Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

04fe04aed1...e4.exe

windows7-x64

10

04fe04aed1...e4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 18:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    04fe04aed1226c37d5c8eec2e52f4866a7b836f28e8300dc36c2a936158ab7e4.exe

  • Size

    488KB

  • MD5

    628921281af57fbdd02384411c342f0c

  • SHA1

    4a1e9e114248c711bcce05d99044849f4577d7ea

  • SHA256

    04fe04aed1226c37d5c8eec2e52f4866a7b836f28e8300dc36c2a936158ab7e4

  • SHA512

    42e05b80a7342965643be17cb325857141787d6c910777476dd9f5eb9731317fe15a832973a92f109143ff744bd37043232e162fce0ecbecaad125809f65ee3b

  • SSDEEP

    12288:V/Mi/MP/Mx/M7/Mx/M4/MpBE/Mk/M2/M1:VVK2O2HIBEd7M

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 6 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 8 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\04fe04aed1226c37d5c8eec2e52f4866a7b836f28e8300dc36c2a936158ab7e4.exe
    "C:\Users\Admin\AppData\Local\Temp\04fe04aed1226c37d5c8eec2e52f4866a7b836f28e8300dc36c2a936158ab7e4.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3476
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2976
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4364
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2096
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:752
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1648
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1052
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2672
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4396
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3728
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1244
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2060
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2776
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:452
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:400
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3060
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1856
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4052
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3696
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1736
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3088
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:1600
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1824
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1128
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4948
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:916
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4872
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:5020
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2656
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4048
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:5012
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1104
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3052
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5048
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2740
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3644
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1284,i,11251706013556949551,5157034131170452377,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:8
    1⤵
      PID:1528
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
      1⤵
        PID:3696

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Replication Through Removable Media

      1
      T1091

      Execution

      Persistence

      Boot or Logon Autostart Execution

      3
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      2
      T1547.004

      Event Triggered Execution

      1
      T1546

      Change Default File Association

      1
      T1546.001

      Privilege Escalation

      Boot or Logon Autostart Execution

      3
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      2
      T1547.004

      Event Triggered Execution

      1
      T1546

      Change Default File Association

      1
      T1546.001

      Defense Evasion

      Hide Artifacts

      2
      T1564

      Hidden Files and Directories

      2
      T1564.001

      Modify Registry

      9
      T1112

      Credential Access

      Discovery

      Peripheral Device Discovery

      1
      T1120

      Query Registry

      1
      T1012

      System Information Discovery

      1
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Replication Through Removable Media

      1
      T1091

      Collection

      Command and Control

      Exfiltration

      Impact

      Inhibit System Recovery

      1
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
        Filesize

        45KB

        MD5

        b0d21a6248eab8c8287c80ab4ca99b57

        SHA1

        73792e3f9b43e1edd813ad7396c6604e19185175

        SHA256

        debc5fd3ba613a6ab8a6649c982f135e07010e619a362e2a9dd424f4a144eafc

        SHA512

        ecbab39bcedab73b16b06f6822a1c118b3df661640035a1e40bda3683882713792e75b186948b411c06ca481a2357e825be86b9b29251bcaae0de74661ab01d1

        Download Submit

      • C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe
        Filesize

        488KB

        MD5

        a152ad61ac0f4b1fe6cf8aef8bb4a9b2

        SHA1

        b7f67defed13ce2c584b714773371aa5776cdc44

        SHA256

        a6ef5fff54e259b0e1203e32f8a44586c8d1e89ee52c1c36bd5966148cbba868

        SHA512

        d8e5fca7956cec94e483fb278fd97a148016a92b246a31630f15aa1352ec84a4f9cdb90ce592fea60dbd28c6ed975440564b03b38cc2e40c3a831c479eabae48

        Download Submit

      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        Filesize

        488KB

        MD5

        c54839a9d632b99ce79e5724f33873ca

        SHA1

        b64ddbd216c62e4b30993d39bb27e34f6ca92937

        SHA256

        a4f6381b12448a4293b28a8c0b80c3c5b9ecf6ae5157e8c3096318065a42fee9

        SHA512

        24d62028932b0f57e003a0fb68fadcba7386d0627278db4511a3a83283bb43234321a94354a71ad186900ffa725897319c4c8e12375828cf5a28cc957c5a1003

        Download Submit

      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        Filesize

        488KB

        MD5

        fb8c4d3908e04b915c26be08aa9ca36b

        SHA1

        abb67db63b104d7f6fa7af157c161a8dcd29cb12

        SHA256

        5e7bb6e69ec44453d67f78b7f20c8c3d27e02919c12b712fe56eb685af62bf4d

        SHA512

        12a5c87969140ff30f5a454cb631eb3fe05a95286f3dc832ee148d5e237077f1da4acadc7b3fd3996d37ffe0d44838d7b3b773d788025b7afeba2c4914c67d75

        Download Submit

      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        Filesize

        488KB

        MD5

        7d72ef9e1c804a8c3e546fa2f63d45f8

        SHA1

        589650e13a49be4457cf3b0f76efc6099baac817

        SHA256

        d9f17b4be7ac637f11e22339d8628d530c613bc948c84cace3c218da43d0dfbb

        SHA512

        4e3dc6c1155f83711761d238cbc2083adf3e55a69c0c59ecd1d7531cad432706cf7512635d7251343271425adaee0725a43e2a97a8784cd9ee517325332818b8

        Download Submit

      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        Filesize

        488KB

        MD5

        f8ad407ebb6fd54aa14d168f45d6bba9

        SHA1

        116937b40e0391643cbd2052745f46aa6e486fc6

        SHA256

        9d6a380d7df2a3af9f277c6b0ba7a8dc401772629ea9eaffe7796623a3d76a9e

        SHA512

        bc9fcefac06d4caa4743dbcb135c3d18eddc01789f88806acde1e5d1a310ddba16ba9483d1122cb4a0f3e2f55ce3aff7a94e0423fd3f942daaa019db078e788f

        Download Submit

      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        Filesize

        488KB

        MD5

        9ed841879e3c989e09bb9d6c9d656dbb

        SHA1

        2f6e81c4352e5d8fc28dc7b9d63767efbebafba1

        SHA256

        f106a5e4139ae4fcf05a6e6096d0ebf16545a1c3cc89aeab8c4609637a522b5c

        SHA512

        cb5c39666466788fcb2abd2b57472a7106639ec1ffa28a6cacf2e6f2aeb982db9775f8efb4c45b1767db5c65a8f4240d2b0caedcc4add1c9812d2f38c92fa4f4

        Download Submit

      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
        Filesize

        45KB

        MD5

        03cfcb0ec95f08878a6edcd210dc94cb

        SHA1

        7c40a2f37509742833ff3c92d41d60f902df1dc0

        SHA256

        62f1eda91ac372b64d88aced806586f0c33f8e3ba4b916f293022dcf99efd1ec

        SHA512

        95bfe121a5cdefae96f2c917387b44cbac2d5a36b6b17766c1119bd36d2556d6be3312013c48f59c5fe59a38fc42ab9141a27bcc4834281b1563226421c8c2c2

        Download Submit

      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
        Filesize

        45KB

        MD5

        a7078727ada6703cf614feadce12e159

        SHA1

        aa792171dfb469060491b6618fcc68a645ef32c2

        SHA256

        e4f0bdc00575f1ebda6978872a5be599ba2fcc06f5acf3a664e76fc95fb26881

        SHA512

        4066966f2ddd533d6a11dedcbe36b37b19208dce9709fb3109402f4e74f7310093b309fe64e4639b14ee945599f0193d64dd5524a9394f7617b3c7e945e156c5

        Download Submit

      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        Filesize

        488KB

        MD5

        c7a3403aae84db615100b07811011cb5

        SHA1

        84868bc04a26b5e4b8026403cd35df18fed0b614

        SHA256

        818db95aca55e48264911832775dd091585120a21dbc7197a2528344b21f1ab4

        SHA512

        ba9f550df21dac57add41a69021cb13412cec6a76e55df39ecff6efc31502454eb1c55f81f2b3f3d111069f7ccb2dbcb3746c27ddef51a2edb993f123fcccbdf

        Download Submit

      • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
        Filesize

        488KB

        MD5

        4b06bd63d5dfa28d528b46b40a402e01

        SHA1

        352646f6b1afd2fee3cb32554d4798874be3a1b7

        SHA256

        ead4e135e9db049debc0489bd81e67c4618077265d790956736d27b42cf701ac

        SHA512

        0547ebe490f5fc5d56fffc9e946c1bcad8af327728d333e39c570bf30a0e588524d6d025a5b2f2f9b82267b1968699d9680cca94c30ef8ef25550f7dd40d1a9b

        Download Submit

      • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
        Filesize

        488KB

        MD5

        ac915619b3a8e89a42e685d79c52ed23

        SHA1

        f35ccd3882203143eb645a2a444d805992b2576a

        SHA256

        91e345f8663d7b17d12523fbda94ef54cb8d2056dfa95773986cc5ea1ff803e1

        SHA512

        e460102ef07bf43ebca48a4a6951de7581abbd0a3cb18fadf0a2dcf10c957ce6a18b81b0a3bd33084982f7a14843dd18542316e78da058b6fa872dcae084c467

        Download Submit

      • C:\Windows\MSVBVM60.DLL
        Filesize

        1.4MB

        MD5

        25f62c02619174b35851b0e0455b3d94

        SHA1

        4e8ee85157f1769f6e3f61c0acbe59072209da71

        SHA256

        898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

        SHA512

        f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

        Download Submit

      • C:\Windows\SysWOW64\IExplorer.exe
        Filesize

        488KB

        MD5

        d9ff0ec383fa80d92431f553879135e4

        SHA1

        2f1143de43138a2d54b963d805be0458b7315d98

        SHA256

        54fa4ddb927990ed13e2494d4c7f4222ee80c2f03c34aae7f47a4c50a3174365

        SHA512

        70f5b7f9cc86f80d80ba37a7f4ae99f5432de04b8a6e5180224819d1a104df29fad22c1f12ba4f1ca271786d5529918c5016f5fc776f809bda836e626465716e

        Download Submit

      • C:\Windows\SysWOW64\shell.exe
        Filesize

        488KB

        MD5

        9a0ab58c3a7bd194fb275b873374a949

        SHA1

        d996f4dc49616372c5c5d512b27ca6b132e926a1

        SHA256

        3db6ebba7f11a6558c73a974a035c10806891a59aebd85d1fb9c02ae7ea0d57a

        SHA512

        a88accceb27e8c533dff31914e21a08fb7c5ab5e9c4f4f3822cc71ce9a7e93c0d76dfb98d9fd69182eb733a9c101f016fac1120ec9f947326b436fa90168f7b5

        Download Submit

      • C:\Windows\SysWOW64\shell.exe
        Filesize

        488KB

        MD5

        f90e54c713b347555c5a0adab0b445d3

        SHA1

        51f3a4a89a616da7b9f76f60073e49a2a55bd751

        SHA256

        1598ac09a1c00cfdf7077a7bfadd6b935333d5cfc71ed990bc5076ba22588eb0

        SHA512

        a7195041ac1d0eac8caadbd49b97824f9d8bbf1bc4f93143b26cdf25cab63b59919c4762808795959f651eecfdda7d028330de9a2542b4b8c950e0251dc93895

        Download Submit

      • C:\Windows\SysWOW64\shell.exe
        Filesize

        488KB

        MD5

        628921281af57fbdd02384411c342f0c

        SHA1

        4a1e9e114248c711bcce05d99044849f4577d7ea

        SHA256

        04fe04aed1226c37d5c8eec2e52f4866a7b836f28e8300dc36c2a936158ab7e4

        SHA512

        42e05b80a7342965643be17cb325857141787d6c910777476dd9f5eb9731317fe15a832973a92f109143ff744bd37043232e162fce0ecbecaad125809f65ee3b

        Download Submit

      • C:\Windows\SysWOW64\tiwi.scr
        Filesize

        488KB

        MD5

        b5762300a6660e40782bbf87e5ce8136

        SHA1

        15ffc51a67dd2d82c1ecda061e6f23487ff00bbc

        SHA256

        d7ede006ffe54ba199e6f8bb425f8428f444af239c1b89e73a2ce757cc62301f

        SHA512

        4d34df1688c6822a52cdac8f50db8e4dccfc026b1fbdbf4bb488c01134274f5db9a0815e8dc5b1f67b2a1d5c5ecb1df17cecbd39c50627186a361bbd7a80f195

        Download Submit

      • C:\Windows\tiwi.exe
        Filesize

        488KB

        MD5

        1a9e6ae865ae696940c68e1d8491bcc6

        SHA1

        1605478c92a9515acaaee99a80a625e695bb8cf9

        SHA256

        ea2a611eb52069007958aec19f683ea058ec52f857ed2c110572862a0ce46f48

        SHA512

        63a995c861be4c6fb07d4b0e980044ac3823d6f25d84303b28c754304ad4cfeb001b0b349f655e9ab4bc0e4120a1c772056c120633581ef1b662556e81b653de

        Download Submit

      • C:\present.txt
        Filesize

        729B

        MD5

        8e3c734e8dd87d639fb51500d42694b5

        SHA1

        f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

        SHA256

        574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

        SHA512

        06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

        Download Submit

      • C:\tiwi.exe
        Filesize

        488KB

        MD5

        2153034abd07964dfcd682b777e99e00

        SHA1

        f464f799006cf7bf02a63230689327d428eff8c1

        SHA256

        f85ce1d351766925ca95887bbda34bd54ffc2eb06fab195e28ba9eff2fa0930c

        SHA512

        96fd1f622e4e574a03b3622babd2a8aef8cff61bfe1b7ee6349e8be0745813afd18d75cbfbe91a35e2793778c54976e8018d70933add35f8667785b14702d2ad

        Download Submit

      • F:\autorun.inf
        Filesize

        39B

        MD5

        415c421ba7ae46e77bdee3a681ecc156

        SHA1

        b0db5782b7688716d6fc83f7e650ffe1143201b7

        SHA256

        e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

        SHA512

        dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

        Download Submit

      • memory/400-215-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/400-162-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/452-163-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/752-270-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/752-254-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/1052-306-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/1052-303-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/1244-296-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/1244-395-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/1600-433-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/1600-262-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/1648-301-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/1648-275-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/2096-255-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/2096-223-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/2672-102-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/2672-274-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/2976-96-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/2976-268-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/3060-216-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/3060-376-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/3476-261-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/3476-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/3476-394-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/3728-289-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/3728-269-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/4364-197-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/4364-222-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/4396-250-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/4396-267-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/5020-294-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download

      • memory/5020-434-0x00000000003E0000-0x00000000009DF000-memory.dmp

        Filesize

        6.0MB

        Download