022d9737d8a9e090a8cd97b50f8cce8b3962820861e6baa56dff74292e83925f0bd95e9e5213ff0b6995da064319456

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    488KB

    MD5

    17c6de8907add5f3c4390f5c9209fb50

    SHA1

    b56728d9527bc0a1e2afe4bafc7b52f24a241d1b

    SHA256

    15231a0db6b5f03e7144726d9a681255ac9e804ad5d4e01da4e122f6935eeb68

    SHA512

    a0f1df94b1303d1ca2a4b40f3ba401c56c9b69690729d2db5094cddca3e1dcc322f285f8fcf8b1b3a46401f831f6efbf9ed7d80dd9262819a023876803edd691

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    9ded8427336e45421cc02595e9214a86

    SHA1

    4a3d351dec0e962164211176b64f1ba076fa4739

    SHA256

    f16cbc128528a9f6536a6aba40bdd00a62447065593833132bed1aa31512bb11

    SHA512

    8f81ae30d8f7b4c52fcd051353e881c3da61499d4d9d45295f8c466e66a9f346482a784e887d75b034a8e40239b4a257edb396072daeff740f953c7a592bd8da

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    72c19d52e97c743fc3b3f8beb2c541c9

    SHA1

    5717a829175221adfda3528ba032d8fb8937a2ae

    SHA256

    4d249c5ca68ca62769abedc146111a2bd289829b671f59a3e77ff42ff1f72970

    SHA512

    fc4dab3ea4e2f78b009b5c592dae0eb3c3713824e5083eb4eb3f83f7101340640e8119cd1b639c3e565526dadf4c50a75d8c0f85f1d94bb021afbb62e45086c5

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    abc0902d7c7860c42bbb24ee3bc5a592

    SHA1

    d72f7c718e950d0dab02cfb1d3a98fc1b890f302

    SHA256

    5c076870c75e2fb0d200f47eaba49e9a2cd9f45f484bb3e976643d5225a83f14

    SHA512

    4d55e4fb50d5ceb1622e0b2006c4448ec9c4f1b0a9f325eb2d2bd7010f81d73c8605c43baad07f61a3db1dbfbc19e948c1ced1fec87b7cca8a5826f2ebefa581

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    dd8af7ede2267752d9154ce55f0c4775

    SHA1

    a0c868325447a5ac0b848e5f7624db7f91b6272a

    SHA256

    b811b03a4ec6136925966c21afaa2cdb5d446aa8477800433df2d37a5adfdf73

    SHA512

    58adab2ca7f6342b56164a550b3bee6de0dbc8f7dd4122f377ca630609e260b8b3a58766cc13bdb287b7f5f7782ec64055dbe610ef23e85fe72556aa583ea544

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    51b861df172c5c62622276fc23b2d244

    SHA1

    371f95a065f9f11cd721ec8dcc4a8cd1652d7b6d

    SHA256

    5ecfc824e94b0b70285ebe8a5f5f0b18c8756fad0be6133222993c6f41895752

    SHA512

    1322808f230c93d1b981dac0e5ca2c74eccc364b556588b1f053eeb66375cc9ce222cd3c0ede6478e89d837f14a1b373b143cafab9f2bac8501fedcb023f2c8c

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    e02791a6cb17607ff356590ddc222fc9

    SHA1

    970fda4130e7e6c0b87b1ef2493ea2552d8f7599

    SHA256

    c79db3ba177e5d318fd4fdade5f3ff18c128d9b1991e5a51d35f15005ad81025

    SHA512

    9137c2dff62d8aefab3e66c9bfdcdee0e1755137ff9d973b99dae03ea9447bcd60c08b89b0004993e72f70e9f55dd42f00e5cee9381b9f7b518c1ebe639999ac

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    96782431e76856eb92aed25655836ea6

    SHA1

    b75014a0df123f4ba5cc5513875fa13cb5d5b3d7

    SHA256

    06d9b393835920a31f51a2e946691526e2cead8f8c0743203767399a0f5c6215

    SHA512

    e5c5a08e7bbd9f4238b0e4196bf46fc81b2f0f1481b83f6a13e64d3de2781b9f39c40cd85b7e9e00c63ce1e2265e7acb40b7945d3130035e57fb6865b7c922c4

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    628921281af57fbdd02384411c342f0c

    SHA1

    4a1e9e114248c711bcce05d99044849f4577d7ea

    SHA256

    04fe04aed1226c37d5c8eec2e52f4866a7b836f28e8300dc36c2a936158ab7e4

    SHA512

    42e05b80a7342965643be17cb325857141787d6c910777476dd9f5eb9731317fe15a832973a92f109143ff744bd37043232e162fce0ecbecaad125809f65ee3b

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    1c3f58ea5ecff29d1a23a48511f0fa9e

    SHA1

    2586170b77b4b8e85b4839197bd0fc57db43aa45

    SHA256

    349b917cd6075e5ca5e8a1c31b6608a253f7c47d9f2622dd9fc8168316048243

    SHA512

    e2251396b7495aba5ecf1dd6f4f17d3c9dc5fc6f86bcac0e4e567a409dea8566e32bb768d1a50fbb2d7e8ee4a20b9c9a8f2809307f05fbcb1d95b78b517413c9

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    cd0b3ba310bf538fd7b2a03d316d3b72

    SHA1

    f39be1528139c980d8e41224c1a4b86b2bebfed2

    SHA256

    8edacdcc9fb880dda01c608e05589d3ca8751dd4de5eb9d8544f412676d02b4d

    SHA512

    7758a1dec16544acf27d3dd6e614c31c5be4e8334349709aa11b0b0306a7b6ef29d0e7d9131f4a14f27dbea576233cab92daa8db29a01e747873cb7fd2d81f5d

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    c99f2eca002a03fe775736d671f87642

    SHA1

    62b02808b30f84dbbf58dc21e36152894475edfe

    SHA256

    4dede3245832cc29a30b28cfa30363106a583f6725ec8e0a809f6a57e8a55c5f

    SHA512

    1632b2e2833a2cfd1c7ffc97ccb9727aa484d40c521ce307b1f30560a75bc9a0ee80b24a3e27b3b8d5401b3752eb52625622080fb93580e54f0c0463755e28e9

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    488KB

    MD5

    f39e98d472fe23ead1c3ba4d7b0c50e6

    SHA1

    21ac596d0475842202ea72acbad402ae2daab2ca

    SHA256

    096b31658a01817736fd589e188576626d73b6b6a95be7b7ee05ae3179fb57bc

    SHA512

    4c187af8fc6be60439301bf246e003aa9eaab5d7f7a4d4752edde22c7311bf02cede562484383ce0fb222ececc905b9546593ba107420b35f1e08be06ef0e796

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    43d33af13032fa9bd6e11c557e29a469

    SHA1

    f0e1498ff364866959a3827292042f4a9db206d3

    SHA256

    9352f82623924431344b169d0e3bb3b290410539e9547768b2dc1e9fe5e187b4

    SHA512

    d430b64f1da8444091240bfa1b37810dadbbfa458a8d7102d0c65059b4a98bda22f288655cf7776a253ed9cd6280f61720b9fc6b597092648100495235838a90

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    1ea3680139a8c8c00074740baf918671

    SHA1

    fcb05d5da3220b0bff0febbd8445cad332238e7f

    SHA256

    ae6185b361e56a8188c6888c8cdfe6a62049c6a5d0762a7277131c8e584b30e3

    SHA512

    c17f799a8565a101dce3cfaac2571eb6d19c97a6d988c02777410ff2c6d18f1e873ace7dc692b0c7efa5159452dbb412e9f398b51d3328c27b0d97ad4359ecb9

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    fd74fb2338d570dea81e6ee74bdc188f

    SHA1

    ccb74b766c221422bf24abc2a60271fe9f13b1cd

    SHA256

    13c0491e3859c166bf3bbcf6384a0c048f9520a55d19cb0b7121b48254b0d274

    SHA512

    ea151a367f4f53f1cd1d86fb4a24888dcbaf619f036eac4264454d7234e1ab3ffb527db7e433055c637c24ced95ed13c736c97405d7b83bdcfc67e4c7e44b675

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    9f38a356dbea2079000f0d9d7fe2f705

    SHA1

    44686a30aaba46d16126abf602fbc1736e21e81a

    SHA256

    f7eb85c5cfaf6434bbf72bfd530fe62f835de587aedeaff7b2ca52dfcb2a4138

    SHA512

    7c070221155b79226b347e1af25468f7364e80e699d65d445907db2cc83956248636545c0b300a51b31fce43697557be4459c5c103f294315f8dc68b14e6373e

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    c22f9affab5c4b21725d03aff2779997

    SHA1

    5b4ef7462e243d984b44017ad115be9623a7d51b

    SHA256

    4e8736d1cb4229021168222a4eeb8e631b60d2098adbd0a356414e315c09a1f8

    SHA512

    2fe1690e83c1ad9d6986f65bf5665b4e2e9303b8ea41dea99d3e5f8a92d4fb892250f16eb3dc9e5321705ccb2eaaf8bc9b678be85d93ed6db9005f85f6310348

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    488KB

    MD5

    283116952870d92f6faebcefa8028bb1

    SHA1

    1edb778fb43610ef0c5052976282b0c3afafe6a1

    SHA256

    ad448dab7ca7c31130efa3a8a1842f8462b1e9b1566ef1f3ac8618d6b90cbfbc

    SHA512

    810da0541061e1e749d09b233bed78c42796eb2dccd6190c4a01ac66d53f950bede5c022141a1d6b74c9cba4c5ddac6bda4ac2cce63cabb2c49defc97852097e

    Download Submit

  • memory/1368-326-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1368-112-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1368-265-0x0000000003420000-0x0000000003A1F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1380-375-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1944-278-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1944-330-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1944-331-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2172-206-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2172-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2172-272-0x0000000003450000-0x0000000003A4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2172-281-0x0000000003450000-0x0000000003A4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2172-442-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2172-109-0x0000000003450000-0x0000000003A4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2172-99-0x0000000003450000-0x0000000003A4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2172-98-0x0000000003450000-0x0000000003A4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2172-111-0x0000000003450000-0x0000000003A4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2172-219-0x0000000003450000-0x0000000003A4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2244-216-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2244-241-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2436-210-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2436-277-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2436-282-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2520-215-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2520-213-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2520-158-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2556-339-0x0000000000230000-0x0000000000240000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2556-340-0x0000000000230000-0x0000000000240000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2644-417-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2736-386-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2740-280-0x0000000003350000-0x000000000394F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2740-217-0x0000000003350000-0x000000000394F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2740-218-0x0000000003350000-0x000000000394F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2740-389-0x0000000003350000-0x000000000394F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2740-276-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2740-100-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download