Overview

overview

10

Static

static

3

8257ff4784...0N.exe

windows7-x64

10

8257ff4784...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/09/2024, 17:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8257ff47847e09ccbab2e5cfda7410d0N.exe

  • Size

    351KB

  • MD5

    8257ff47847e09ccbab2e5cfda7410d0

  • SHA1

    5ceabe7df050970c089cfd2afe6a8fbb436b153f

  • SHA256

    55eb705061511f6e4010b51b9ce7c218837c0fb4a2e97554540d6546f00b40e9

  • SHA512

    6f8ba8b448ab0acf4797c952353f0e5e940c497d339e2164b7e67a081a06cbfb37f23acb3a56f83e90594a2840289abf638c74715f0e307f033c044a6e9521bf

  • SSDEEP

    6144:V/OZplmYZplx/OZpl7/OZplx/OZplQ/OZplU:V/Mmqx/M7/Mx/MQ/MU

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\8257ff47847e09ccbab2e5cfda7410d0N.exe
    "C:\Users\Admin\AppData\Local\Temp\8257ff47847e09ccbab2e5cfda7410d0N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2232
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2648
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1044
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2164
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2476
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2368
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2420
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2088
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1700
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1820
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:592
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2668
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1484
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2284
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:896
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:540
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1028
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1648
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2952
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1512
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3040
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2788
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2828
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:340
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2056
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2816
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2684
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2576
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2020
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3060
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2064
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1596
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2796
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2916
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3056
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    c356dc66c65736dda449f514ce044596

    SHA1

    5248c70e87d9d644dc72021c9fa6fa03068806b3

    SHA256

    c866ae0eb71a8b15348671325ebe383d88718b7a4afe1b4d6ecbfd1bfa25588c

    SHA512

    23b43e785869c3879817f849d2800af5578f8cc5d5bd142d8a8466ec2d422d4ef24eb47e215055737f1c3c6b14cc70486bc261f92c05512eeb381f722c37ac8f

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    dd4d4d5107a389d5ab8388b3957a8390

    SHA1

    cb6131802a738f7b108ba09e1342aca993b6c284

    SHA256

    3a10593a8930cc77f796b73ef1a0830521443492d38b947e85717fb874b693bd

    SHA512

    1d18a942b2a167e717930205251f1fb8f884aca89eff273746c2924dcca36cfd1b873fd825dbb9f5cb9e863f53fb52ac9dede7fada6dc700f2368a068972a9a7

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    6aa7029d4761ff6c7d8f5bfce8c6dbc0

    SHA1

    19f6ecf4dbe99b22b1e8999511b94aaebb657f27

    SHA256

    7f80fdb87e6388abeca8a7e807924ae58a4ab93373815f01b3cfc7635412be29

    SHA512

    e37a649a90d02015dc11ab7d9d92903fc16334e0082ecb793b067a23558d27e3d1b42d9c7d683894db30a8873c5feb0c5334b026ae0082750e7abd9155555349

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    3ccdb68f09f8fb0e7d276c6d6ba8d538

    SHA1

    8f9bde78924f7dc9677d08032a7320b74f92fada

    SHA256

    50aa229501c10ae6bcfb292113b5c62179bff402dbc08dc3ac71b35f63feece2

    SHA512

    847800ccee5d73b964412bd741fb07c9b8ad1cdaa7c4df69e6cbcf42d93548dde90f4b4148eaec252f203b4df5f70a5031bb324529c78350426f00f6b8a448ee

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    351KB

    MD5

    dd24744a52930164450b0f010883870e

    SHA1

    9227b543563ff4489292851725332a80bdba7586

    SHA256

    9c65e288312dcfc26993566e0bb3921fbceae28292f5018d6f15ad89f240d94d

    SHA512

    264b6b8da8bccd02766759f827c163367a96438d9cfb86d449af81814373ac94a2bc62862dc2f9af2678b73e78513b27cac794d27104f61cf78809705ed9edf6

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    351KB

    MD5

    cc5c366c406a3f89154d33011d934d26

    SHA1

    b48d0a5b4e52f670dd1a24195f8a25da3dbfb776

    SHA256

    f0551eb04781a650b64183f53bb335d561ecd51326e638873bc22017706e28d7

    SHA512

    82dc6b05a4de1b060dd8719ab88a2d23410f59edbf9f9cca0bffeed7cb1482c3136478c489492595f6c6fa7d287d13d3a9d306e59b23c4b97d3d2e3a6ca93b4f

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    09074ab82ac3bde5edf0024ee7a875e5

    SHA1

    df8c8b551807f9eef46cc462fdb838548ee366a5

    SHA256

    03244049d0f0902399001441912ae62e1ab0f84f94404c79ea2584da5ce4892b

    SHA512

    0271b5e6479712086eae21d1293a3d74c60b6c60d77b6c2d60a09f3058f10414e94e8d6ba2abcdfb834309e94dd4eaccb2432715eb72cb4737801636fb6c6fa5

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    c2e910e8fad2bbd6aac6b08b1ccc2b66

    SHA1

    8d9d2b151f5072feb3dc70dbb0a9b857a684bbb9

    SHA256

    c1ef075d6b5601ef41099c696e5529961a0195576d75978e66cbe4f36de839d8

    SHA512

    f84fd12026e6e757795713afe75a68cb63b2d8c18924ac55701f30140658f1a65bcebbc55e481857d91dab253e41f251ded43d308ccd71b61e31f09db9223d2f

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    1f0e2ff08c4aee0f66aefa110e0d6c5d

    SHA1

    339784e9c714e9c5700e4b263b9150e03a1d3215

    SHA256

    d9b4b2abbd6142105ffa04569f941bf3f9e89da412ec911b9fb778c09ab63853

    SHA512

    912c6dc6469d16e35ac9be13ac656245ad3f06832b541e02ce1b26bec14fb3e1d62039a65cdcda3594785e2e848c40974b14d5135a4de3e479064617acfb5b42

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    351KB

    MD5

    8ec70a00230896f601ed96acbbc2eda0

    SHA1

    180bdded9eaa201f8636d89c8fca8328c3284fd0

    SHA256

    9f5ce96a7afd2ab31892836a084cd682aaaa169f7d66156beacedaab7f441eef

    SHA512

    c04824e1ac858818c5314ece2786446266860c432f469c81d0d81ab5a8b887c4d3eee2b5e1519f4de654185b3d6cb2d49a5202517e86f2f0edd69098f36c7543

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    351KB

    MD5

    69c1d5b093c6a20d520e9be67446fdba

    SHA1

    29ca033ff66d68f4573a18b102b122a357601db8

    SHA256

    8e1e8f5acdd3b1049ae0a51181182d086fd7d5855d03269a52027c48f56ea9da

    SHA512

    e8fa1c61636c28bc2c2bf2686f440cf40cdbd6b75da0c474cfc4d7b39484feafc4440d32d7c3cb15b62d37750b690e087a5362586a4f1b98a442624b7bf575d4

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    351KB

    MD5

    49805a310d3a0f41cffb5d8fd1d57886

    SHA1

    a6d371de109459511bf66a89f5d004722d1ddd05

    SHA256

    a8a7e7288067612740bf3ae449b15a8b1e69200ea15d0e2c7aa8cd68de5541a2

    SHA512

    3f9ee34eb99640300fff1da6bef3235c7a12db7e920a4769d7cd785915a52d92aac474ff66c51d01463cf5c491c5426935b76863a329da5c6b9c10f1375820c6

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    83f00937d358425268553803dbaebacf

    SHA1

    7be990ac8d71ef8b80d40a0a2f335a26a8c7364a

    SHA256

    88b276e0d962d594bfec9cfe156e407dab4d8039d03ffbc1c806f311c79c3d6c

    SHA512

    976e03fa8c87859e3b001694cf1208200f74e75322d9f902a6ac41392fd3564575730d43752ecb9143c58477fe6e8ca6e77e7ac6befd4f64d92070cb8fd59ec7

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    466283abde65004215be3cf08052595a

    SHA1

    20c132ebfd011d2ffaeccdd851e1745abe84aa01

    SHA256

    7503746a5d1d84ec00a1abf1871c21aa67b07ffa69fefbc7fc41db947aa6e2b9

    SHA512

    c7d41a0c2c244e60e1798ab11ad9b411d5392761049d46a92279fff278086a3b82124d198c4d7af8cc7fb432b9b3b1a9886a1e4ba2c1a7bc900574ad4cad95f8

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    745f3b77e4cc6caa31a8ed62b3ba436f

    SHA1

    fbce65f8541b7eb19d8768763901e685e780dde5

    SHA256

    a18661fdc7e3cc01f844650220ea44615fca028f4b2cfca28fa553cbc9e28f8a

    SHA512

    56d81edfd7bb0314ca229be3a0bbeee8f4a0b258df40ea3d8f5e11fb43b2707b0992b4de6cae57806a0e99d1421de0a3f79f684c69874b58d807a9fba1148b67

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    8257ff47847e09ccbab2e5cfda7410d0

    SHA1

    5ceabe7df050970c089cfd2afe6a8fbb436b153f

    SHA256

    55eb705061511f6e4010b51b9ce7c218837c0fb4a2e97554540d6546f00b40e9

    SHA512

    6f8ba8b448ab0acf4797c952353f0e5e940c497d339e2164b7e67a081a06cbfb37f23acb3a56f83e90594a2840289abf638c74715f0e307f033c044a6e9521bf

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    351KB

    MD5

    69e6061b1a5986d5d865dbe9c6e18c61

    SHA1

    20e5ddb687cc3c186f2927455a9732404acd5806

    SHA256

    44d01777d77ac9e0df7de3500586dda3c236a500fff6ce9dd0ec139afb71835c

    SHA512

    6339033d51ba98be8d42ef562040c46109f37db801675b74c2f1144ac3d73b4cc6c288e0b2172e9a0ee08e1b4d9e88a237f985dc94243b3126a6ad68c9c1bf59

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    351KB

    MD5

    5d82b526f75b2af567edbc4399b14558

    SHA1

    5c6d83a2b8a43a23600b9333227fea6d61573a53

    SHA256

    46bae229a35615e3a095e9ac3af5d85225a1a92fb754cf8d48cd145e6ccd44b9

    SHA512

    c4d82b073eef075f32b8bc927bbc698715c8076a7089a26a4091e1c5bb8cb4c2c44149b2ef1349370ca897e8a8804aed9ca7311943877d19da3107660bc14697

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    351KB

    MD5

    c2d39b8ebf7b11dc019b0e835de60c87

    SHA1

    776a05610287d02c1ee89ab6ea0150861f3c0fe3

    SHA256

    4982a6d170fab66ce21828cc9bbc5f7399122c37bce35932a7e598e81fe6e67c

    SHA512

    44c8e7b0d4521303b829d545eb84b27325842b91c286da84b19e6f0f24f24e17b78467071bc885904292abd70ba2479ebc36ce35756e74025605352430e73945

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    351KB

    MD5

    740b25b61a2acffa5981deb224fe6903

    SHA1

    71b54319339c18793eef6fb3200a185eaee3ece0

    SHA256

    da3d1244290ba0fa68cf8af3b5cb2d7b19d06c5ca6a2efe7a194613c78c2fcd6

    SHA512

    5f027997ef91f06476914205b9256ee4ec02ff570ed3b6aa6624998c2c619799d2b9259c24af896f5637f3a8d848c89b9fafde5fea2bb50810e29860a20a5de2

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    351KB

    MD5

    0902da5fcb0a992ffd75c69d5e839d57

    SHA1

    f2d6c8c3db5e7e277bc7adf394f26c27c9f72fdb

    SHA256

    af65a9352f8581374b7c1fcf8cc75e7b6f83e4f5c82f0d931930a2688e9c512f

    SHA512

    2bca9e4f44172f5bd6a2b5305e3ee57b40bc228bcbd6de46e1790ab82ba297f71a638d6c91da330b2cf6e96807f9aa2952bcaaf11a9d58879502521dd0f53286

    Download Submit

  • C:\tiwi.exe
    Filesize

    351KB

    MD5

    ed2bf582aad4c8efa2014ac9c466cb6b

    SHA1

    3b26566526f7da973b3357b1bbd0440365cef5ff

    SHA256

    6a53db5e41ca07d23d5a9b00ad3de8e48d2ea1c087e9897362585f86dd53064f

    SHA512

    fc3c45b0f91bfa41ec97e04df1469001c4875408aa210c530dcc9dc15562fa7f09dd5dda85f68d358782ba9bfc337036e98716ff0361d050887ae32ca1c17bdb

    Download Submit

  • C:\tiwi.exe
    Filesize

    351KB

    MD5

    87e1dddd3cddd9b910c5b8ba90dbc701

    SHA1

    d6c1c56f5461ba953214a29d3787bf78e82176d8

    SHA256

    3cc4363736051b5573397a9f61f471eb4050283489b8ee9353edf313c75ddf3c

    SHA512

    a43ff3d6cb8a8db1edcedd903356cfff5b4815e53e3fa7b3bd2b9b90b8be99ba700af244505d8815b4edcac5eaa2450063eeb748dd893b5dc24cb5c32ff84392

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    351KB

    MD5

    ccdb3bdbcfa7c6f1262cd1553c8ca078

    SHA1

    13a5915486465634df10f19ca142a63658c1d4ee

    SHA256

    50dee76dc3c073fe7196ce4d9279f83cb9c032f06428adc2e0221244718ea963

    SHA512

    b99d640019e575b442100084cb0c0833d08060686698106d6cd8f53fbaceb793a5f43355f3d8cec372bcdfa59481cb8e0be9e7420cc044fd5b2f0748d4479b03

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    351KB

    MD5

    52f678b1bc9ca9acc766c5a39b9b9294

    SHA1

    14e9eb7c6b098403bccc7b2285a288bc15c96e46

    SHA256

    e87d0a3b640053c13aaae5b733c49b95a831b11879aa785eea6b4be6620a8a23

    SHA512

    ac80628fcb92b1a8886cfdbb9ea73d928d4b50937fc890fdf37c194775e28db80b315431383dcb25b2254fbaad86b00db5c2e9a4a00c4280af03a74d105c47d8

    Download Submit

  • memory/340-451-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/340-125-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1044-264-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1044-281-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1044-263-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1044-262-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1044-453-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1484-435-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1648-444-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1648-111-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1648-284-0x0000000003750000-0x0000000003D4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2056-339-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2148-407-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2164-275-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2164-276-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2232-174-0x0000000003900000-0x0000000003EFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2232-123-0x0000000003800000-0x0000000003DFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2232-98-0x0000000003800000-0x0000000003DFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2232-124-0x0000000003800000-0x0000000003DFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2232-108-0x0000000003800000-0x0000000003DFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2232-110-0x0000000003800000-0x0000000003DFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2232-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2232-289-0x0000000003900000-0x0000000003EFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2232-290-0x0000000003800000-0x0000000003DFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2232-260-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2232-418-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2420-421-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2648-291-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2648-99-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2816-341-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2816-342-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2952-273-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2952-272-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3040-343-0x0000000077A10000-0x0000000077B2F000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/3040-344-0x0000000077B30000-0x0000000077C2A000-memory.dmp

    Filesize

    1000KB

    Download

  • memory/3060-261-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3060-176-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3060-452-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download