Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

23765acc56...0N.exe

windows7-x64

10

23765acc56...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    15s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    01/09/2024, 11:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    23765acc5648bb69a661441140d8a3f0N.exe

  • Size

    351KB

  • MD5

    23765acc5648bb69a661441140d8a3f0

  • SHA1

    c150de336ac88baa3a1adf5fd568096e3d6c0d1a

  • SHA256

    64286834e52595b260106d182071f719b008117e1ddf158da2c9a2a598c58303

  • SHA512

    f51bf4a1b0e9dfe665763a7d4bc5ad8288932175c602c3e79b29e6bbc965a7055644bceca52894ce44b8771894d433452b8c6ac31928b47f95efdba2ba0884ae

  • SSDEEP

    6144:V/OZplTYZplx/OZpl7/OZplx/OZplQ/OZplU:V/MTqx/M7/Mx/MQ/MU

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 6 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\23765acc5648bb69a661441140d8a3f0N.exe
    "C:\Users\Admin\AppData\Local\Temp\23765acc5648bb69a661441140d8a3f0N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3012
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2896
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3044
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2284
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1140
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:868
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2140
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2628
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2224
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1272
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2076
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2784
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:840
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2900
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1564
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:424
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2544
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1800
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2132
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1028
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1792
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2664
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2968
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2156
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2444
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:800
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1496
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2796
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2324
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2316
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2980
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:784
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2916
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2724
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1240
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe
    Filesize

    351KB

    MD5

    0874aa577398b55fc32222bd7b76942e

    SHA1

    074a6bba6baf8a72db972005bc30300b60c919cd

    SHA256

    171b3214c826ed616a5fc0d3f3bc18b175967468a52f33301c8635f8245af716

    SHA512

    58a6908ccdca4b2834b572c6212a51ed5660cc5c5d96616d1c5aa5906c32bb8cf09daaf2e2fd9d9ea373cac6c421112b4e115bc798ec98d2ba1b4df5daec099b

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    f6422a1bbd01599db021675dcc813c32

    SHA1

    9c23747802391912c3beabbb0900d418b32af4cd

    SHA256

    e02fe3a75be315202922a61b6275fb64123fd02eaab94c25a3b04d1e5ad14aab

    SHA512

    5e0741048944e7050e1b4a939382318bcc63c654a5d1cb9d7a2bc5d72a61d9137d6785cd30207522c712d16ea4bfa1e5bba2642913748a741c5b582437b97416

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    af84d23d502da8f46b77c450dfa0fd0c

    SHA1

    c3aa6c2b775a157ce13f5237ab049ebbd747cf8b

    SHA256

    c477b23fe83ff5cce242d40d0cfce93716b12e493c5385ab4396128ab9365aa9

    SHA512

    c9fbf128a202420685df30b75f409bace725c366493e9a921556804995dd3435bfc4df469c5ff040a858c1269032c7114b45ec5c6edba090014908978ccee5e1

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    75f480e6760f8d2716b1370420ec2aea

    SHA1

    e6ea95e9d02bd67c4864659ed38bb862b3c7d3d9

    SHA256

    5ee24cb168e2fac2e47265e58b7a48b613e01e58b57dadebc81923dcf82792c4

    SHA512

    e695feddc7db2ab653a8700e24a3df313646888864cb72f0af91b10a99dc96c93b70c892d2e40bb39058fcaa0843a81e5cf9c2c64015a07ff068534187be0732

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    933a06dddddff2cfde839700f4496214

    SHA1

    a8b7f9a0b26497b94e19ab18c962dd520a8d9396

    SHA256

    9fd61047d5e9cb8093eacd5e54118ff70b7d1db8355029168b7a6ef6c3f7bc75

    SHA512

    a5008295b1b7b4ab40970762924d4689caf273a18af8dfb71fe9008cfb99a4a12766c66a0a46b5648eb98f086b6ed968002d6e3155496bcd548141e290ef0887

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    2692bcb450b8631066e5868da8dacc77

    SHA1

    c5ab58d67c3a36c6d27307e6b3ede05f745ea11b

    SHA256

    feb485c3eac0448306401db59fed0bbc172d25221d425e94db0304a0c79cac02

    SHA512

    720f84c8f2626b943da5e3067c25f123150d0556e7f81e3f41398d939b44c7051eed24f9d2f33dcc11e02d74e0931045edd135ac1557a353e5277cbb0cbd20d0

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    351KB

    MD5

    69232638593032806f09030edfc00648

    SHA1

    fedeff91ed37a9bf254541a7c4f88df04d146683

    SHA256

    85bbcfde73af746f989430837013b29e47846828f35ba16fa9f3860437e051b4

    SHA512

    d3ba95e879f9c12f6b75232df651009ace348a14afd8d4c05e6dfaf178d7f0916da184983b0f4cbf84ccee3448f5971b9d224224a5e76e7478b4c3a8578adaac

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    351KB

    MD5

    30375a4570ef64d01cc297144553fb9b

    SHA1

    dd66c8ca45d6ef310df59c206f0e4fda1bc53df8

    SHA256

    0f144f87c8580e38aaa5b03aa9f3a67cf82b6d55197d61eef4f8d2374bc6a5f5

    SHA512

    c70154be4749586cfd2ac232a6bbb28711fa310040f44ff9056a6101cd6ea57c9ff93d4ecc95aaca743a65d9b51ade8f4f3144e2229cb4ad26401c24b19b6b92

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    017fdb12944b827cd3b3e96f34a01034

    SHA1

    c7338cb7d46e33ca13cbad2e468ea9f0a023f18e

    SHA256

    f8bb55b6fe770634327e3d0b2b3348c9bd2dc9802d5060bdd9a4752eafd19aa4

    SHA512

    00c1502693d16ddf72423af32dae4d6b2f6e9e20a0f91c7bc70dfe6f131780dbd8783d9b73de9f8ec64df58774a1fa591426f19b1803b3415ed566d8d7e12c7a

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    1c9456d9116e0ce528b0980ae35c6451

    SHA1

    f212a432bde7693b9cc69080aa3d36ecf6ee37a8

    SHA256

    97ae6f22b7722e7fd37fab3a1101e1ad163aaad0e7e5c2bea1986ecead6f662b

    SHA512

    b244c5c203b1ee250285a0fa5a9ef7dd6fa27119b3291b8074e23a7ff88dfca234b8d86227e4af5d0f5b049469fb583a878e23e62168a2f1ee673376ad561231

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    351KB

    MD5

    8975c1bcfd2be299d4d7fea71306b239

    SHA1

    9caca183371c4dc3d1a70668c3723af59c99e259

    SHA256

    1ee927aa37297b2aea40aeea28ed82eabe9e8248e855597318fd592c6218c94e

    SHA512

    cd29fecf16616ae4cfb02f1a35ba1964d9a157e2d784bf05e46ac6cace6906edd38e46e0a11b5fec7a6d13536252587f3187ac701b6d5d91da3b7f3a29844d97

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    351KB

    MD5

    b4fceb92579b68c6a7a2cd51e882e2e0

    SHA1

    e632b8a83b62e73611da0ba1740eca09d24351ee

    SHA256

    eac5dd2b2ff8d6ce425655031def353e891db54184ccc47d9533208999ddbf1c

    SHA512

    acdae5b4c380f0098e04e027a789e1f54ca0afa39707b8b2420cb265c57e0fb1447bd50b220cd7120015feed3f0d036f31a060cfcdae78a6faff8ef49dae4142

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    351KB

    MD5

    d62a50e272bd54d4be8c09cdeede93d3

    SHA1

    3365a8176075904fcb0862d3bf7d20aa4860f7d4

    SHA256

    fb8c623736776037008a7e5266410442288a25576f42b0f23d03ff1e8abe4b63

    SHA512

    8b96dbe8a1fafc2cbb73a5731e563015ace798252af55f958974644d8f1c1c9302dd70685f3cbd55da50e1748fcd60d7f8df0352dcb78eb807f459c112eec069

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    035d6dc05dbc1269adae7e2e7f32c2b6

    SHA1

    645e45eb49ccf47d0b283e77d245372a5063fb28

    SHA256

    1b65ad95e67326c02737d5d6fdc07545da0b0215d9fb5f2bb7b78b6ab139e536

    SHA512

    3161aa7bd538ce84e12e993777cbd1c7e3de09ad5b766454c39e73a97b3661c7b1da9763366a2042a371f529aa1ffccd2873bc697d243ff214559d6d86e5963c

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    23765acc5648bb69a661441140d8a3f0

    SHA1

    c150de336ac88baa3a1adf5fd568096e3d6c0d1a

    SHA256

    64286834e52595b260106d182071f719b008117e1ddf158da2c9a2a598c58303

    SHA512

    f51bf4a1b0e9dfe665763a7d4bc5ad8288932175c602c3e79b29e6bbc965a7055644bceca52894ce44b8771894d433452b8c6ac31928b47f95efdba2ba0884ae

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    351KB

    MD5

    820cd77cd1df6047d416ddd882a1f88c

    SHA1

    8257f304e5675f2b3508964f755032685e46a3e7

    SHA256

    0147df0a793d3d84830a278348caf3daa874b5bd2c2251e626e67c89e3d0c03a

    SHA512

    c468b3ac84fd1c3d59e00b5356fc4a1c1284c5c9ab00a9e170daa0457dfa1fed2570a53bd833874d0bcba51141378f6be9e14cf7277ed0bc9c6ac3fd54ba4485

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    351KB

    MD5

    636189e7671807b0fdd6a39c669f21b4

    SHA1

    c2dcdc6bd362ed01034c038741fe1c7f812cb6f0

    SHA256

    7d79d1b4419fe6b870b2845b0b8228dca1e4493be09d5b8a24d12a0a1f309b84

    SHA512

    13530fdf03050f4105efcfba4ecd96bd4f84483e508c85bafbabb46ca13ffabdb71de0c281418d432963aacb7ff9c3691546c5bf7231b4db99127c86e7160531

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    351KB

    MD5

    4f1090a3ae9010eaae3cb146eb54d15f

    SHA1

    c8af8f927b0a5027d10c7430a336eb4af1603c5c

    SHA256

    c850f66422b9c9124eef4f8092560490247dc03864340d45d86c0ebcd4ceb5e8

    SHA512

    cbc604b139074915cbc3191e421320b6d7afadaf3551297545839f5ce21bc2a7ca8a4f54822e42e8dcb9e74f12db38159196911312596789b7deefcb826fbe20

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    351KB

    MD5

    775b5786170f538289fd1e9c62c5b928

    SHA1

    ce322cb35df103852c687c5c127cc7761f3cff16

    SHA256

    addc246ea350c325e1186e29c669226644054632819fa925d5e1ceba56166cb1

    SHA512

    cde34ad5309bbc735dfd8c6b5394291a28884e3852414dabb211fa6fdc77bb1e6b67a9d989f24183251b8c16c272f627b7f05b55c123e31a565a17a7c62ede2a

    Download Submit

  • memory/424-446-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/868-333-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1272-434-0x0000000000300000-0x0000000000310000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1800-334-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1800-112-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2132-289-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2156-232-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2156-229-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2156-208-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2284-243-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2284-236-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2324-418-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2444-238-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2444-279-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2544-338-0x0000000076BE0000-0x0000000076CDA000-memory.dmp

    Filesize

    1000KB

    Download

  • memory/2544-337-0x0000000076CE0000-0x0000000076DFF000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2724-389-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2724-388-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2784-392-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2896-417-0x00000000034E0000-0x0000000003ADF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2896-235-0x00000000034E0000-0x0000000003ADF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2896-100-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2896-233-0x00000000034E0000-0x0000000003ADF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2896-278-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2988-438-0x00000000002E0000-0x00000000002F0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2988-439-0x00000000002E0000-0x00000000002F0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3012-206-0x00000000034F0000-0x0000000003AEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3012-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3012-99-0x00000000034F0000-0x0000000003AEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3012-98-0x00000000034F0000-0x0000000003AEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3012-237-0x00000000034F0000-0x0000000003AEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3012-109-0x00000000034F0000-0x0000000003AEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3012-111-0x00000000034F0000-0x0000000003AEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3012-440-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3012-421-0x00000000034F0000-0x0000000003AEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3012-207-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3012-347-0x00000000034F0000-0x0000000003AEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3044-162-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3044-234-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3044-231-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download