Overview

overview

10

Static

static

3

9983ad0d3f...8N.exe

windows7-x64

10

9983ad0d3f...8N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    20/09/2024, 11:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9983ad0d3fc695f334d8a5d2ce447d1339be26b85480a7347041e1d122e858b8N.exe

  • Size

    488KB

  • MD5

    47805fa5b1d5f89c904097e44f1ca290

  • SHA1

    4c87f4f1e0d1a4936b6f72242c56bcb4ff8b74b5

  • SHA256

    9983ad0d3fc695f334d8a5d2ce447d1339be26b85480a7347041e1d122e858b8

  • SHA512

    75dc449bf7b50bb7c8bff8a862c204f704bf58117c3d1f91932e9fb8d07bca5a1a903e08f4b53c766075b9ba85281c6531076ce7fdaf2443a28635d862b98fd2

  • SSDEEP

    12288:V/MV/MP/Mx/M7/Mx/M4/MpBE/Mk/M2/M1:VSK2O2HIBEd7M

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\9983ad0d3fc695f334d8a5d2ce447d1339be26b85480a7347041e1d122e858b8N.exe
    "C:\Users\Admin\AppData\Local\Temp\9983ad0d3fc695f334d8a5d2ce447d1339be26b85480a7347041e1d122e858b8N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1280
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3068
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1592
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1344
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2936
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2400
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2740
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:860
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:832
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1180
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2688
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2660
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2124
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2700
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2484
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:632
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:1780
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2980
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1612
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2852
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1980
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2540
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:1716
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2672
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1768
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2152
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1812
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:552
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:768
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2020
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2248
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2348
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2760
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2460
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:316
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    a7e9c9e941a36c48fa76a16030f79e8d

    SHA1

    800946c9ce4cdd1d7ce3aefea0b26f2679f3b945

    SHA256

    d2ed071a49ed48193abc0e1a91a0e765438df73c7d7ea807e0a29d49a60c826d

    SHA512

    a43f20abf1e73842bf44de739fb01b9ca1becbae84a8f81006ecc74eec797fa969fb9ddf30273146ffb6321eb387674fd3de2c6b8c5fd62edeb29846d5f02224

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    625a0ef57ef898661766f37ada7556e9

    SHA1

    3412ea573acf5ca6f041493b1d875efaf57d5f3a

    SHA256

    0651418468c5c968f075ae23647507bb9617df35c2eb13ec4c3064953b6e1b99

    SHA512

    bf188de6a0a85cef01e115192a5003ec7e5b398bba102cf4e9d285a0b085cc814ef0330bf3a4233c304b79051a2e6d5a78b4c0469ece989fd5cd59aae8467963

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    6f0f985a5410f5269f68b4a03f679c96

    SHA1

    a59ad57b13f78a2d82cae9895f4127a1f56cc20e

    SHA256

    e82ac531d4a32269dbb0d549bbee04a341f20d7681867ec33933df9ee43840fb

    SHA512

    1e1d5b76e0398c6468d1925b1e5cc1058f129571b2d4deeb92c801eef295a89d67c68e4d0dca2a274b0af1f35d7f52324c3120d9953a35a4398173b527cbe8e9

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    488KB

    MD5

    c738ee9a03d0a5bfe54425dcf80ea4bd

    SHA1

    0e8bcbce45f1c951ac270fcb441949e26945e2d0

    SHA256

    8d84e3e13b2c0c5f47f113d25aa27741ba78d3ac7270a613112a9275f0057fb8

    SHA512

    f81ca873e0eb59aac93ffdc6a023f152238740471f4b5fbdf33e344ea588d6a4c542dbe51e33b44e6f46c71bdfeeda4fb17f7e04b2dfe2d13bd13ead14df5501

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    66cdb5af29fafdc8f5e2a2fd11f94301

    SHA1

    cbad95dd8336eed77a23348f31d9ef7c409ff7f6

    SHA256

    4ff8bd7ba86b5fb232c746d3e4b53fc8fe7b8f4635f9a089c4da917a0c8d45d4

    SHA512

    ded1c0e4b2d6ad20df7fe6101ac7203da5326203e1e5b81c59b8cfa9397639948e69f9d78042616bf898eb6f5f1cbe9d27bc99c498296b5eae0cd7ebc2a39155

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    fcdc8bb3a8d77ba72c015cc6b4d33b4e

    SHA1

    8d0fb124d5f340d65443d24161c31e0cc25b7445

    SHA256

    b73dd49e3bb3a4066d18c674a1c734c369a00097cdfe9ed0e2dc03d3da450af5

    SHA512

    85b87d0d9b96d05dc8f26c42a702d2eb4c98f55b1e73f36b864e8bb6b8106986f8462794a59f59aba2f7ece76afb6c32d98cd263d8cd4b24af57a1c0f81f069e

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    28cf88935f3bf04d26c9141874e34201

    SHA1

    37173c12f2d85f5a4a941871520258d71686182a

    SHA256

    af8e785f1d20fbb59868c1326724ffe630e2ac4a47e73fb31cb08ba977bdc460

    SHA512

    ce6a8a3ef58875e826222cb6bcb0744abd4e7642ef5cd111f9309018a0c17e38a11d12ff0e0a0dd12cbb8843e1d88fc152c18d8d4ee45c199cf05789f5e9a860

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    ec379bd39016752d2745cfa8a06b5b97

    SHA1

    b4bcf0ff6b555e0d7f0efc50ea5879261dc81ede

    SHA256

    0b4656f03d33ba02fd77c60ace7b9e9db5b49536c6003d56c2e6219a22dba95d

    SHA512

    338beffe1c2318d3d11633bc4bdfa553e508e97da56a09ac41044a859bb57d28065ee60b346adacc4782e0caa5e4f2f048ec80137dbe1a5d9e59c2641114e262

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    488KB

    MD5

    c0ba2deada97c40c5da3897edfc502a3

    SHA1

    43d6ce149c059c492a515f6da43e9eec5993c030

    SHA256

    8f8e9068d7034650d4b909692e090a36ff6b5b2cd8947ab18b3d4b38e92ac63d

    SHA512

    b14ed08df4ada398bd2b6d091863821a5371a6041762ea3cb45c0768aee907ed2c8c191e67804be94bc93285270e374668ce5a1301abc7372859b2eeef28cd2f

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    feaad2a0d6460ab80bfa82767446d719

    SHA1

    1ff857480e835e0733d3cbda89cc4a7f20531554

    SHA256

    4bb22ec276cd5da9784baf55dd26b8bb85f05c4a50619d8bf31b453fbab2dc8a

    SHA512

    e0e9e285ed092ae3812369b1b98c512818046e22c5747411f2b7e3983bb25f8f695c1a407f6615a7be1b7b143eba4661f4ab119475c26da18b917cc87d275100

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    b5886474d79a487fc80cfa5a74e43041

    SHA1

    051aae0b8ddcce7896994a55918f33acc377ce69

    SHA256

    b2339621156ab98f39f5fbcd3f66b711e58817104fde82326b412f4395a173b4

    SHA512

    ed5f3ffa4292f22bb71a3593ef328e3dabdfb105f7d397c83a2b2264c0790f44cb27c73880b08d7e14b7ea598be6a7687c4f7a818dcdc76605c0753af6f4ea78

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    47805fa5b1d5f89c904097e44f1ca290

    SHA1

    4c87f4f1e0d1a4936b6f72242c56bcb4ff8b74b5

    SHA256

    9983ad0d3fc695f334d8a5d2ce447d1339be26b85480a7347041e1d122e858b8

    SHA512

    75dc449bf7b50bb7c8bff8a862c204f704bf58117c3d1f91932e9fb8d07bca5a1a903e08f4b53c766075b9ba85281c6531076ce7fdaf2443a28635d862b98fd2

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    cef2e12b81f077549131d9df4c5aeee4

    SHA1

    e84e6003036191cd72b66ae8dd366a92d499c300

    SHA256

    a0fde3dd384b4bff960497c27d4e230aa689407162e83e3921ba20e05eb620ca

    SHA512

    7e52985bbd7ced0bd7778e8c5eeefe9ad8db14436fe194e7a9042af794fc0f37d31897f36601c5055b607355c723d1551745e5b41e8b8f808d2c603e4f037f91

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    488KB

    MD5

    62b5f5eeb2033897d5e32e5bd6c57722

    SHA1

    e272d129602207a573400a3ab2b644852e17ee3b

    SHA256

    87939ddb9b33895b80862f5a1125f7183e4cc144f028daa545182558568b2ab0

    SHA512

    150968fd319842d9cad97e8ec1845c2bd433f9663b22e3fb7cd6c4a7311a3ad40aa2f9a0a7355f2cf7f413e8fda9c3f1a2ad0488df94ade3f5801b280bbc59d1

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    1e1dcf43a4eeb3fbbc2b3a048520b35d

    SHA1

    2f7db20aa2276d8d21e6aef22de12e382cd691b0

    SHA256

    f06450835800d5b4e39b121893b7f73e5e9568b4959d0f160b1ba2c21dbdcd3c

    SHA512

    5a8090281579ce771e17f11063814b9f4e1e1d9a0b446d98d83de60454be6e57e04dd1eb7b0749a2bc26ad2aea98081222aa3e81fa99cda6293f4f2af3d5caaf

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    488KB

    MD5

    e10df674ca2299b6b3250e71744a3269

    SHA1

    4719adaf8fdcb9ab1d1a98cdcef139de2dd77f0e

    SHA256

    a95e134e4332c563f566438005d9d4910f4a655822d463067446477b358af458

    SHA512

    bcecf8a6d04d6709bfa000cfdd316fca3f89753c92a092ef6cfbaf726b27276310217d71a7fec22b71c86a2573d96268ed3141b06ccac8c1cf46b3848e1eee64

    Download Submit

  • memory/768-285-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/768-166-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/768-286-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/832-284-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/832-283-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/832-257-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/860-281-0x0000000003680000-0x0000000003C7F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/860-112-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/860-338-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/860-256-0x0000000003680000-0x0000000003C7F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/860-280-0x0000000003680000-0x0000000003C7F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1280-110-0x0000000003A90000-0x000000000408F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1280-458-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1280-259-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1280-100-0x0000000003A90000-0x000000000408F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1280-165-0x0000000003B90000-0x000000000418F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1280-449-0x0000000003B90000-0x000000000418F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1280-98-0x0000000003A90000-0x000000000408F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1280-277-0x0000000003A90000-0x000000000408F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1280-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1280-111-0x0000000003A90000-0x000000000408F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1592-258-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1592-273-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1592-266-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1768-455-0x0000000000300000-0x0000000000310000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1768-454-0x0000000000300000-0x0000000000310000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2012-456-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2012-457-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2460-416-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2460-417-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2660-408-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2672-446-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2980-415-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3068-99-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3068-279-0x0000000003910000-0x0000000003F0F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3068-278-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3068-276-0x0000000003910000-0x0000000003F0F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3068-467-0x0000000003910000-0x0000000003F0F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3068-468-0x0000000003910000-0x0000000003F0F000-memory.dmp

    Filesize

    6.0MB

    Download