Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

a83008e79d...58.exe

windows7-x64

10

a83008e79d...58.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08/09/2024, 01:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a83008e79db916cd97b72048ff51f0ccd8d1079391bf05c586640a8927009c58.exe

  • Size

    488KB

  • MD5

    3c339154290c87abac049472ef31f8ac

  • SHA1

    234d6f88721f2a59d8e815140dcba183a6c3ffe4

  • SHA256

    a83008e79db916cd97b72048ff51f0ccd8d1079391bf05c586640a8927009c58

  • SHA512

    7670a978d1635baec4c6de92d44202b8824e6425ec7c7b6ff58cb469089a3464b43e6294c296a8d5c378259a79606763ffc087f6b460bb9513170f4afc892e95

  • SSDEEP

    12288:V/MF/MP/Mx/M7/Mx/M4/MpBE/Mk/M2/M1:VKK2O2HIBEd7M

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\a83008e79db916cd97b72048ff51f0ccd8d1079391bf05c586640a8927009c58.exe
    "C:\Users\Admin\AppData\Local\Temp\a83008e79db916cd97b72048ff51f0ccd8d1079391bf05c586640a8927009c58.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2700
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1900
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2192
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1432
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1532
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2732
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2196
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:656
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2788
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1968
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:1736
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2304
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1252
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2036
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1972
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2088
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2768
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1236
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2808
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2480
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2032
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1892
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2348
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2684
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1976
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2272
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3032
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2960
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2340
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1668
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2184
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3024
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2976
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2204
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1984
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    479703c12109f35bd185bf3724435c9c

    SHA1

    e87fc3f745468a51b7d95274682bee821b25c465

    SHA256

    5426c4cc88a2872df556e41ae0979f9a58a98f48fcbafdda5c73b89cbc215604

    SHA512

    c39e5ec3b1b80d4a1bd65ed9a1dd60a19718970331765740f4b31826186f2517b590e56b4ff77305ea37474671f5aa6bddb42841017f399d697752caab7a8818

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    d8eb8f7859f76ec0c3eb6dc727f1d47b

    SHA1

    1896265524b0717572ce6ddd058509f50c1c9065

    SHA256

    53fe3d36e0ba0ad6f4d6800fbdea0fac810a4a9f6858d3616e9e7822a389fc57

    SHA512

    b2937175381b7622b3679551f80f7eeafd4f9896962b2b0e47829222958a3d8098ad6443477e5cf1a797c0f18779e17f82c8fb956a7067067b012269464bc437

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    b5f4dab19e71434c7989f3b911c31ae6

    SHA1

    b8513261246eb6e4d5ced0468ff4a8431034b72b

    SHA256

    c262b73a64b11a5335eddececf24d6663b18e1fc45900815514c0614f8b3d774

    SHA512

    04d20e99984df3f5a48e4ccd98b474c2d1edefc63ccdcd57b7808fdae29e869b60a8dea83c74b7f8870669e0f6050992eec265463a90c782519c19cd6b98489b

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    84a58f729003f1e343752ad3124cd17b

    SHA1

    caaa1bb7047c8866742541f69858df710a6ab9f0

    SHA256

    7ef2047d9297504bf32437aa11154b249bf837a5a8b0c62ff43a3c1bd477138c

    SHA512

    17680e170fd269dce3f8611caa4028387c9040fc9a1ab9d5b885ad4de2467696baab82506377ddddb258029696c0e1e8217a7def9d375d6a3cda36177ce24ad1

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    cf5a6fc5a9d9d4813299626b8159e4d2

    SHA1

    2e32c3a07b5f9790296be0580802c9959adfb882

    SHA256

    9f5d4ab5b15686e85458d5c0c0841e5725ab483eec2c056e730a9572add4946c

    SHA512

    e47585325813f36baa6909c4953fac2268b8eb7c384ecb99a950498c3b346a685fbea75bc34d83096d0ac25c75389b85ba75e48f6a9cd91c27b7bc0c201df479

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    5516847a13d3a4f7f001cb24cbaf14c2

    SHA1

    683567199fd1e7e2aecca3ea4b91fab516389a2b

    SHA256

    a40bccbf7e5e280bb640e0c2304d113ed9d16a2a38659e9560013e4e20d53075

    SHA512

    51822d67418a58291bbba0d9506c2d4240e581df10365f6522f054556e80a560640b9562143d7d1b8e0779c4b2c8324eeec2ea2081e23c6b4890a99e0fbb1c88

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    c0ebd88c95170aac23c02f4f01f9e32f

    SHA1

    eede5dc18db856fe06975ac315d59c2f3368d6b1

    SHA256

    79cbfdea6f6d5034742aa3b55ee8b4f62a174ba02ad2377495e389ecc61c58f2

    SHA512

    01f8c41202ee627b9a71ad1ea92a8bab05e2b3e29d3887a4eb097edf8221864ad20aab6d8e858c51e733c075f17f4013fe59504d1e10aa8acc9144acb47b7a15

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    651a84b1a8e61c91ca56800f264ddc93

    SHA1

    f52248fb20bdd1598bf291e6cbc94de33d032d66

    SHA256

    b94c4fc5f94d914a76bc5f01a5a91067ab094f534e8baebc3813b597efc939f7

    SHA512

    e8ecd3e3108f578676c0e2d27223a499fa7b8777cacc8705db6c7934e40938c2e076ef990bea749fb36578dbe1e21ff91d954f4ce5885a45bb3dd004bbcf0c2a

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    488KB

    MD5

    961d5396980157aba32754ef118b4b66

    SHA1

    97454383ea0a53d711308827f5ddeef6ed92ecab

    SHA256

    1a65746b77467832c6b0a890fe460f92d5cd1857db5e4653bb250ca4c022dd2e

    SHA512

    35aada89a38ae0aa17621f8288112d967e9dda039062e8096382f300a4819d335f9042df80dcc6f7a2e3e5a154e6518331984563942f36b1c82ed07a5b23d1d9

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    a137da562eca7a5b1c356c3db7853279

    SHA1

    ade903abb7907e1b0c0684ee50963a61b6f661c6

    SHA256

    93893fac5f92a8b5da20f0baa77b017c6a5e3e45fa90830c2a03dca92fce0528

    SHA512

    4d96a5ad06077e0c76995b24b4a3d852112aef2cfce64176f009542c140a2fa0235c7b2af5e2ffb731f277f0b4609c6a71ac8b881d38e729c29f60e7b0292a3f

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    d13a2650e962fb6731d7b091b60debce

    SHA1

    93a9e3d8fb4d5d5344cea3b1a7f24afb2dad6b5a

    SHA256

    24e401fbade05919da476beb79f98debc1d98b034d4e4968332d968e8485a208

    SHA512

    d308ea17c475c5df8d5514dae6535bafdcaf082ac69ab9982fb240067529560f7d9a728b126289fb2d01bbc998c3d703c80d083a944b802ac52d72927d29d399

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    f09213e96e2ae1e3b61de03594b3bd77

    SHA1

    aabfe73641d7c9b6b2093719290387094a59aca6

    SHA256

    57d1f7c943f54de5c8913d7b0b26b150051eef9fe4ae64c25f0b1b67f74834bd

    SHA512

    0a5d70fc53427067f9379cdfa8dc9608a13fb523bd22b91171e24041daf3b2670a6fc79f1b84579e8de581a1ec2335bcb51e0551baa68fe20268b4adc8c78914

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    4c48a21f1779434b050bbe27aa6681f6

    SHA1

    73b0196c2fc113bbefcd7f296f168802539e1930

    SHA256

    8b2412bd8948ab705b5d9e220bb1495f7ba95eaff82481bc0060ac49c040f32a

    SHA512

    b6ed4ba72e309e0222c56a9df6158625924b2f21411cc06e0923e061af74b96170a9fe12fbcefa2609d20311fdc37a31ccd8442b033b8c892a59cdb84723366d

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    3c339154290c87abac049472ef31f8ac

    SHA1

    234d6f88721f2a59d8e815140dcba183a6c3ffe4

    SHA256

    a83008e79db916cd97b72048ff51f0ccd8d1079391bf05c586640a8927009c58

    SHA512

    7670a978d1635baec4c6de92d44202b8824e6425ec7c7b6ff58cb469089a3464b43e6294c296a8d5c378259a79606763ffc087f6b460bb9513170f4afc892e95

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    739d3c56aafca0f3f5b8e32d6597ca7b

    SHA1

    2ffca29de724560cd04de22b4e07aba4cd17dec4

    SHA256

    293aa0c5ef6cd4b80b0c0b4806b528e7305d61c8f39274c39107a16d763c05e6

    SHA512

    c611191b1a4b9a39f1c27fe70bb24bb700585f10314ceda80cbbed613c87ec7ee8039a4797cca0996ea6d3cbbbf30bd08a6c1ff23350c431a8ede8113c0ec975

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    51f71ad6d49a05f3c627af167354dd26

    SHA1

    96c01278db5fc45df99087af55790cbb2c8a38db

    SHA256

    85f67f49686869bd1eca2bae09c833538ed4d9d7297ed45560b9dd239078da7f

    SHA512

    1fa2e02abea1f1bd6e47e83fa8429c3f999f578b36e5b94e3773130ec0ec2cc6443af7acab118bd6644dd6ebd55b5eef1543093cded426316ac809696450d1c3

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    488KB

    MD5

    c2d9c1b48be5d06997b72edc9736570e

    SHA1

    a5c48f3ea4c920a57457c15bb6f0c0c3e26ad67c

    SHA256

    50229f0ce328624c347992e1c97f820685e0970982fb3293b781acb602d880ea

    SHA512

    834f76d21a091bf7bab3319a2f9b1adffc3bed5c1a671a5cb4c8fbb1cb568a27c6a34a2a2055b9bf5d3fa68a149a545cc358fc38d95a570b0c32df5220f91608

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    0cf5bdba025d842fc216fc3d0e83fcea

    SHA1

    9f58bc9bb626c5f27048d6c1f8a5b196f8867bd4

    SHA256

    fe9075f14908591698446b15f17f668a5cba0551d7f15299b9e9f80402cccdca

    SHA512

    b15d14481c05c0255c14645b704065c5e0875b8f2f8f40d41248b3172bc79843c2e2b8a70471cb29be3235e868662b258650bd550f4bd0043b48b4d42ce6ef98

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    122832e1062227b54b5ba5fdc0174797

    SHA1

    16f877dd27aa9c5b9b9869a146226e4d1c9b621d

    SHA256

    7e6b521a4fa7fa5f22a6d12a65dbf1ed19d3de9628e6835801be1ceeb7e5b3e5

    SHA512

    df72533868dbf0673dd9772735e8795d746f1474a8a8bdd5ff85f352ba42f3238a1bb75fdf33116882409a27243c6d73daeae998c1ba97cdff2033b7d47542b4

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    488KB

    MD5

    53417cfb365b4d3bd7fa2f41581caf1c

    SHA1

    e647981a9bfa0e9ba7ffede3683f9324ddcbdd08

    SHA256

    17caab7f3cf3b35cdaa95b89b3b3d3877f22c70e6c266c9b5a0e92f787004c7c

    SHA512

    3495e95b6af57eae33a5b6b2522dbad50878024c131f756eaec9a22b0c121b8af578dd5e32ef73d4ea114a1040a827f6296f4bc8460e048b52cdbf940da3ceaa

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    488KB

    MD5

    a0065525718a57951fc0bd28386bb164

    SHA1

    b1f70ecbdddc720d153b1faebf485a3aa16626ef

    SHA256

    ba2f5d57d4f149203d76b3d1bd7cca570c21dd651139aa0b02f7acba1c4b03b8

    SHA512

    d1ff98e7b0cfe898c9e0878ff7c5710ac486eac1be93d925c664be010b2e07ab5763e704a4af317ff87bc7fee114bffd16c66494588287db17316653327e1487

    Download Submit

  • memory/1236-425-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1432-282-0x00000000003A0000-0x00000000003B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1432-281-0x00000000003A0000-0x00000000003B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1668-292-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1668-271-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1900-284-0x0000000003290000-0x000000000388F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1900-99-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1900-296-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1972-455-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1972-456-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2192-283-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2192-212-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2192-278-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2272-310-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2304-432-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2340-266-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2340-262-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2340-211-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2348-111-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2348-349-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2480-435-0x0000000000260000-0x0000000000270000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2480-436-0x0000000000260000-0x0000000000270000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2684-443-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2684-272-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2684-277-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2700-110-0x0000000003520000-0x0000000003B1F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2700-444-0x0000000003520000-0x0000000003B1F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2700-459-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2700-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2700-210-0x0000000003520000-0x0000000003B1F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2700-112-0x0000000003520000-0x0000000003B1F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2700-100-0x0000000003520000-0x0000000003B1F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2700-285-0x0000000003520000-0x0000000003B1F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2700-98-0x0000000003520000-0x0000000003B1F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2700-280-0x0000000003520000-0x0000000003B1F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2700-257-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2700-267-0x0000000003520000-0x0000000003B1F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2732-352-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2808-431-0x0000000000230000-0x0000000000240000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2960-401-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2960-402-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3032-354-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download