Overview

overview

10

Static

static

3

f80d4a5494...0N.exe

windows7-x64

10

f80d4a5494...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    13/09/2024, 09:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f80d4a54946b6589ebec797560362890N.exe

  • Size

    488KB

  • MD5

    f80d4a54946b6589ebec797560362890

  • SHA1

    87d24e16d2fba2a98119caae02e42f3d99408682

  • SHA256

    00727ac9b04e4d1aa94f306295bb1a6c83662f313efe2e3979848307f8a8684d

  • SHA512

    b89c782649f5ffb0b98eecf2296049c1466d9411c81c9c9d044d842430e50d65bb81cb1d7e15372cfc379e2d21f638b6a0bb5bc1334e32897541406da91e344c

  • SSDEEP

    12288:V/M7/MP/Mx/M7/Mx/M4/MpBE/Mk/M2/M1:VwK2O2HIBEd7M

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\f80d4a54946b6589ebec797560362890N.exe
    "C:\Users\Admin\AppData\Local\Temp\f80d4a54946b6589ebec797560362890N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2300
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:296
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:864
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:536
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:484
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2928
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3048
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2636
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:468
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:740
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1592
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2368
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2388
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1944
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1512
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2264
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3000
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3052
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1356
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1996
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1612
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1908
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2924
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2956
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:608
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:984
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2472
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2796
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2800
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2852
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1932
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:808
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3012
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2232
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1756
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    9e711e75ce10d3d54dfc6ede9fbc9303

    SHA1

    13382b254bc27d93815bdad23607bd33f9cf9c7c

    SHA256

    111ea8494824aa9209866ec0a7c959b2d36396e6b3e94a7b71ab915fe28207ac

    SHA512

    dfd6356f86535be175b542522ae995276cf36539ab55a2b8557c44f9a474728c51720b73d8781134af8b350400237a2f90ac2e027bb399ab7a63b0bc8949ec0b

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    e7c80234ca8ab4a3a7d0b746ddc043e7

    SHA1

    0b7bcde8529a0a2554377b2623ead3e9d29e301a

    SHA256

    51ebef12bd89dbb988a6dd5d3e49549c290f156f650d5441d81cfc66cbdfc39a

    SHA512

    ee29f9c7c47701b0fd3b94c08db2f0f98fb1c90bff478907f660792bcbe1a61becafbb13beac4dff034dc0585d10ca1eef582f1416475ed9a65a8ee42a7f835d

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    2fd3aa0caac86fa4959a7ae40ef38df3

    SHA1

    5543b95ff2abc18b1a3eb4c38fffb39be9cb9f69

    SHA256

    db3ec0523cd6b169f3d3a2f6717c71c648d9bfcf25613e1ab1d2c67aa784a6d9

    SHA512

    a2d6368cda0512b70126618911bbdbc8a038af62d85fc6c2da6b15edbc7e76d82f2ad32f916a82dd17cf7dc3ce60c2d3fe53e4e5410af8f3d14a533ee47d71ab

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    5eaa1264f3bb102ad53c154e6b8a9939

    SHA1

    7c7357e730b35249862c4e6e9866a803b21fb4c2

    SHA256

    d2ed15f1699f01599acaf2275a8984b2f03728e527db4b102d2d61f19176c409

    SHA512

    1b7d9d0f08c8e845fa9696a975e88870ee03efd53fbb797a681299527454f65d2510b5db8536fadef5914d519b1c076e35eab7ac8faa0719ac3433c8063cfac7

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    8613c11d48024b6fdfe1c454193cc519

    SHA1

    d9d155904694e8a23a84c16af4b02d398c1c15de

    SHA256

    a8d40be37586f807cd23b79ec64993d0ca37e05b92201adf16d70e1bae85eb07

    SHA512

    c85b900d28d40944e1c13f01e304ce9eb9b51891961cea7b174fa1fba0f8450490897e944e96a517d27a4fd7580a280e2b9a704b8f5b28738eeb681bdea7b278

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    5834b8ffd1ddb47b04d5c08922ecc246

    SHA1

    03e2d0809e7b5f1dfb37164998df0a6f5334b1cb

    SHA256

    d21382ee46f4754a9a18e7f49ae10201201effd03fb5700249eca2ee3e303da6

    SHA512

    dd0f118131fb3b4dc8ae08a1f3a4d955b931d0fb8daefbbacbe6abe78c9d68988610a5de6db149f4c7b158886fea940d42cea9a15be73cd69b4f243802eefaf4

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    2c017ff09bbb9db958dcc306457cc173

    SHA1

    10e6c2d66b56c5bdfcc4090ab10fad0a962eef24

    SHA256

    e055a48efb04627f260b174613f53e8c3c319851f9a52292be788a1577b4d187

    SHA512

    43c44238345b07f5727f4f7d8a3d0010d5934795ba43a7c6c04c2244f95ada1e2e9631159750d33879d9bf9a609f2e63cd8d533841bed3d3e75b206953dedb76

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    f85f4b36bf4d11e7bbea35160e6b5ce5

    SHA1

    fe170724b667b08f907411b69fe6ac1e9fb6c8e5

    SHA256

    b91bd46d947e8445179daf4c7e34a32cbac40e8b11cd8cc5af35a75723404823

    SHA512

    fd31ae4103365fdd9bcba1213a5b64fd73421c879a20af9319e5bdec54138fa2f439f750e127ffe555dfdc7363ea766a38809689d00d47d4edbda746a861700f

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    58e9baa21b427cc28dcb455748a9023d

    SHA1

    1f069a6950d4c43ef4448c7e9702cb069d3a04ea

    SHA256

    cfc3056033ebd27a4fddd97fbb31083a99b07e667302303f455ba5dfdd20859c

    SHA512

    09960836eb9a319c66d4857e2e2f1c08326d44bda8ccf384301e496c5afac6b2d494d15f3c1abb43022d460caa3cddec1baa1050ece5a0def4151c4779ec9ae1

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    b685698745da565ed33b09ffe62fe065

    SHA1

    30e2c067beb4f5d76a50964760431f7d25ab1ca3

    SHA256

    b17d38d078997e0caf50e9d5404d98a69bd187c7cbfc87c1541d1558c695c4eb

    SHA512

    c449961d42ac03b849e993f8ff5902050831bec5f2b53f809fa637e5d0f6cab74fec34f714547e1333b4cd6328e14eb21fb1d4754401743f38db62f3fa65e579

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    6bab9555bd57351c4a17330b3988f328

    SHA1

    12d6e6bcc93a97962cdc72626140f251f192ce6b

    SHA256

    c0dcd5264225d64e2811af4126ee2399121ba1e28efd3ca951cfb75444584ffc

    SHA512

    70f87ddfa33268cbceb140886dbc0b805751dd62e38693f8839f544e2bc20051e5928694701c3d00e875676e8d042182f32bc758a12e33e2dd08cc7e336af8f0

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    4d57d780cbab6e77ac49de4a26f102dc

    SHA1

    80a6cedfd6216445f955f0ba9b70e2744f5eacc3

    SHA256

    452c87d1a49010ab25acc3b8383d080aa0b7a7fa84badf5ab5a7e463a25387bd

    SHA512

    69d3175582c66b68fbcf8c2865285165efd09df9c9dc56f89a80d0834c1bfe7e191b57fd23f2369cd0e06fde467be3e461ad4b578ecd3bb25f3e2704c198a465

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    73ec94956d5d258dd11112a41ec3b46a

    SHA1

    67f19a7becec6ac554e4d118cc5d219ac8250ab5

    SHA256

    c97782becbed97d911edbdcb8faf99c00b4cfce43a279e836d2ebe8fd1757100

    SHA512

    568f5f501a6a76d00a2f11c4e1c9b82460d2d6394759bb10b0b639880d0f60ac35d344faac178c9dd7e67dd950230f4d4e4ac6ff28f0fd833d34348bdfeba50f

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    43452739a0db1f754332f079e964b6d4

    SHA1

    49230e4a7a4472b2a1e9c4ce7209874aec9aebaa

    SHA256

    9a7263760636670467c2d07f01f15749c577221eeffaaa68976a268661f3995e

    SHA512

    986fece7230775863e2777e1d8d33188889a25a51944aeb1903381a122dcd385b27645055b7eabeccfab019cf2770340651f470d07d8b98b68f3d037e02bf75f

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    b1fd33cbef74116cd419266e5305489d

    SHA1

    3bdd32b3539c5e3434dd2c6d6c8af8f825587456

    SHA256

    31ec3e5ec43c7fda30b6fd0e7a2c5b8c6aacfdb65b5bf8d7488ec10762e306a6

    SHA512

    1c509c53b4cb1840a50062034a66c5b48dab98d4c2891cee8b37ad4cd7094a495f8420357971df152b0e5360c1af1055133923b8e5f98a532b59f93dbebf40ee

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    f80d4a54946b6589ebec797560362890

    SHA1

    87d24e16d2fba2a98119caae02e42f3d99408682

    SHA256

    00727ac9b04e4d1aa94f306295bb1a6c83662f313efe2e3979848307f8a8684d

    SHA512

    b89c782649f5ffb0b98eecf2296049c1466d9411c81c9c9d044d842430e50d65bb81cb1d7e15372cfc379e2d21f638b6a0bb5bc1334e32897541406da91e344c

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    97ce647b7fe8b276520d3ecb77bd6920

    SHA1

    33105c5512f2177266320b91698c26f76f229c4d

    SHA256

    bc6ea0c5488fa34d1b53448d1f65d91838fb8753c081c68b1f60955f07f0f895

    SHA512

    7313401becc81296118a7f11b38e38f119fd451f7598aa7e0e139663b5195dd86b3eeabbb7ad8b1cbc383645ba05745a30b81a90480455e5b14aa6ecdccfeb74

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    058ffb9e0c064cde9649c6b6ff42dbf5

    SHA1

    9672f45646be879e71bd23510c12508c7b9a9843

    SHA256

    8f9a008972c44f937c3781eeda117bbb31abf405c5f00862f4f745668579e3c6

    SHA512

    50c9048444ebb7788ec0eb857218b6516c6eb08ee5a9f8cce5c72cb1deb264a58f657d920efab2d0fe4655e8702ca0a96ff386f3fae41a478043ee30adb1b834

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    e3a35416e3b02404e766207907189809

    SHA1

    16f4f29f9c67960c6cd578ba9308bf7448d81ea7

    SHA256

    852de0857d7be19ad00793461bb1c8f6283e7090e6a9525bf92e9f92374fceac

    SHA512

    c61a92ee02ff3e343fc1530222f8711d6e38464e697b2a968d9614b10251438d2fcc14cacf1803672928c93c15841d6ab6771a2672213d4711e4be7a07b20b8a

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    488KB

    MD5

    0c61de7f67df5d6d4cfe3862419fbe5a

    SHA1

    e084ec06587ed286ac0170adeabe97e5632cf06e

    SHA256

    cedccbf61998a63c8c75b6087b6b42cfd06e7c97b123287505cb540e47fda48d

    SHA512

    4f2ba5653e301a976e42358c99cf67af2c47cae6768ee6f864728d7939ec71e02aa02115523542c0f0e54da0206687548c30004877f5923994fd953d6c1ec713

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    b7430ab8222bb168792f0a4b063ea6d7

    SHA1

    48fa185dd6cef7211670f73e4cdb5feba502a25c

    SHA256

    be53587bc21dede33164333a749d0f35418be81d35f006210f1a90cf366f7abf

    SHA512

    ca2a5d1d0227b0542af41ed0f3972fb7223ea5ae6e483c9c505d95ca820c8deb4e058d2672ae7a640b81ea3b5d3b2d66488bd7c0a7a833bd47ffd021863ca89c

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    917179727120c0c952b7d4cba09a0da7

    SHA1

    4a6cc7885412c6f9cf07a946c4507e8a2ab0b92f

    SHA256

    49d26c4015a9a43ce9ac4b71a0e028cac0da5a7775a8ad0ec20fae5ecd7c2dfb

    SHA512

    316f0f22aef6e665445128fbedc471bd7cf2ceadd3d4b6d4a9406353224dd83d5ca83c612187b3732788a9a62ca6fc7a5a56e397caea26f6bcb6954e28120763

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    595e26f01823ebfe2121e63f1a9b32b2

    SHA1

    af7e826edb7133d6d00e031d2711a96c12208b68

    SHA256

    6d336b00af2a961cc0a448200f3d651894fa843e3d6b9c84d70858e7d7dbe2e5

    SHA512

    4b0ffdcd2f5b85633831973be014ed2f5c633cf59db1ccd9b54e85dc86cedf24eb331ea1aa7dbc3c3f0f0d3c583c13feb604cd4477f1d959485e235129939b54

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    d35f81657354c5cf4b98ff02d1c358b2

    SHA1

    4e61a52a2098213dbc6d07e5324eec68a8898e05

    SHA256

    518443278b941a2b43be0274c6a7cfc5725a0ec08d956ed7e0da24a4e7b18fec

    SHA512

    21ba4df65915758ce9896325836c953a7148e782993894b746ac1e17809fa2fb09aaced5582a58063e9dcaacea5507782cff94804fdcea2a9ef281cba0dc6d4d

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    488KB

    MD5

    053c2c72f2dbd21007a032b7a6fad508

    SHA1

    3058e743fa3c17b8088c0a014654e20b0217f80a

    SHA256

    2fc724cbf9611856f0dfe7ff77776df5e9b837a732d93a67ec8b8d0c2be1ce92

    SHA512

    0d10661ae7a4629054034f3a6cf890d3343ae3f2fc24ce9860ac365117dbc5bd2d917b5c34d62d937de3f287a0349fdc61d921e94be41404e269dcab3dd35161

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    488KB

    MD5

    f7f94b6127692ef2db39f6add3abebb1

    SHA1

    303ac955cbf2402a3eae8402985eb6db5bfbd5fd

    SHA256

    2bb5be194300a1c68e1c6c27210ddf602469d2ab4bc471b452e7cdd42c906279

    SHA512

    5467128821a9d235ad8361e85144e3d3d8212e6e6bb3ac8f46c8b2cb3484b5e1a7525edcbf9c09d8340a3b0971391065f97a9a5fac65f747954b265a5cfc9a79

    Download Submit

  • memory/296-100-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/296-340-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/468-269-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/468-265-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/608-263-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/608-176-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/608-264-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/864-319-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/864-220-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/864-320-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/984-332-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1356-457-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1356-126-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1932-444-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1932-443-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1996-331-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2300-112-0x0000000003750000-0x0000000003D4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2300-124-0x0000000003750000-0x0000000003D4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2300-99-0x0000000003750000-0x0000000003D4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2300-98-0x0000000003750000-0x0000000003D4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2300-175-0x0000000003750000-0x0000000003D4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2300-110-0x0000000003750000-0x0000000003D4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2300-272-0x0000000003750000-0x0000000003D4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2300-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2300-177-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2300-278-0x0000000003750000-0x0000000003D4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2300-125-0x0000000003750000-0x0000000003D4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2300-416-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2388-417-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2636-111-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2636-271-0x00000000037E0000-0x0000000003DDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2636-359-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2636-458-0x00000000037E0000-0x0000000003DDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2852-440-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download