Overview

overview

10

Static

static

3

ef43e3690d...4c.exe

windows7-x64

10

ef43e3690d...4c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    24/08/2024, 05:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ef43e3690d581f49a3b9d534e8ff3873f3811124c5b08ab9e0654e9018d5f34c.exe

  • Size

    488KB

  • MD5

    34043d652c6669c2bb3de1aa396f48b6

  • SHA1

    02d07ad408073ca4f0424fd6a8dbff81f204f5af

  • SHA256

    ef43e3690d581f49a3b9d534e8ff3873f3811124c5b08ab9e0654e9018d5f34c

  • SHA512

    b6d99ef57767ba1aaf9725b607dd64f59c5bbfb349a276a3e847cc5eb96f2dc95ad8f5cfc93bef9c386f2b74330059e0664daf6856192df2c77b5e29b4ab04af

  • SSDEEP

    12288:V/Mj/MP/Mx/M7/Mx/M4/MpBE/Mk/M2/M1:VkK2O2HIBEd7M

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef43e3690d581f49a3b9d534e8ff3873f3811124c5b08ab9e0654e9018d5f34c.exe
    "C:\Users\Admin\AppData\Local\Temp\ef43e3690d581f49a3b9d534e8ff3873f3811124c5b08ab9e0654e9018d5f34c.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1628
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2632
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2672
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2824
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:568
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2032
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:112
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2732
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2312
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1264
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:852
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1580
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3052
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1280
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1648
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2132
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2176
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2896
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2576
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3048
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3056
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:1536
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2264
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2692
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2588
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2708
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2516
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2868
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2760
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2556
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1844
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2652
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2528
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2236
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2116
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    a53f3a14865ed90e5cdcd265ed176fee

    SHA1

    3eef9f9ea4c5753f8d2dc7e0d05fe9ee146d2b8a

    SHA256

    4e5b9d8c0bc73492364fcfa1d9419eda5bb7112fa099df702c63972740c19fd5

    SHA512

    95d1ea28ff278b126f2f2c1b24b5ebc9e13ffced022544b48549bf8240c352058d63c70bc3f640d3cf2b882c8485b0701ae3d0506c8354df390766a831fcb07b

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    6165a9e5d192f294aca61cba474f3584

    SHA1

    22467a4693a4f153a25f198e1751a69176960b88

    SHA256

    f1ee1180ec73d96be3da928d88ffe480913d89f8d7dfb9b3088ea3f51374f16d

    SHA512

    6bd6673b88aea89308880ec3c13488e56c797308a5b12bb0b0d018a0e1812581bc9426b4124abf8ade8762f05d1572a6fb529e0db076963da48930dab2e09366

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    ff6a0cffa4b6e26d528a250aa3efe6cf

    SHA1

    f65c331b6ce65f9eacb5ddfbb5c0fa7826669693

    SHA256

    8244ce36d7aa96a872e6660096a990fa37d0cefdfd563cae64b54ad324251df6

    SHA512

    52d497240d3a8dcda42c04178c58dd5f9ac31a7a2a94c6d6eb6e71010ffcbe79c26533f6a224fcf846799e9105d6e8a2e6bbb6949ffd6d13823bd4f1e231fe8e

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    9eb7f2329020b5025361db6bdad5b2e6

    SHA1

    facb02099fbb9dc5bbdb43ed709d9cdecb52df07

    SHA256

    cada4a4dd867a2a2cf0d861283cfc9dde09663dd64af7acb46c6d3b2f4d5131d

    SHA512

    00b92da06263941137eb0f96c2a28d4eb19dc101b06275fc758e6cba48bbddc25b8cc480e41f9661eec99bcf0d94060d72845e2cf817b3b51fdfff1553a656a4

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    511221f26f6026424d52ccbe977e2e43

    SHA1

    7bda51b6bfa7c63b5bf124621c0846625e23a3dd

    SHA256

    2bb3b037b5a5326ad1efda4bd904c1003c2d1120b758455f4f8276d392f10ac9

    SHA512

    f243a4dfcc0ee2d4443617e581d4e6b7a1c62d91923d2ebde91e08168762555af2869b296d20fcd15e4bbabff99a7a9936f318c119eab8effdcf140aab15d49a

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    cc01c746c0c41f62954aa40303c5813d

    SHA1

    1dc2934415483d8b6e04104873ef27d491e531c9

    SHA256

    c986f1c37b12a6df86e24b1869b274b79d57f09d0b8f5a39765f9fea40ab1b6a

    SHA512

    6456e2057934427ab7d57ef9509df6cfa37880188b4272e8300e607d5d93eb762cb2418db383c05ec2058309a12811dc462700af140b668045805f6b0c847338

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    4573e4fb03ed58f1416329b311e3777c

    SHA1

    e9248ddf0f396f15113ddce50274a06f61bd2117

    SHA256

    ada627fc02d20c3b0bed8dc0a40b85329e90d64549e21febba5e3ffc96c3b7b3

    SHA512

    a6c1f0398b2de1be29af49228a1afa1455fd7632d80d9f635e63f32fe7c72d9fef7fd5da920687e092b0eac62fc4bcc39d71b7cec43f5f963424eed4f81b2303

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    886f66d1ccc29de2f99d157faaf78408

    SHA1

    4a83555b69af416c07bec17c4959a0fa9a7a3188

    SHA256

    a9a5220d6b8e6c269820ca705dc3e96026888d9f08162a4afbccd16afaf19dd7

    SHA512

    533b7dfe7c1e67e8d6addba74f840d856f4693c2ce1ed3558596697e2df9a45957f8df569d5b588fac1246129ee83c084906b84fe3ffb78a8804f5a964371623

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    488KB

    MD5

    68d75a15052d688941917721d0b22435

    SHA1

    65280819eae0be8bddb2db792c5774c011c89d55

    SHA256

    e1dd612909f77216b393949a6464a21e710cb09f7b1f7dbc2f880846556b9f8f

    SHA512

    66073859c42091ff90d291c53b1e0d01c9cd037bd053b6d7963e14ff38d484b6762668ec111880b2d9a54cc9aee49426c2a71974e8c9d10afb844e6b00295d10

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    f66f75218348ed8a69f67d59c51e34e3

    SHA1

    a3d47081db50beb02946000669c6b492280c3dfd

    SHA256

    12db3e91315c7578f895c05a23b6468b7fa63e9a9e25f06b429ce8a03181487d

    SHA512

    953c923271ef154746ccbfe502944aca1993a621cf23faac50ae553a2717cf63ce17c8a7f6bfbfa3087ca0ed975bf4409448633d18cc51c9a04417b20bdaa54d

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    711a95e44dad230fb9a6ddf174643de6

    SHA1

    8c6d0af56542b7e0fb23cec282e0bdbe3b6bb67f

    SHA256

    177082f7d55b8f051f0fce0f669d6ff8d859a642d6d19d1990a5830964d0160e

    SHA512

    f3abc77869282afebb55c23b3b8e1426ae02b612369cb80b9eb599d89448eb1cc46fe4d690e6c2cd25ae36dd6c34ebd05f59057b36ecb3d7015079650c41e65a

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\IExplorer.exe
    Filesize

    488KB

    MD5

    32fe05c3d403a3a74b91ce19ca6fe8fc

    SHA1

    d47e4c85a076956ff66806f34e2a58897c45522a

    SHA256

    9261ccafe58311579a312779eadde6e38332cad11a4dd612de9bd67f3a0a29e7

    SHA512

    f489b4e0197f09f97c667284aaaa09bd079e55049424631b5fa77df29704198fbd367efac7faee4c49bc416af32efe2c1e5da44a18bd40da9360852f95217366

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    026631b8d91052a8be034f8eaceb847a

    SHA1

    bb928341ee38f3d221c14a32de2c58bc237e3731

    SHA256

    539335f7192df7a61133e8ccec9487fef4f8eebda8d20aa6a84f85905cada4da

    SHA512

    fcbf91c829bd4153bcef4cd3d6ff6f5413e49709988dc0ddaa5a3841c8643b1cf36fbe5d68b500f8a023c738d283cf362b16970ebdb97265cdab353cc6e2e36c

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    1bfa3afcf3bffcf07cb542fe14b6d813

    SHA1

    f47123edd20b589f189cf89bcd2ad1ba1d22974c

    SHA256

    695d598c09e86e67c12162af9b3d6c75de10c13cc53847bbcf62fe432bcddf3c

    SHA512

    81e3625ef236836d821de594e861f0f2b18321700d3d77088430001689a07c8b91d0946bd24164c31afc3683688732761c932b77386658cb3943d510efc30cf6

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    34043d652c6669c2bb3de1aa396f48b6

    SHA1

    02d07ad408073ca4f0424fd6a8dbff81f204f5af

    SHA256

    ef43e3690d581f49a3b9d534e8ff3873f3811124c5b08ab9e0654e9018d5f34c

    SHA512

    b6d99ef57767ba1aaf9725b607dd64f59c5bbfb349a276a3e847cc5eb96f2dc95ad8f5cfc93bef9c386f2b74330059e0664daf6856192df2c77b5e29b4ab04af

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    19508bca16e088a656a910cae309f3e2

    SHA1

    6a8d25f0785e5301453eb9238656d012a84566a7

    SHA256

    b9c56b5445a76781810cdc4d9704130b74080394d85717803c292cd5497526d2

    SHA512

    2c43a0cb04c4aed95469182069a50f35942906e58b870c57d2b4fe028d0a35a63808eb1e3891e094d9f0a25ad321684e4c7c141ecbac360627e34ccf21da2588

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    2a8280a02020dac5225b9e4a6b0fb36f

    SHA1

    412923e7e4f1c046697453cf566fb325f6e3aea9

    SHA256

    7f9a0cd7c4cbd679ae187fd5d15bb89520cda172e86669b7d887e5dc40714df5

    SHA512

    0547fb4038e0273928092673b6e616be39aab8ee7a6b6566916e0d806282b0281a5a1894ef951193e50254541e0e0ebc4455c75d7a931815b8e626ceb14d655e

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    488KB

    MD5

    9ee767785cf562068c1a8c6407d7b787

    SHA1

    57525e8b13d02b36745ee784e20fbf3748b1bf1b

    SHA256

    4c00025c8ba353d44260ccdbddbbdc41fdaf6a1d2bc5be3cfcd424b395da3ec7

    SHA512

    2caae992085433d14a291a5c0c62df163049bc546f8069b9d3fa77db1d8b515fae15bedb06e50a6c6fb30e86f2a79217d0b326ca73effc33a014abe70adf36ff

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    8dde1ec3939a6d92380faf2cdfde790f

    SHA1

    38ae0a941e6435bd028adf7427bf65b50da22077

    SHA256

    1eaa8790c42a46122fac7a1b81efb449af3f37535203a309a34ab34a1707e00f

    SHA512

    6f02ade870bc51d67e6574f5f82e2e642224c1576547c1568e7ffa89c3c187108bcba2b42ec3c787b4ac43f218a51d2423d1620c954b121114045078785419ec

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    abcc640955db81d2af8a6086f729d1ba

    SHA1

    7c39327a6b25cd8083503fc95667728917ce8695

    SHA256

    8410a53c5966ec4464b52adf096221e12013b3703bfc7eb21a0c47126a930d87

    SHA512

    f83ecb4ae48162857beafbb357df42ed192311f2ad5a504df3a25338800925128dae6ac717b2155148dc77726d6063ef6d16cf56b7127747fa62cbc4d84c05f9

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • memory/1280-166-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1280-178-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1280-171-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1628-179-0x00000000038A0000-0x0000000003E9F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-180-0x00000000038A0000-0x0000000003E9F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-437-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-100-0x00000000037A0000-0x0000000003D9F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-110-0x00000000037A0000-0x0000000003D9F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-271-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-274-0x00000000037A0000-0x0000000003D9F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-111-0x00000000037A0000-0x0000000003D9F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-165-0x00000000038A0000-0x0000000003E9F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-98-0x00000000037A0000-0x0000000003D9F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1648-181-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1648-230-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2116-410-0x00000000002B0000-0x00000000002C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2176-351-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2264-409-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2312-294-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2632-275-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2632-99-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2672-287-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2672-227-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2672-286-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2692-417-0x00000000003D0000-0x00000000003E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2692-416-0x00000000003D0000-0x00000000003E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2732-370-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2732-112-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2732-455-0x0000000003790000-0x0000000003D8F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2760-444-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download