Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

23765acc56...0N.exe

windows7-x64

10

23765acc56...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    115s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/09/2024, 11:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    23765acc5648bb69a661441140d8a3f0N.exe

  • Size

    351KB

  • MD5

    23765acc5648bb69a661441140d8a3f0

  • SHA1

    c150de336ac88baa3a1adf5fd568096e3d6c0d1a

  • SHA256

    64286834e52595b260106d182071f719b008117e1ddf158da2c9a2a598c58303

  • SHA512

    f51bf4a1b0e9dfe665763a7d4bc5ad8288932175c602c3e79b29e6bbc965a7055644bceca52894ce44b8771894d433452b8c6ac31928b47f95efdba2ba0884ae

  • SSDEEP

    6144:V/OZplTYZplx/OZpl7/OZplx/OZplQ/OZplU:V/MTqx/M7/Mx/MQ/MU

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 6 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\23765acc5648bb69a661441140d8a3f0N.exe
    "C:\Users\Admin\AppData\Local\Temp\23765acc5648bb69a661441140d8a3f0N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4020
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:232
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1724
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3040
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1380
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2496
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1356
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3640
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2068
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3748
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2684
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1552
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1220
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:5024
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2032
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2304
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1132
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1964
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1860
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4072
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2272
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2400
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:548
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2376
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3180
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:512
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2784
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2480
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:4352
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1228
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4768
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:224
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4380
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3316
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1696
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5004
  • C:\Windows\System32\mousocoreworker.exe
    C:\Windows\System32\mousocoreworker.exe -Embedding
    1⤵
      PID:1380

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Replication Through Removable Media

    1
    T1091

    Execution

    Persistence

    Boot or Logon Autostart Execution

    3
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    2
    T1547.004

    Event Triggered Execution

    1
    T1546

    Change Default File Association

    1
    T1546.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    3
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    2
    T1547.004

    Event Triggered Execution

    1
    T1546

    Change Default File Association

    1
    T1546.001

    Defense Evasion

    Hide Artifacts

    2
    T1564

    Hidden Files and Directories

    2
    T1564.001

    Modify Registry

    9
    T1112

    Credential Access

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Replication Through Removable Media

    1
    T1091

    Collection

    Command and Control

    Exfiltration

    Impact

    Inhibit System Recovery

    1
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe
      Filesize

      351KB

      MD5

      8ff9f1fe2efeb196745d6152f3e95c79

      SHA1

      2d427f3b3bc40489d162ae682881bbbec79f923e

      SHA256

      840650ecc05ae2004573d2eaa630bac2249a9e0ad2e3fe505cd0f47ad0e8a2a9

      SHA512

      5ebe778e3a6c0fdc402fba0458f5f3e363bde49aec7f2f38c47508e2b8ef843c42f0a8c8626430ae388c5b71991363c45dad0929080833f8249d65a6085d8ee5

      Download Submit

    • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
      Filesize

      45KB

      MD5

      22d97a087520c65ac739f6420d6c3120

      SHA1

      67d7bc7836091892ce2472094847d81b7d9525af

      SHA256

      96e197ee41a089e6bca743295271d9c1fe08595b7af6fb27ad3ee7f880138ed7

      SHA512

      04aef5d296320aa11287692bcf7f7e676b5e3791f6ad67d30a29fe8a9a88d15d64f7de4aded593b2420ec457da63aec4643bbd941132c3b5ca5fb1a300932f51

      Download Submit

    • C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe
      Filesize

      351KB

      MD5

      9d639a2c82563fcb34ce48e90ceb7db2

      SHA1

      14bb1583462adefda1c34ec1f6bf0f5bd2500678

      SHA256

      58e369a656170799b66459c07a481c981fa564b94719e9ab60c0802d3ee84992

      SHA512

      a2eaf5d57d6b0c2ea2f9235a52a334de06cb06afc2131cc0ff6dca87a8c9b8f5aab8c6eec3c770e8dca72f3b72fe660d3c3a8e23a15cf02d40c67d29b50b04e4

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      Filesize

      351KB

      MD5

      374f8cea8d5e553a87c044ef4bd70b1e

      SHA1

      adc8f9f884117c8309efe2903f9b91f92d04d6c6

      SHA256

      12b99f98bb3d385de816bd361e4131d8c4e1a77b0c14879c41fe44aed3510ae2

      SHA512

      294fdcaddeccfa8242bb77731f3dd85bce41976a8d3d16d22794ef62d3324c07a554910c0bce51fc5ff97c8b50c7a8f411e439d3574442111f12e66c0ef02829

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      Filesize

      351KB

      MD5

      8b63d2a51553c94e3ba841b9f8371c2b

      SHA1

      a3cdcab4f69e6cfe840587ece9ecd8b6bbdcfb41

      SHA256

      98352aaf0e1d97c760d3b115ae161e17292070204e93db72449817032d94241a

      SHA512

      2c69818a39d44ee3e7dbc93ec048f8bdddddfbb2330238a51943699ccbc9d44fbc055ce46e60d2945d7f79b25972ac21941e07d75284cf9e63c197028c2f2c32

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      Filesize

      351KB

      MD5

      d2d1b2e4c7dbd4f9a962e0727dcf714a

      SHA1

      43c568fcdfd6016fcf71a998de9e435b8a27a27c

      SHA256

      9df5eb47e7646edd81ff065b80edcc5de3a6ca207e53a6e5a8f0c05e25505751

      SHA512

      2dcd409dfc2f8708fbb9c437054a957726fcb72ca389f462580677f5476a81fd5eb206c902f2c22c544da9630602e8c2ba86737521a3103cef0fd68a1719567d

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
      Filesize

      45KB

      MD5

      803c2ef7470b19168c47e395e51f5e9a

      SHA1

      1f19bc251b93aa841c79c51b05eb5d9d8606e7e7

      SHA256

      6d99943ea7624b8eca909a2e697a25dd3ddd42ae9950fcfcad99dc8795d03d6b

      SHA512

      0f6da9faa641a1c2ab3fec2331f0feacef795d30124a5c082e121d23861852e8d5d2a59092b6b22f67cfc95fe7001f82202a41459c075b32d334cf43da2d43e8

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
      Filesize

      45KB

      MD5

      cf53578b539edd54194d2d7c9bbd93d2

      SHA1

      a78cd60d218bcc977c313d35aa0ca7c73138dfc3

      SHA256

      a82d67f8f36135ee61bf2a1c5288063d2de2e99346c40f8855d6e55f19dba87a

      SHA512

      81225934ef8089571538416cc0779bd58c00f9470012685d56316486e60dd65f6dd3baa4175edbcf3a606608e61684fb65f5021a2ff3c8b02973b053d21363de

      Download Submit

    • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
      Filesize

      351KB

      MD5

      f668fa1fa361178a65d1bae5235a6ecb

      SHA1

      15635794eb23f64392a2b8402a943ed23d1b7d78

      SHA256

      f8780d2a9e30f129961b322db0ede9900bff0198720ac0ee71e218f7f228d719

      SHA512

      516a01360e84da74051ab6ea4e030f9b429afd8f0b0848bc3d4d04568e8483450237b9e295140e87b5db877080665d3be7d7c315fd0278b095c16a93ca350032

      Download Submit

    • C:\Windows\MSVBVM60.DLL
      Filesize

      1.4MB

      MD5

      25f62c02619174b35851b0e0455b3d94

      SHA1

      4e8ee85157f1769f6e3f61c0acbe59072209da71

      SHA256

      898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

      SHA512

      f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

      Download Submit

    • C:\Windows\SysWOW64\IExplorer.exe
      Filesize

      351KB

      MD5

      b0058b1f31531a3c2a9c260f159eddbe

      SHA1

      aae32171ffc19125edde995f1ea2b4b0efb117cd

      SHA256

      2deabfcb842bc5acec43c6999c34af16cab8f07b9b5c5142f92b843011e06bc2

      SHA512

      f7cea09c011279b7e1e4e9b6a8e0801807d7dc7d2f973a09d34e5b231d6928b7ae05a94cdf77af5861fc6465df1b76610f0a5eb7a862d0ca661163f53ae524d1

      Download Submit

    • C:\Windows\SysWOW64\shell.exe
      Filesize

      351KB

      MD5

      27bbb3b7799b37ed2ce7c6cc6855651a

      SHA1

      7683747895bc1177e4868b0dcb3ca17920dae74f

      SHA256

      d687811b60efa7c1a15b1147af7ea6bcfdc1cdd4fdb277f9de9e29b7c62c4d97

      SHA512

      d1a1f479346b4c0b5ce64f4c3157def7b67e0ef75d1c576ab4ff8353d31627c5db59308cc12232d0c12d77bf18976f63014005545d4fa2544c0cbb0a89970a74

      Download Submit

    • C:\Windows\SysWOW64\shell.exe
      Filesize

      351KB

      MD5

      23765acc5648bb69a661441140d8a3f0

      SHA1

      c150de336ac88baa3a1adf5fd568096e3d6c0d1a

      SHA256

      64286834e52595b260106d182071f719b008117e1ddf158da2c9a2a598c58303

      SHA512

      f51bf4a1b0e9dfe665763a7d4bc5ad8288932175c602c3e79b29e6bbc965a7055644bceca52894ce44b8771894d433452b8c6ac31928b47f95efdba2ba0884ae

      Download Submit

    • C:\Windows\SysWOW64\tiwi.scr
      Filesize

      351KB

      MD5

      1027dd81b1a40b763f9ce418c18d040b

      SHA1

      37e49312affba990ecfebfa719c4ddcb4078f237

      SHA256

      60948dea240e9d8e081d26e09814af20b5e2c272f313972d48540c1f7b9c15d0

      SHA512

      ec31d7c8a6025e78bcb77712e42866cc37a50ddb501b57bb358525db7c25a1ff49fc4dbddf9c92b9e8eac194a76951af2da28bee458cb12038b858f47a86fb54

      Download Submit

    • C:\Windows\SysWOW64\tiwi.scr
      Filesize

      351KB

      MD5

      36e59040d77015bdbcd5c1df8338f8e5

      SHA1

      59e4a4af23a62690a1479c171d6c1bd6dfc8f230

      SHA256

      0862ea37b2c0953b723df8c5181c8e960c712bc3bf7a59074805d84283cc2d74

      SHA512

      0c8e254646d7aff9d990826a350af8ccb036d3dcae5802cafab97ac903d29707d053f4676674c2265329e140813491b78c1c6c1e3d4333e2c3d543f94978cfa8

      Download Submit

    • C:\Windows\tiwi.exe
      Filesize

      351KB

      MD5

      4722cd9316845d3765dc441c395adb3d

      SHA1

      80bead33a437eae7d3884408efaa92fcf67c26fb

      SHA256

      86f7f452633a61c985c57f1125191370c5d92b6643bcc81af08066b05f1448c5

      SHA512

      726805dfac86013ebf1177569069ce3195c8182c7d6704851b149d403aca5ba122e50b618e108928cfdec471d474c3516dcd61e004de79959abdbab08ff37cd5

      Download Submit

    • C:\present.txt
      Filesize

      729B

      MD5

      8e3c734e8dd87d639fb51500d42694b5

      SHA1

      f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

      SHA256

      574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

      SHA512

      06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

      Download Submit

    • C:\tiwi.exe
      Filesize

      351KB

      MD5

      558797cea1feb8c7e2fd6ac77871b568

      SHA1

      c085d4c15365271cf82fbfc73dc9431be48e074a

      SHA256

      bc77f8dfcc06186ebe456426a584046f8535c30da09168f794b3b7cec2770bff

      SHA512

      bcc7de3e2a76ace9a510c42c3c17d42cd3de42ffe5c70c04a675e76c02037989f51f9bf99f26686cae0b84b44ec5b733efebfa3c413191d95aeda3fa527764e2

      Download Submit

    • C:\tiwi.exe
      Filesize

      351KB

      MD5

      b076bd7e9094eda452eb9e01bcf714cf

      SHA1

      c539690fc67abdf25ed90e36fae2f5027bb84346

      SHA256

      81f6bc28355d7531812a9b8fc5edcbaa832f97b94edf743323cf5424f7ba76a2

      SHA512

      183300f7bf972743791be240c19838da0f9104c935a0dd4c640cd31aeabc5fa6323eed93d8e605fc01a495f775ba349be41ea3648b133bf2933f59598364972e

      Download Submit

    • F:\autorun.inf
      Filesize

      39B

      MD5

      415c421ba7ae46e77bdee3a681ecc156

      SHA1

      b0db5782b7688716d6fc83f7e650ffe1143201b7

      SHA256

      e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

      SHA512

      dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

      Download Submit

    • memory/232-285-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/232-95-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/548-403-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/548-286-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/1380-289-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/1380-299-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/1724-193-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/1724-202-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/2032-301-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/2032-313-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/2068-281-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/2068-275-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/2272-167-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/2272-198-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/2400-272-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/2400-199-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/2496-312-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/2496-305-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/2684-314-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/2684-304-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/3040-204-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/3040-277-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/3640-101-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/3640-288-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/3748-294-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/3748-283-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4020-282-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4020-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4020-377-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4072-168-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/5024-300-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/5024-110-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download