Overview

overview

10

Static

static

3

c9f41bc5f3...d7.exe

windows7-x64

10

c9f41bc5f3...d7.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/09/2024, 09:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c9f41bc5f366b78b6fc376767ff73628ee6d5fc1f0a9fa9dc5bedcd049ebafd7.exe

  • Size

    488KB

  • MD5

    616d3d1f176b32bb08a78c670e2a70c0

  • SHA1

    7a571f812dee70e4ef4b689a22465c4b98386681

  • SHA256

    c9f41bc5f366b78b6fc376767ff73628ee6d5fc1f0a9fa9dc5bedcd049ebafd7

  • SHA512

    54aabaf45e7ae97e5c97df11487c4e277244819d6bdc908ee658ff233db6923d05312520e23693336261419706a88f118b50fc57734b40f4948b3367b47e2713

  • SSDEEP

    12288:V/M+/MP/Mx/M7/Mx/M4/MpBE/Mk/M2/M1:VdK2O2HIBEd7M

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9f41bc5f366b78b6fc376767ff73628ee6d5fc1f0a9fa9dc5bedcd049ebafd7.exe
    "C:\Users\Admin\AppData\Local\Temp\c9f41bc5f366b78b6fc376767ff73628ee6d5fc1f0a9fa9dc5bedcd049ebafd7.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2352
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2684
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3020
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:612
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2036
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1928
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2368
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1852
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1884
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:936
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1920
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2584
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2752
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:752
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2204
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2184
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2380
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2016
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2956
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1204
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1748
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1520
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:1180
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2616
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2672
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2688
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:352
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1056
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2052
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1892
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2880
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2660
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2440
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1376
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2736
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    c421cf7f2ddf69224c34164cdab75283

    SHA1

    05a72d738833830c0cd7848794f9a6a3fb642829

    SHA256

    083858437888da7ba7fb0ef450a6defacdae743e472ecc46178e0f23b715901b

    SHA512

    dcaf167c6bb09b38a6e48c4e975a8b5b73bc852302e49cf263e0d6a17a8837c20d1327d99b1abcb1bc6e22b3fe2015be6d1251c0cd4ff8cd7f2fafd17f7a7ac8

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    488KB

    MD5

    284270f462664f3c2a564594928f6e32

    SHA1

    c7c2dc6b5f4568fed4dbb7ad584527eed6229d29

    SHA256

    a689cb496381f7833860c878fa6e0982fd58e8afb791242b0d8125b4a366f284

    SHA512

    26122059ebfc6da4a64f9986ef3299bf7cc38f2338624511893846b9fc209b9b9e74f05d1bd7dfbbc391c865630b3949ce344a339aaa87280d0830f8c726eaa4

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    9f011de0cf9bdf6437772994badab70c

    SHA1

    83497a307a25c20e5152f7b8d2d51e18f7201abc

    SHA256

    339acb8f2b97a29205abb938633c4a3d8d188ce947c77ceb4812cd07fa6e1b4b

    SHA512

    20e33b058533fe4d3680ed821225cb07ec0220dc9d73b83d8cc27622ce37b97326e4fd47533742909558ffa5dbad554b1a3de60329799307148daf67dddcfa1e

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    306a7fdd0f221f7fb267395dec7f3349

    SHA1

    017192012fdd00a4f64aa5b74f3af8350774e7aa

    SHA256

    88b62c96390e537e63f6758ad8ff0a9e2822c4a8331609e87db1531855336475

    SHA512

    daf82b491d98d5ddad039b1a1aa3bcbed0b85dfd8e3e1d0934e7fb7e56fb3b6514cec75b84a56091e7b71da76135e004195d26d62c80a2394066f8ba0d649687

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    d035be3b997dfeb049009f266f1be91a

    SHA1

    18ed1075e9937da14974134663f4787c7f9ead26

    SHA256

    bd6af3c214e1495a7d73b9cb44c10de1cbcf041435cb567e23ad827d57a3411f

    SHA512

    3fbfb2ba38246650abf9b36594a2c082a00c7993b26b8d3a8ce86d29d2cb69f4c11d58afb2acbd97b87b31d8dc161941f209cd9824a1860dfef73c3c86bb9634

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    f8c20018663b893809121be928914f53

    SHA1

    c29900945a04cc1a9e0e5d4aab78c4cce430be6f

    SHA256

    c228b68181ff9befe8d9af03aa18682079412b3a1f01db5767dc8bb0418d9973

    SHA512

    19345f4de8dea9c6c7613ec0ba0b290c9bdcd12937292658887f52c65f91f090c9c51ff90c2d8fed76b1108995e472607fd65807e933c976658d1d2280b70202

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    0648b654d4eecd12397899cc3f585f11

    SHA1

    6336a4be4389fbf11cbb0521cebb16d1b770c936

    SHA256

    de58eea36b5992dc0e47dbe732836135cce74be4c0dc71558a61a5dce5a1f9aa

    SHA512

    639bf7fbfe8b42279d297700d01d4cee876104ab020e0278481d8a7c85c28f844192ceea5601963d5723e4ff95d7b459c73ceb35c675ee47616f6d66008ec7d9

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    c57b52313dce0f24a60849308bec0802

    SHA1

    ba524a85e32a3d38c4d880a28be747c23943b872

    SHA256

    102fb1710a51a87c121a2ec59c4fdd03d692d3305f92f2b82448751a92022306

    SHA512

    0f074f571b788d04a231dd2a21ddd49369c85051fca179a9b2ec011cda8044fa8c1ab5145aac04f52ab156f2d35ccd359fa5e002d5bbe09be64a6154cf9862aa

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    f880bae3d314e6a5993e8923e9bde89f

    SHA1

    3de1ba1fa4abcdc43f40c8fd880500c806cbd5e2

    SHA256

    51dacffd0047c07423867cf1a7e9038e962072a165cf9dd9d08f0cdc7a582ffe

    SHA512

    a87a3b3c32421c14ffa91c7185d5942351b12edd04f8937428179fec966dc58b0d1dd2765e8a470364e15aae523c847347cd149acd0ecc38a73a2b8b58d3623c

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    5d877295cbedf04231a2ae873babab0b

    SHA1

    9d2b4a43274ff2cc1dffd638d89e9567839b9abc

    SHA256

    6d99e998a8bb0f0b4441864a3c39fc8185f4af6776e3c89d86e31b7574b68888

    SHA512

    131a90df333d4adce5fc5f0fd74402426a9a179fcfd6d300ce4ab480ac5a9d98c4dc3d5ae548a1e8cdb04516ebdcec3494900990ea96b0d17f1fbb2c34ae9390

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    09b7192f9b5e9a75ec984d8b5a99a895

    SHA1

    40c11df8907553053f389a3c97c21a84795be6a9

    SHA256

    328bcd0ad5dc6569d1e351758b7b0b754e7f8cac4512c7e7f6393f2e87f3a79f

    SHA512

    17d0a6eb615aec60812752e9a55f8410472058941ea085205904578a7c6875d97855c8a1805c66a75ee23497817c9098c95c884c1bebbb2be5501a8f51bce401

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    d5ba0e86f6d19c566e5cc32d2b16bd74

    SHA1

    f663c0d2e1e2d0467b10fd9ef5bec26a13efae3d

    SHA256

    b5d2579f56dc1aeab93c6356902e15b00be9d45d47aabea08a283538df6a9743

    SHA512

    df606f421ddad7fbe60e07efc7bb4982a1438ab5a3a7edb6b5edb15e6592bef173f29faa7c624e143ec2151c7634f60b0f294c1e4604be869a3bd8fb8fb81b42

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    05dae2b1787e12754a8678ce873cdce5

    SHA1

    8f222201fedde423b01ebb0f96ae8d9158e7183f

    SHA256

    c4289ff974b8603e547095c8946ae5b85235683a58e692c1d78d558ad30729d3

    SHA512

    4781e58a8380eb49dea20fdad669512acef801d3f229abc1498a3c3f9577c38a441ce95e4035e0ab3ae545f4cb46d33e5886fa8672f5a7dd9fa61b92ce335873

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    616d3d1f176b32bb08a78c670e2a70c0

    SHA1

    7a571f812dee70e4ef4b689a22465c4b98386681

    SHA256

    c9f41bc5f366b78b6fc376767ff73628ee6d5fc1f0a9fa9dc5bedcd049ebafd7

    SHA512

    54aabaf45e7ae97e5c97df11487c4e277244819d6bdc908ee658ff233db6923d05312520e23693336261419706a88f118b50fc57734b40f4948b3367b47e2713

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    9017890e9ea77fe01b0582eff961fb5a

    SHA1

    7d729df31417583c57e332c69579c61cd39e439b

    SHA256

    e4dd0091387404e9cf53df98aaa08ee3adfb00c1fb73be1a7000d34934af5d73

    SHA512

    2bce7dfaa9e340515fd808af1a71beb43d5db5583e75e6d662626e7860fac5a9d5939256321f6c1f8fa7ad68261fc9e8986fbed4d328a1e992b98ca4713e12a1

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    4139f26b8bdec0ecf7cfac9c4c907756

    SHA1

    38e127fe6f9b118063be75e7beacae1da3a404a3

    SHA256

    488eab6e55c55143736e2ef58c9b94bc1920e8444ed049833ee0c617636d2c9c

    SHA512

    668ad90c98d54f9c9a9d50b8b2c735f8723901dbcf942e7e04d3142cb542901ad106e41c188e7dfcc1f6e0450410ae212fcfb70518d9be8680c923ef8561907f

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    488KB

    MD5

    0670c8b962ca2b8bc39888ab622a78c4

    SHA1

    b287f9cb68e03d904d8bbefb08baf46c507e1b6d

    SHA256

    3df432dd4c7164a4a15915b99bff6106dd8568dc2ef6c69c6b5e5d02a898ad8c

    SHA512

    7f0761e72f2dc3912d18a4362bcecde7fd0447306226547d8ee402414110f0c02fc7f1688a73a6a64d4a0aed180729a7b81f48a2723b787dcd89e41ed85f9a8c

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    8b91c4701774517ca60f0c311873cdf6

    SHA1

    5d61205f1aa6b073d554d003bd61988d1b9ce1d5

    SHA256

    45d339c0e61e0befa3f9eea664f2d3a31a23d63c8f8bd187937fbf739d1ebaf5

    SHA512

    d751ce98be033968a587b57f3a583bc9fac8561bd7fc5a09ae1669d2c5f377e06817d4ddb7b9c68001f879f1a28141b791ba0a71e32d6e5a690cb631c76692bb

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    675a011fe04c1cbfccc3f88c66dae3f7

    SHA1

    db62d40f4728754efc80e17172d54e309bc83162

    SHA256

    1b9f41c671864d4ae1a7404b40daca1a809c096f3ca560f75785495afb4fad71

    SHA512

    122b6de5441e6e1224287a0140b3a676f985883d0c32cb68b01b3396df18fe420d5c3e987cf3bf42401a7add02b2fea11eb3caad86b4e4513df755d484735a2c

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    fce325f05c9a96fdabf64990c5e524db

    SHA1

    aec40bb7fb8402ec464072cc46cb47917e4a4e7b

    SHA256

    00d69f9ea8a9a4152a3863dcfb9abf8d63bc43c1330a0a72298c627190767a21

    SHA512

    a7918156a20ae5af9647457cd0a8775625f2a91e111e8db239c62873cdc2a2491c6dea5727ea1a8e93b9c6c7e71ba0fd752de08ebf33643b7ac64704a635f297

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    488KB

    MD5

    6a7545097608b9b41226263477332979

    SHA1

    22d617c3f7478c8356b2077286f00c6fee1088d3

    SHA256

    c2ffc1536d7bde97d78f7c7807593bac3d134c1356675ed8374e94114be5f9f9

    SHA512

    4a2586ddabc0122335f93fac781b997fad64639453bed9d5e2b438a473408afca6c8bac79fcd770e68da0eba750fc5450def52063b214e7f098188f546d26db0

    Download Submit

  • memory/612-232-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/612-309-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/752-457-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/752-126-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1204-274-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1204-275-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1204-176-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1852-407-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1852-112-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1884-282-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1884-279-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1884-280-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1892-442-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2204-354-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2352-233-0x00000000036D0000-0x0000000003CCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2352-175-0x00000000037D0000-0x0000000003DCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2352-228-0x00000000036D0000-0x0000000003CCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2352-98-0x00000000036D0000-0x0000000003CCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2352-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2352-100-0x00000000036D0000-0x0000000003CCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2352-110-0x00000000036D0000-0x0000000003CCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2352-111-0x00000000036D0000-0x0000000003CCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2352-218-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2352-124-0x00000000036D0000-0x0000000003CCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2352-307-0x00000000036D0000-0x0000000003CCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2352-415-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2352-125-0x00000000036D0000-0x0000000003CCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2616-414-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2624-410-0x0000000000230000-0x0000000000240000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2624-411-0x0000000000230000-0x0000000000240000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2684-231-0x0000000003980000-0x0000000003F7F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2684-462-0x0000000003980000-0x0000000003F7F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2684-463-0x0000000003980000-0x0000000003F7F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2684-229-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2684-99-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2684-230-0x0000000003980000-0x0000000003F7F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2880-445-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2880-446-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3020-226-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3020-225-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3020-219-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download