Overview

overview

10

Static

static

3

d2b8484030...2N.exe

windows7-x64

10

d2b8484030...2N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/09/2024, 07:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d2b848403040cf5e2d00a49d9fcc8042168d8baf1d9048bb433543c0d66e6672N.exe

  • Size

    351KB

  • MD5

    8253d58f1e7e111602660b1dbe7b7290

  • SHA1

    d11df477bf7bad45792bc3e63dd197fc615f12ca

  • SHA256

    d2b848403040cf5e2d00a49d9fcc8042168d8baf1d9048bb433543c0d66e6672

  • SHA512

    bbfb54280b6f3e0655045fa276baaa10e5d4d7a95ab48f3afcf0a6b11a137a44b27b84213d01d120e3e3d0ad517bef7101ad0496d74a8de78c2f9ec14ad219ae

  • SSDEEP

    6144:V/OZplTYZplx/OZpl7/OZplx/OZplQ/OZplU:V/MTqx/M7/Mx/MQ/MU

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\d2b848403040cf5e2d00a49d9fcc8042168d8baf1d9048bb433543c0d66e6672N.exe
    "C:\Users\Admin\AppData\Local\Temp\d2b848403040cf5e2d00a49d9fcc8042168d8baf1d9048bb433543c0d66e6672N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1628
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2572
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1592
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1804
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:1252
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2812
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1488
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1756
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2892
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1160
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:324
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2832
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2224
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:576
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2772
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1216
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2496
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2140
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2884
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2792
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2804
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1548
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2084
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2104
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2132
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2432
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1280
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2652
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:468
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:704
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1424
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:352
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:848
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2692
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1644
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    066139fd350541583d8000f06feff33b

    SHA1

    905d878968773b67e61923f3627edd8967cede43

    SHA256

    24843c0f63b65ff4df569b6905a9fd9ab2db2b9be60764a2a684b2c8ffcaee17

    SHA512

    bb2a1c82282d10ba472ef5b0f322e6df27171bac5592c08c99327eb9a38b4e65863fc53399d775663b1c99cf273f5aa92894a13a1c46a3c7afa1c272aeca1f6a

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    7c5001c2c0b4f7c9fb60fda2fffcf67d

    SHA1

    4ca2badf5e9ee0a1d65ee48779a3dd65c005376b

    SHA256

    a04d5210c44fcf474b9f21cd5892a1b4e4a69f920d18da76e59e557d30ef987e

    SHA512

    2400b38a05e65361a5bec82e991607ed43282c681cf0f737c8c49be07c2d66700d94b8d1fbe753d3f55df10e93e0eb4cc75e6ae3efa688846a7c0a1a126d2565

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    1e3ae0681466ce6338c619dde85ac631

    SHA1

    0e9b59eedf0681054fd2808403117def0cc1aead

    SHA256

    d1d39c4a40a656a83b23725b379aa2cf8e3afb95386daa6875744923b42f85d8

    SHA512

    d3d2de85cf7fcf35f329fa7b9dbd37f883cdc27b91306a243948b16c0268e515e170ffe77dcb09bce014e6baa8670f969c7c4d5260941e78bf22b566c381d8c9

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    351KB

    MD5

    0a3b6cc6ee252d3d56cec29ab012d183

    SHA1

    e15396e0d3de90c8371f65a27c088b1ef6160c2a

    SHA256

    d0c1f155787889f4f7d7e1f08c36658056fdb71504ad9042d2a8590e2710481d

    SHA512

    ce2d97f3aeaa43873a95a9fb9fe2a18aa3372647322793c8fb86eb028d9a861ff2e52a4a51769eba6cfe9e63649ee64990d44c87675a33b5be605aa52acd0d51

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    351KB

    MD5

    3407ed5fe3c16c185a711c20b8eef491

    SHA1

    a9e2d7a1e36fe3f7f0b760a9e1dd6ec991bafb52

    SHA256

    f3a634a8333885ea960b13884c2591ad4a54cb45974e7e2f20dd444db4d30998

    SHA512

    f7d8530168183c43cc392bbbd2ec397c0d736d91b075bf465436068303c151b580a97b64b1576f3c81a0ff6524545742be1ff9996a25ce127c4a776e71f93d4c

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    e87fc42a4b540afc24a2de8dfeb23825

    SHA1

    26be16ef61f6d96ba4c777a48e2b9bb0dc59decd

    SHA256

    91473b6c5f4ecee6e48a4f2e9f09c8b02c579b051ca8ac05cbfdd8cfad1223de

    SHA512

    76340db7636295f81b9fa2ce28d8dd0345aabc98aa2170f5c66c670d69c1691089ed1dc389a0f42124987ba5a789d56999702596fbf57f23106e2b0b371a204d

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    13f28683345e5e601a03125528685dbb

    SHA1

    1540262b028b6b985cbca606c44d4f7b72dfaf23

    SHA256

    ca328a66dd48555579a198784ee01e2ec9f87c4c91217c876907f699c869b080

    SHA512

    fc356891213263db0ba15ec4fc208def522cc0db0eb57f31be12e9d69c5b33bf8006cc501903ec1848c6628886018d45e8d23c26bdbfefb854bd24c4b79e9fe5

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    351KB

    MD5

    83ea1c8394ebb019230e1290aecabcc0

    SHA1

    76e87b3b76abfb6574863c9adccc539e9df13d2d

    SHA256

    47a12d07674b1931d5d3a07adefbc2a3f32dbe30f553f9abd90657b46103bd75

    SHA512

    ca1262d29f5eb6e9b3c2cc8e8c5d7523000aba341c26fa2bbb4de951ffc526268c30e9c105925ebf43c7bdb8470937dc5e3ed1ea268d201badb64a737eda8a50

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    351KB

    MD5

    494199ea7650eb78c3275927dcc03e94

    SHA1

    c0f11687ba843617e8c8aad7c1c1b5696f7f0f6b

    SHA256

    914491477a27f453cf2dc02fb167e45554435971a4df55bb601e2de78614f024

    SHA512

    af02934bab6b61e262d2d359147bf3d8ad1a0090993dc3af904866ccf744b3b9ef412c95702c631fc26cfc69e35cf738df30108208ca3c51a4b8b7ec3c9d5a47

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    351KB

    MD5

    3e6735039b2c3f8b82769b3251a22dd0

    SHA1

    4b16ba5caa0f4867408e4a3742c70bf27e9d3794

    SHA256

    a65adf7f4b9ea5b18601ee03e36ca0234c861b44e6cada236d17ceb2477887aa

    SHA512

    b0e014911471fd846e1c44ea2073d7f8f60b89c16384ef790546afaa73984bd1cc9db3a03c1f01dbabf72a9fef511fba767fcb2920ff2fc2c5ae2c5ea6ba647b

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    23b985ac3eab8b9657319c6c8fd49e26

    SHA1

    6492a56f83f15edc0ce7ec22fff5c5701e28064d

    SHA256

    eb129bece123db566b82900bdf63fd3628d6c8544a840a0273d8fa1f42091cec

    SHA512

    0341ff5ae9b6f6716df9204fb43eda9a8c0e7a36c6c7c7b6db097f4fcaa952224d31195a96d09e7cf7178b203fafe45f1e257bfd85c17694e1bfc92a3c44ca96

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    6e52ae28e11764233e6cb1e5ac3085fd

    SHA1

    09710954d372401f7b7c2240400b0a796464e902

    SHA256

    032ccfaf1e05e54419559ae08f60ffa7bbead85113840260f3ac66208f0132b7

    SHA512

    9efa57808b773ec76d5205e09916b8da1e9cb8f8c33003e8b584fef529405aa3c8b928ea765d5b5381b43cd9bca36088e466ae7ec769251ec7cb7affbe605668

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    8253d58f1e7e111602660b1dbe7b7290

    SHA1

    d11df477bf7bad45792bc3e63dd197fc615f12ca

    SHA256

    d2b848403040cf5e2d00a49d9fcc8042168d8baf1d9048bb433543c0d66e6672

    SHA512

    bbfb54280b6f3e0655045fa276baaa10e5d4d7a95ab48f3afcf0a6b11a137a44b27b84213d01d120e3e3d0ad517bef7101ad0496d74a8de78c2f9ec14ad219ae

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    351KB

    MD5

    b54ca30a9e92b57cb67844bc472c9913

    SHA1

    4919c249ba7e9a0f7446c49704f2abe6d48b84d9

    SHA256

    aa20f04dfc5735b984848ef17e6a1f7584d9b2cbef63b3e826920eb7f8f924cc

    SHA512

    82b9fc1c80aef2843308bd4a2d8545d7fc0c7947a267d2abf437ac1879bea57f41710a12089f9f187f7a745801c2a1346e69471d8d5449722d581739331a8719

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    351KB

    MD5

    d6c52aa24efe04458441cf225b68d2b9

    SHA1

    550d2713a0d970b5f9a10e310f15bd1d5d8b980b

    SHA256

    dc20b103ac39b3d51e035ffd327d66693b8ddb059d1195152d91f278cadfaa54

    SHA512

    4e922d46d4f465d0f8ed2a1ae0ef4e6ef6c5942063b664e28d27439be7016d17b1ca911e7bb9edb7e9cab5a7691a91b847b1756d0cb6ea9037c2c47060e466a7

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    351KB

    MD5

    4f8fff926ec25b563b0e261bcfa880d1

    SHA1

    db4d660f0e1b2dc6887207c8c4a82735ba84ad06

    SHA256

    88136a2527c3a886f166e7e117debe771176a78cafd0a6c77a81f0bdda621258

    SHA512

    478eb1917115e0b7027c8e055b03907a514422cfc2e59b49d0792ae39861a7ab12e9684b2082b932721c8f829e9d12a86242d57bd0f01a726cbddd5ea356f02d

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    351KB

    MD5

    acae9529bd22ba62fedbc976b72d9ec2

    SHA1

    54282e6b3b5247a6750f7e2f6bdcf621996bd928

    SHA256

    53c28e86a24acf3e9cb150327c5cd63f793205419d2b4f542d303a255514239c

    SHA512

    f3088433f104694af0bacac7e777faae3f8b0c96b5f44c18ae1936a9e2040260b063474e4522760cc941d5c64e39edf5dba90c096523b0fc98c096cd156b21ac

    Download Submit

  • C:\tiwi.exe
    Filesize

    351KB

    MD5

    ffb131b91f64f4962480e674e78f42c0

    SHA1

    90c2e368bde3ad4129ec152f18aac0caa71f1768

    SHA256

    3cd49537b0015108bc64d8b3810a169a38120cd3f88be18e710ca6d76b1fa5a3

    SHA512

    eb581471f1b8cc28a0c30dc6196ce9f1039d9c74895903440622c1ed1c545508f3aca48950dfb8eb258ca35a04b39ec093efb141b24df3da01a79c59328fe143

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    351KB

    MD5

    362dbc6c684a642bdce5ec13fb5471fb

    SHA1

    16aeb408444ea5d37bf35dd6c0e8af9b76fc9f50

    SHA256

    3dcd4790bf83ce59b9d8c980a2232a456cf63f975363ec703cc970a71faa765e

    SHA512

    be48dd7e40e8f4b0536ed94a60d55d2d73211c0ccf994e2d6a29ac5ab3490ff90d67d0c2317a45a55ce66bc7f7a3ada6bfd7a1c240599ff147d271d83d9b4787

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    351KB

    MD5

    ff824c54f774fd8fc991b137f119e14f

    SHA1

    801e756e8ef3cdbb91d25d167fffb58cb0000975

    SHA256

    2db22b89876d11cf46cd96b7926bad1760b3d09891c938181079681ea57a03a5

    SHA512

    feceb65fa4199592452bc884bfcfd66803601335d51740d5eef52c43534aa837729d0cc880c373f64029d80f5a08066d5d4984a496181d4748f042721686ff05

    Download Submit

  • memory/468-220-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/468-223-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/468-168-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/704-227-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/704-280-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1592-216-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1592-282-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1592-281-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1628-111-0x0000000003760000-0x0000000003D5F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-166-0x0000000003760000-0x0000000003D5F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-226-0x0000000003760000-0x0000000003D5F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-165-0x0000000003760000-0x0000000003D5F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-225-0x0000000003760000-0x0000000003D5F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-425-0x0000000003760000-0x0000000003D5F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-441-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-110-0x0000000003760000-0x0000000003D5F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-98-0x0000000003760000-0x0000000003D5F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-214-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1628-99-0x0000000003760000-0x0000000003D5F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2084-112-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2084-352-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2104-285-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2140-430-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2432-311-0x00000000002A0000-0x00000000002B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2572-228-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2572-100-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2572-233-0x00000000036C0000-0x0000000003CBF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2572-215-0x00000000036C0000-0x0000000003CBF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2572-458-0x00000000036C0000-0x0000000003CBF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2572-459-0x00000000036C0000-0x0000000003CBF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2692-420-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2812-424-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2832-419-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2832-418-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2832-417-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2884-435-0x00000000001F0000-0x0000000000200000-memory.dmp

    Filesize

    64KB

    Download