Overview

overview

10

Static

static

3

d89a5683bf...ca.exe

windows7-x64

10

d89a5683bf...ca.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/09/2024, 10:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d89a5683bfbcf6feeccd980be0229a12e32f912007c2775c830d90d3d42877ca.exe

  • Size

    488KB

  • MD5

    408124fac57fb47e5a962f0351e0546e

  • SHA1

    a992b643d319612429f7a26fca87ddab71f49a59

  • SHA256

    d89a5683bfbcf6feeccd980be0229a12e32f912007c2775c830d90d3d42877ca

  • SHA512

    9a4d2b4c9f1f38f70d7095eec7e093d9738693191aca8a6cec29c95493e6305dddb55a302e178d77c72a34a57a4c8f027c998629209e1c23f9f0efb905963661

  • SSDEEP

    12288:V/MZ/MP/Mx/M7/Mx/M4/MpBE/Mk/M2/M1:ViK2O2HIBEd7M

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\d89a5683bfbcf6feeccd980be0229a12e32f912007c2775c830d90d3d42877ca.exe
    "C:\Users\Admin\AppData\Local\Temp\d89a5683bfbcf6feeccd980be0229a12e32f912007c2775c830d90d3d42877ca.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2564
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2672
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2228
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:944
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3036
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:784
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2608
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2216
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2016
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1696
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2188
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2540
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2740
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2716
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2376
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1180
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2140
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2596
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2488
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2856
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2784
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:968
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2908
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1144
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2024
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:612
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2032
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2344
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2692
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2384
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2152
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2304
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2824
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2764
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2696
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    735d3c2aee3871193ba54fc92747daae

    SHA1

    0a75a95204f72334e74f1f14e326a57c175c9e9a

    SHA256

    37510603bb139f055ee17f54dd3749820ae0eddbc6d88b3a54fa685f0293c12a

    SHA512

    20ef77d6c24243bb1b625cff46f024db80e03dcd38f6a7316326721c0ca69ef5d73d3221f51cb1b15d792b693ae53c2a8a6597474ae80d6d8e601eff0354e438

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    d76f2d2426d8ad5a60d4e72dd3b13ac7

    SHA1

    d752568e30267ad8a87e3b52c7e0e6c355f21701

    SHA256

    d8fe71ce91ccd1b88837c2e5895878a6c4f87ad06d27797a0d144e8783d2fd33

    SHA512

    17a30895c7fcd379e497510c343c64b2c977f69cfd328fb28f7d05f0dd934303332abf7e18f2031fdca7b222ce93f423c425bd45921bd51e35e97b121be74f76

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    92d709bf0bb3aaf772220c5bf0d67a21

    SHA1

    1c201f4bcc4ca3c7587cba25364c8d0a20bf054c

    SHA256

    0c70a4eb78f1aceb4c9707966661b2a160ab9e6892b5cd3dd6da1cc7d0b348af

    SHA512

    f942f53ba785ef52ee1c3dd69e6da447368a2b809bc5825c99262652871c6320141d3d61759324c4a61a7f07c07d552da71f7cd13abb24132f92679bb4fc0d76

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    4e05053c93aecf84a2659f89de28c98c

    SHA1

    ddaf10bcf15a7126848c69bffb154d90fca1f248

    SHA256

    f00108dfb65b030f1fba153d48a7294bf3ee523e4fc1baa079e66d01bd89455f

    SHA512

    c2b3e94e2db6c1a694b960beea2bfb436e6427d7f2a4000a33aaf9aa8b7fa71ae316c3dc7c75e42109e71618a6e34d7a88cefaaed9b5a0e076b0059279a723ba

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    ae25d2cff7614d2f96bbec9a1923813b

    SHA1

    509538d920f898cc04fa2199a56ef143e350ec73

    SHA256

    8e46e138d79373a086befee2c0b2542e9ca0ec0d91d63d101b58443214b410b8

    SHA512

    c41004ea3e14908514f2164f78c2c8a3047c3daf29fbb367cb6de3d53b7ff44f8039a80c6dffe14a51f6467c486df31f2e098e39efcaeace0e7be5363c9162db

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    436b4fdb5bfb06f64e0e6b933c298ff8

    SHA1

    7a428c119962be8ac26bdfa6b3cc564ec6640f3b

    SHA256

    66a64261f9b2ce6130f77173df6219924eba56537639d27c3370f304a5717136

    SHA512

    2c3fa78feffa90d390b1205a6b6fef0598f38c5845133d3b0b5930f269219cb0c0c3f5ca427856243edb9608015eedf0a4362823dfcfdcdae6fd3cdd44304131

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    fde03292ac29fe3289149182ee9cd52a

    SHA1

    d5a5e2faf7a067b313d5138aab649ff09f966853

    SHA256

    31e888c73f1cbc913567adffceb30a3cbc01219090ffdb93f9c98dc2c53a7736

    SHA512

    f13a37c43e2c323020cbb704e35aaf220ae9bb9da73611561c3277a753e3f8af89ce5ea817ed9277016fd33d764ce0b3a0fdfbaec9bf04b85a24e7a85fc072c8

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    eee902b657122f067fb4c95d03c41ad5

    SHA1

    f5f2e8ce6734c6b10103f5b7ee0ecebc881460dd

    SHA256

    4574c06c113b05f38b1925cc3325a35d460b139674fa92727bfda9a61181cd93

    SHA512

    2f8d03fe19be5649b073034e811f0298dcf067049cced5fdde5af26eca738bc13541431f7461d1d3e91d396e0f2c91d0e8012f5fce13b83611819aa891da755f

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    488KB

    MD5

    116b56b6f26146284e13b4d6b44f1e1b

    SHA1

    c18c5583d4ca34d3609a8daf36f599f59c29904d

    SHA256

    203ac59e872e4e3fb2463c6791840366e0a0aca94e083d8ba22fc1a2eb56cbae

    SHA512

    ab46b6f9dcddd3c7e9b712fed04bda6d5a96eb15cd2584e1d018766954ee76731ddc8c2d645c37d81b202cf70a28db1a4be292bcfd42fac3c2a5c8e9efb09998

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    488KB

    MD5

    47a55114cb79af0b3503b51a98296eae

    SHA1

    efe3edf29ea42bfaaf394e63e7fba3424191f7c0

    SHA256

    ec98fc20db71bc707b9b19965e5569de3c4d595e71c41938212ec8724e03c6b8

    SHA512

    0c954283ffae296bb77387aa67ca279505514fff3ca12fd1fbbcf68fbe02753f85dd7c03980f8ddda8d4cfd147f0952086e3f3f78e15fa44be96e0fc24fef9e4

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    f7ff1a2218c2767538592324011c6176

    SHA1

    d59939ba582cc4537151b1ca8f96658ef534e5ea

    SHA256

    0ee9a9e52c52c97c862b0910151d54be25d99350e778cef4e0bafb7444b408c1

    SHA512

    7fdaacaf4b9336c4609417919421b6d80a632ebece9fc534b771765169c2bb0f6c0b3fbaadcd951bc81d39281230b6f1dbb7b503fc0f18f88e3a1a01c27b0dde

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    2370696d193f312f47c832fd219cb039

    SHA1

    bb67e0284b13ad01d1b89d75058fd4815e39e09b

    SHA256

    57df45d4a1b0d99eb4cb6121bf795080fde358a6451a9d4a227477fdc579d69e

    SHA512

    4273ded0fc1f1305ba0b4c163548d9e98ce2ebc3dc4648ce56958fc140d41d4587bb3ee732935fcd20d285e413cf60d8fc6b381b29e55491b0fe6b8d2c50af18

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    f3f31ab638ff9bd41ba82ffeaa4b3902

    SHA1

    b1412e4b01f1a9b5c4e9c2ff9a314ba0121b3512

    SHA256

    976228a63764bed8f3d735fc9e93e54f9e9187a08f9ee6d7be3dc426fab4c61d

    SHA512

    872882543608b4fe51e428aa60e656c87a457aa004b9ba2f8bda54959c3892c84446d41bdc62ecc03bdf8873d9e0344821e45a34bde1a2acc8db0b7a9f5ccdf0

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    7d444cb1043ffe91d845b81ea25a1477

    SHA1

    6a8227b697bf1f0ffe2d3eff4465443abd1a9d60

    SHA256

    b1bf850188a240173ee2306e68cf0331cc1b73ded30b3fd693fadfdc361eec5b

    SHA512

    8b4fab1ace7d4859467f7c9b7425f3ddb840630f509f9665a2917d5074711cad38046c38435b742273ebd0b8b956941f9aed23756cf32dc7dd50969d78e368ad

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    2c65861dc0036a646b26607f38a49da4

    SHA1

    7ef9eaeb872010e1ff6c5573f4609d36aba3f28c

    SHA256

    dc384d6fb0b11080d43ac3dd5a16b53ad4d731c04ff18d38a43d3996c35b6845

    SHA512

    5578800ed6f2511aa8cdecd6047a844d1ea38b0379f6c4d8c140a82d79da1a9eecc7031b03e6a81f9278109470dc0862bbea83e0237c5149bea5409996677766

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    408124fac57fb47e5a962f0351e0546e

    SHA1

    a992b643d319612429f7a26fca87ddab71f49a59

    SHA256

    d89a5683bfbcf6feeccd980be0229a12e32f912007c2775c830d90d3d42877ca

    SHA512

    9a4d2b4c9f1f38f70d7095eec7e093d9738693191aca8a6cec29c95493e6305dddb55a302e178d77c72a34a57a4c8f027c998629209e1c23f9f0efb905963661

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    62cf7cea7a74a60bec466eff12905003

    SHA1

    7243dcca92021d1c5cc2062ab8a7e5bbd77e5a9a

    SHA256

    9e95edc38df61ad0d4226ff25dbf8fd0121585ce17d31d54ca9f33a08f8588ed

    SHA512

    cfe97a6d31e3fb9c5112cfee037bd8d2e09654048cd789dd7481714d405289a30b8a6fd0f509c86672d7e62c52f6344363e555750cf9285e3592588e71a177b5

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    45363b292fa7e801b4f63fcd03802ff2

    SHA1

    829ac3fd93976f04f50dadbe1bdb5ab3fe7b2183

    SHA256

    aa8d9e50210a2d0a14b6fe539d3964d029caf65c6f7ca507117c5cb828aa5e58

    SHA512

    af40ba95f8a966bf16ff3906ec3a59313b75ab926d1ebc6777a676ae86ebf25f4074b47d1684cea53d41f8674fbb98ead9af5596668b97e7ccfd212b3bffed0c

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    488KB

    MD5

    6e12c373f05ecfd4a5c6bc067847db8c

    SHA1

    951dceae0a406843de499cfa48e7e22547db21d5

    SHA256

    72aae34480643dfa7d1806a0b8b07e42e05b4bdf566e6bdf5a03e8c2131be49e

    SHA512

    924d7072c015fb53bb3b363fca4c9beca3b1d8cdeb9b0ed895996d0a10e0f6e411e415c35dc4662f1c6466bc4f14f3da4aa32c23f420af378711cf9702932cb2

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    2905e7b43ffc2f767201f22e267bbc9f

    SHA1

    de54a90335654de5a71d014fb8e9fa246ea36ed6

    SHA256

    1ee940a2f2414dd6cee54accc48a420920ad03a4d15167fde430545afd0435d2

    SHA512

    ae0be91be44cfb9acc3e227f05d3dab88d3a59f80d6c949f8c9c3bbab97a43cedad79a06009071ea13efbbe00d912866fd4845aa86ede040e8aa6d243168cc62

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    658a5b39dad7f31ebf26ef58bd71d520

    SHA1

    ec9edd5357afb1227ac4dd00923717c9a221708d

    SHA256

    8d24e0eb135e8aa81e95cad1568afe31f17c2610f51fec7c685ac70dbd4b8f21

    SHA512

    f43b2b9acda34a2de06943d7b35e6be395d2ad6365d5f5df8c9ae5191edfbab960ad375db4cd0dd6444ac5ae54071a60fb8dc69bbdef2af209f18566a6c8f434

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    debf8002edeee576cb234ac06e3b1b1c

    SHA1

    dbaa67994f11ac4e487b584e608e6ca3c230e0c5

    SHA256

    25e0c8a9af045941d106964e1275405e1c2ebe021207bd3209e8b511a43692cb

    SHA512

    fd36ba4b3c12d8a9f9569c8619cb0989848291bbc4cfd05a37a633a1fac9e98c3e0ac4648ebe176f0c3b407639c06934c6cd036c3c5a4e7eb8ec11bc993333c9

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    ab08c664e4cb57d25c1c00965c0da16b

    SHA1

    e8a9a082f4b5a1779b3200355b13838a75603c48

    SHA256

    581e46f8ef827ffcb8143f022e2af03a2e047630fc2e187f32b48e67b2835b16

    SHA512

    1966d636a0e532f2a625ad48f7f144e9aa8f36774cdf12530814ded48ee17844139b492bc495ef6989fcb6eb2512c3610aaee05c932c2ab1fc1ad1862d2ff66f

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    488KB

    MD5

    e53bebcd4cf2abe5e3b3a9d68df02c92

    SHA1

    1d00d0e0f9907b6c2caade6dee4dfb50f457173e

    SHA256

    66b45400f6915d7c2d6495b630180c8c53cb693340ef37da2cf1c77927582bca

    SHA512

    557f873e28f6f9ab43da6b1b39d9bebb7e39308079250997f9ec25c8cfd3680b61a8e475fcfeb285b581f34405bf1699b76c6a6bda954d8d3912c60c1b19f397

    Download Submit

  • memory/612-454-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1144-444-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2016-266-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2016-283-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2016-285-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2216-112-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2216-265-0x00000000034A0000-0x0000000003A9F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2216-374-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2228-273-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2228-272-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2228-263-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2304-365-0x0000000000230000-0x0000000000240000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2304-364-0x0000000000230000-0x0000000000240000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2376-441-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2384-290-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2384-264-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2540-357-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2564-376-0x00000000033E0000-0x00000000039DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2564-276-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2564-98-0x00000000032E0000-0x00000000038DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2564-267-0x00000000033E0000-0x00000000039DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2564-268-0x00000000033E0000-0x00000000039DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2564-278-0x00000000032E0000-0x00000000038DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2564-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2564-100-0x00000000032E0000-0x00000000038DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2564-432-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2564-165-0x00000000033E0000-0x00000000039DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2564-111-0x00000000032E0000-0x00000000038DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2564-110-0x00000000032E0000-0x00000000038DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2596-417-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2672-297-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2672-99-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2672-447-0x00000000033F0000-0x00000000039EF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2672-277-0x00000000033F0000-0x00000000039EF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2692-166-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2692-275-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2692-271-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2696-421-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2696-422-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2784-453-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2784-452-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download