Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

4bf50a3b9a...0N.exe

windows7-x64

10

4bf50a3b9a...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2024, 23:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4bf50a3b9a2de2fd3e7a07c9a1381800N.exe

  • Size

    384KB

  • MD5

    4bf50a3b9a2de2fd3e7a07c9a1381800

  • SHA1

    88acc805347ad6856b34e0b21cad63ecdf93ee0e

  • SHA256

    f97932bb8d75d8239edadd768fa301261a246d5f19edcd3b879a1dc6237627a1

  • SHA512

    e3a16a13609e6b2d80a6ff429b857b77c68e9e56fa8cd8a47efda5ab26bcae7199e79a8503988ca3f4569ef6e3b35cf1180ef294e6647c5d0fb0f01c4c6a56db

  • SSDEEP

    6144:V/OZplJ/OZplP/OZplx/OZpl7/OZplx/OZpl4/OZplpBE/OZ8:V/MJ/MP/Mx/M7/Mx/M4/MpBE/h

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\4bf50a3b9a2de2fd3e7a07c9a1381800N.exe
    "C:\Users\Admin\AppData\Local\Temp\4bf50a3b9a2de2fd3e7a07c9a1381800N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2076
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2344
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1416
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2712
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1644
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2148
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1764
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2632
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1780
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1688
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1852
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1480
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2340
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1040
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:872
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:676
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2396
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2776
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2040
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1992
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2680
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2288
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2732
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2752
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1260
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1560
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2888
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:1932
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1616
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1656
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1920
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2144
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2892
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2872
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2980
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    7d04f891d89ee5bf131f0e982ecbcf83

    SHA1

    16deda2ac43c57eba2394a86be00ccc171fe75a1

    SHA256

    5f4b6afe6517814bbafc51f699ec65e0c640564cfeee4054e6616aa428839bc2

    SHA512

    9e5c609303836722ea0a3cce1edc5ad5154d65413530ffd63d320b1146bf68ff337910cd771f6e2820a2de161b86e407b6ae4121c0d67fb26df8661c4a2b1af4

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    384KB

    MD5

    aafd1eb982f722d8e8a0012b404463d5

    SHA1

    02da195bd22734809768e765bfb5fc878733ce2d

    SHA256

    44b7a6644da959f06dcc14028e8b24bd43ad96c6a1214273d8987f88169ae8f4

    SHA512

    40babcb94b657ab08ea09d3a9ac2b1ef530a96034fd69aecb5d3cf9de50a272602d9d93c13a9e9efa553cd55cdc2de8d3b78564c6004df254b455393aa10d63b

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    384KB

    MD5

    9afeeecdb3bb63c7e96f840cb150fe35

    SHA1

    98e12b4029f6f271cfbc58a15746c127a196a5b3

    SHA256

    63d91c1ae311a268ba321e7e3faabc44967e66b94c8717bdcbb516a86981fa77

    SHA512

    907272c10bc5292ce9ca08b54d490dcc8f76a471e14f85f618c1f586657743a965f129b58973d2e222d773e367f22f3a43686cc3d66b9056590f4f1bd5ce191b

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    384KB

    MD5

    93560b99b61a61c19118aae7e2fd23ba

    SHA1

    a6552e5c768bbc00dcd530cf97b116fc3d2966a7

    SHA256

    20e51e0e7eaa19ec730927118421733ee12124d60939860561fde589159e9e3e

    SHA512

    b5c022cb7b46bd499a0b76df3fdae85d69d1717c47950ec4da3ca62938140ae8220d78b535d1aa2334fac3a6dd0d3f10d470bf87c2c00e6f838a03aaeb458b47

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    384KB

    MD5

    ce3773cfad9f02c8fe546f6edd9bb7cb

    SHA1

    e0f07efce288c61913f2ee9b33d3a137799005e2

    SHA256

    cd69232c232d858793715e5ecb2c002c6ca1b605b5249602dff1c045c1fd494b

    SHA512

    e2b36459646b59aa10696cf04ab77f23fd4f5789f201cedbc170e8e0a420eef4564d820b9ba8f4a844bdc77b37eb6ca336816d0912a74603652b0ca889a19a3d

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    eb275ee4047bd94ba1f5bf06ad6af84e

    SHA1

    ab9aaf96c16af8905c5a247667e31ae17cbb1ea7

    SHA256

    7dfccf69bff05bc69e051b0b7d60fdea17537e4a20ce50377252341bedfc586b

    SHA512

    ed59899c257e17062a47741af39bdde0fa2c61cf1b8ce0c8799bcc8578efbf5c84659db5742647162189ff930de267cb96db66a630d1b082b76136945a7548fb

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    56fb2f8be1b2269e5b5aa9c72b8f17ac

    SHA1

    223db3784a9a875823b0496d80ec3cde483ffcd6

    SHA256

    2faa1423a7188b4118930b866a9957c57907a4212285581a2a440096206791a0

    SHA512

    9bd13ee1abd8a0ebb6fe64a533c18e88aaee976a111b4d6672c1cffd0b4db7c5422a6933c883f313034a374f330947c2f9f321f510619fd472647256b52c0db0

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    9e14bb768d285e1ee7c6d4ae7b82a728

    SHA1

    357aa39f982492cd6647cfef40ab22c32ce864f8

    SHA256

    2b836676d64f717f3c31dd118e5cbf7aef376b0551ed4d24d8c19ec0d6114ce9

    SHA512

    fc374af3c34e0e085c4ffca1d969d3fcbb40cd633ef919d9f4c22cf0add50195828e76ae6f86ebed711d9fbffab8910f0511cde57b4547b0330cc93af0c038b2

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    384KB

    MD5

    d8a92226762f9e6674488eda69709200

    SHA1

    c14175e75d22bde950c06f5dd6ba4882b001f06e

    SHA256

    c6a679348beef9fbd3d2872b11f2f5881f5aed3a96e3e189ccf66b1436303069

    SHA512

    a48a04271eb1ff23dd15648cfcbf7f99a67528f07e57517285731d4dabe475e8a41505632e15f68a454776027622a961c3f49126dacb9406ef967d4c6d0c848d

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    384KB

    MD5

    dd9ad7c7587efdf85835388af5e81d4b

    SHA1

    2aba124be6f4d4a95528e8222ab7930bd86870ce

    SHA256

    ed13fe184e6fafaf2586e6d7c2440edcb08b4ff15f7915dad3f8ac64553daaf2

    SHA512

    b688f6badad11e2f9ee6b1c3627728809cca002893fdf1a78cff6abae65ecad6325f8844b44032b5c427d51b2fd7868aa743981c2b733dfe0dc93f8c6e27c7f7

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    384KB

    MD5

    5ad80b5fb5ab36ef1b117ff78eb40803

    SHA1

    5b80a8418cea5ff82adafa98024de5db71589cc5

    SHA256

    b032a202b5032674aa23dde471ec51c869bcde5a0e2afc382a857c62743f675a

    SHA512

    40f60c3670a94e5abd8c84d633538a708273faa4fd799acee39aca40250d88a0ad90ec12a6ef1752e589f9b8fa5f87c2055072b1db9f69997a56f96192e10a83

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    384KB

    MD5

    9317f7fb32c696ecd98dec27e82a1b08

    SHA1

    e5b30ef022b1a702e6cd849f9d42dce7c3ae217b

    SHA256

    05ea1d94417ab3b65219573b8768c412ec740983a820c32450233d7dc2d60232

    SHA512

    7f277375830e0af603d00a3465cc4a22760c438822a5f81150b5699285eae74aed83e4342fe9a4eb1f2bdbefe8a47cc05fa7d725999dedad7c7f90c2071e53a5

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    384KB

    MD5

    1f55860bf4884d38f4a6b7a5f9e66609

    SHA1

    31ab079788f109c53aed78b78edddbe136b85431

    SHA256

    542131596dbaafcd57b3ac93944f9f80224ac92a2d6567e9c71acb5553161e44

    SHA512

    2d8623fbf954de68ccb01f548aa1a753e958eb00774be701f874410b4e7c5e5bb209537bb813e7128bd594c7673c5cb7a6f2e552d3a1d68ad098b6d327fb3a99

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    384KB

    MD5

    695a2cf3b87c6a935d6a3e2f692096eb

    SHA1

    319db6d8e33cd41ebeb85680d34c3ad25e2c9b92

    SHA256

    ea1906f8f7d3075c98f3d25c33e963cf58fa1e89460228b7c2456915d76be5e6

    SHA512

    3d6c1df2444fb220a379167a72a4d1dcbd86e484a79ba0a2eb4170c34155b49cc109e07aecf4dcbc989e1397f210ebc656324771bd5a2748ef70fecb95b7d3af

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    384KB

    MD5

    4bf50a3b9a2de2fd3e7a07c9a1381800

    SHA1

    88acc805347ad6856b34e0b21cad63ecdf93ee0e

    SHA256

    f97932bb8d75d8239edadd768fa301261a246d5f19edcd3b879a1dc6237627a1

    SHA512

    e3a16a13609e6b2d80a6ff429b857b77c68e9e56fa8cd8a47efda5ab26bcae7199e79a8503988ca3f4569ef6e3b35cf1180ef294e6647c5d0fb0f01c4c6a56db

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    384KB

    MD5

    16d573419763310009758dba4bf4ba38

    SHA1

    9f77ae145a557e863f442aa7e64b7f2969462eed

    SHA256

    f3f2715dc665e822967c302261efb38b28fe04db7990d83528ed8cbe16b5e0f8

    SHA512

    01bd473a234fba7a8c31b4a1371b627ee8371f3448a91ced29f36730a4909fe9741e40ff320ab6c5f32f37384afd281d9ee5785ff357cb01c8d77fe0063a24c2

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    384KB

    MD5

    b62682f2cf323f1bfd1bcaa33cb90539

    SHA1

    2e54ef8106eefecc46702f71cd7fab4cdda256de

    SHA256

    8f6302609a9778e6fcde18250fb936257bcb47ca5124a71281cf13408ca16c2d

    SHA512

    b32a7f3e501e6192651c73ae8cd2943324838b7c8b662f9a24c922c2d7844b8c122545c6256e0a9a1f968f5d15da205464b7be7757db2be6745528a729a71d18

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    384KB

    MD5

    d22d5517de1420c87227746c997c44bd

    SHA1

    efb5d8222298fa5ecaacf824e9f64c4ef3e038fd

    SHA256

    64b89305ca5ae51a3573ab040143c976781ae29a5a1795a605d8bc01ea6bf0c8

    SHA512

    981088f9484d51ab668ca246f47471d37a57bbda514f7541e42394fe9abfe3c1f71ec4429a634fff71de0396ec7de1a5bd677a202a3788b35b711dd2017f5f34

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    384KB

    MD5

    316965bdf6b0c6f4711a11a2101769c1

    SHA1

    6956fc42bf67b409715a6972149dcda7bc6252e0

    SHA256

    4e6d22887de461e158d15d5537812e1be6fa09c56da5e3f890c3d57607d992c2

    SHA512

    004aa9b64f2d1345934dd98ce5588091b752c14a31cf8bfb0a62d7e52c349fe99c9789eee088bdf38d4d6d7627ac39d2a2399e9a12afc56c62d612519bc122d3

    Download Submit

  • C:\tiwi.exe
    Filesize

    384KB

    MD5

    2b8ecd045533f0dabdb3558919bd77c9

    SHA1

    057e28312299c3d8ce5758132fdca453c7f8a53d

    SHA256

    bf1bb1bf47ddcc93557d46b47cfa00eb2f5eb4a55af3c695a9580db9994daa8f

    SHA512

    90d256e3c30181f57daf77a099ea9933e230b7c438204b9456d5ecff1c2f1c82abacd3cd878908f9695ffa5a5def42546c3da10213e3efc9280dd3023543b491

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    384KB

    MD5

    6c118fb5c7797ee2586fff81b104657c

    SHA1

    9c98afe8c8ce46cfb2fc60c79f527c6129bbd400

    SHA256

    2925390c1f63044f1cbfaae43c259c201e4f7749bc1c8d246c22a9d02da2ddc7

    SHA512

    a3a3c2e6a6adfb6edd44aaa3ca59d783a5a8d9368a5addb94727b18477f294965f57e1832dbed9b5ca317c616868c202a9a398ed735ea5c911a07e2425eda64e

    Download Submit

  • memory/872-222-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/872-277-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1040-165-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1040-219-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1040-218-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1416-212-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1416-273-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1416-274-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1616-429-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1780-284-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1780-287-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1780-283-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1852-306-0x0000000000260000-0x0000000000270000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2076-308-0x0000000003710000-0x0000000003D0F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2076-110-0x0000000003710000-0x0000000003D0F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2076-438-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2076-109-0x0000000003710000-0x0000000003D0F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2076-98-0x0000000003710000-0x0000000003D0F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2076-220-0x0000000003710000-0x0000000003D0F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2076-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2076-221-0x0000000003710000-0x0000000003D0F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2076-164-0x0000000003710000-0x0000000003D0F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2076-227-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2344-276-0x00000000039E0000-0x0000000003FDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2344-352-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2344-99-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2344-457-0x00000000039E0000-0x0000000003FDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2396-394-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2600-430-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2632-422-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2632-111-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2712-293-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2712-278-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2732-401-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download