Overview

overview

10

Static

static

3

8e9316fcfb...aN.exe

windows7-x64

10

8e9316fcfb...aN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-10-2024 04:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8e9316fcfb2ebcab1131cb233d259ac7c22732c6af85b81d314e390acf95a09aN.exe

  • Size

    351KB

  • MD5

    ef27fdf7082169a2ffe88ac3b4821c50

  • SHA1

    7d7dab58ed43b6124e20970928c453a19a24ffe6

  • SHA256

    8e9316fcfb2ebcab1131cb233d259ac7c22732c6af85b81d314e390acf95a09a

  • SHA512

    877a5e2938a74e30438d6da76e7e2f5074dba877bb3b0640db624a33a09ad861744d11df394f3c9fe76aaf7dabfeb439e8d0ab6aa8be2b959f746ed058a2732e

  • SSDEEP

    6144:V/OZplaYZplx/OZpl7/OZplx/OZplQ/OZplU:V/Maqx/M7/Mx/MQ/MU

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 6 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e9316fcfb2ebcab1131cb233d259ac7c22732c6af85b81d314e390acf95a09aN.exe
    "C:\Users\Admin\AppData\Local\Temp\8e9316fcfb2ebcab1131cb233d259ac7c22732c6af85b81d314e390acf95a09aN.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1136
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3988
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3424
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2400
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:4304
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4468
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3056
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3200
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3396
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3068
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:1160
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:5064
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4408
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4480
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2772
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2760
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:4388
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:924
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4528
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3756
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4024
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1484
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:5052
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1840
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1008
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4512
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3676
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3432
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2340
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3620
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5060
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2348
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4524
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4560
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3172
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4328
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4264,i,10065386245627775856,6567048529106473151,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
    1⤵
      PID:2336

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Replication Through Removable Media

    1
    T1091

    Execution

    Persistence

    Boot or Logon Autostart Execution

    3
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    2
    T1547.004

    Event Triggered Execution

    1
    T1546

    Change Default File Association

    1
    T1546.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    3
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Winlogon Helper DLL

    2
    T1547.004

    Event Triggered Execution

    1
    T1546

    Change Default File Association

    1
    T1546.001

    Defense Evasion

    Hide Artifacts

    2
    T1564

    Hidden Files and Directories

    2
    T1564.001

    Modify Registry

    9
    T1112

    Credential Access

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Replication Through Removable Media

    1
    T1091

    Collection

    Command and Control

    Exfiltration

    Impact

    Inhibit System Recovery

    1
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
      Filesize

      45KB

      MD5

      f7a0763fdf870b186639e2c961a71419

      SHA1

      db426b0825c6a58e273080aa6243e659fa16e062

      SHA256

      6ba0c40f1e65945610a6c99eb512f634e4c5823be3b3e1ede6cae14ea13e8dda

      SHA512

      3d9b6bd5ffe79bb4c737d1053d26f40f1f63611c669877eca6451fd49d69705f0ee09cccd6ef22eaa79b98fe67f64c608e6e39e5644aa40411005957cfeeb3aa

      Download Submit

    • C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe
      Filesize

      351KB

      MD5

      788715513763d91b22bc515724b2e7c9

      SHA1

      a83bc1c18b18dedfbd9d8ac61657fae5154d7aff

      SHA256

      827a2b6949458b4994a9f627efc3552ade3fdd099663896013baab9617684c60

      SHA512

      3e2388ba851391bae537f4a0f64f8de4df3f31db459a0597262cc8fb489a34cab9650870d6c2e1e1fc42bc0f1ee7a9420f924450e7e54baa89707ab03ea3920e

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      Filesize

      351KB

      MD5

      221978cd8e4a22431df2b70e026d7cc2

      SHA1

      fab4cae384acbb5e8abf3d60d5462d9af21a5f41

      SHA256

      be0856664d25b37e32eaae1a003d6cd984bb22ff48b4c2c1f400fca3a96accf6

      SHA512

      6ba5cf371993c8a5d1b8bf0e582d4b64ac72e5c760383ebeecb544327fd9a3b3024c88cc18c2fa1c168f498c49412e94139ab70750b1a201bd9a7ee80e2ca423

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      Filesize

      351KB

      MD5

      430da28f67cea6b956b8d1cfa9d59d7f

      SHA1

      bfac8a4d7694a6dd183d48f4bb95cbad7ca4ac65

      SHA256

      cd2bebeed1cabfd26e05078133e1dfea5c1f857eb6e05aa792eb5ba747298e50

      SHA512

      8ab9beea3b666e28ed469eb92371ef1bc7be6c459cac53657dc2754a6d368eb95f9aa4d508cc089d8f76b7cfc9c482f677e57d9515b19bafd23555aec469dfdb

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      Filesize

      351KB

      MD5

      d8b3fc798ea45891db74efc3314a746c

      SHA1

      b7782e6ead0f2732e2d7666700c3118f57ef136a

      SHA256

      98c51a42aa40a0f4a360f61695ba85db6ecf88f6c0f3c03f702742127d7bf938

      SHA512

      b2921e987f4f467e7ae00121bfd8d7c9800cc9de90cf1d02978cb3cdff3167790c31817892bf281b6bd1abb93dd5e0a2ccddffd2037b6408a13d3a0230e11035

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      Filesize

      351KB

      MD5

      a9ab45a7898c7d869bf4983559f26c99

      SHA1

      a7470257d14d13042f371ad33dc84081ec2d8362

      SHA256

      e3ab2a6437f3a0cb6cd03c27f61bcc1a7fb7500dafd65e44da7b5a1b093986c2

      SHA512

      1fd778e743090ada41500a661f551b6897d23cf5715a3f3c4272a5df49aa294584be2cd06f0b046f3dc322370124a6d6c8e3389fce84446aa9584816e7b5b28b

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
      Filesize

      45KB

      MD5

      8428d8c817217f67463b6c337403e6b4

      SHA1

      7a328d9fcc0239417153301f34a726a2c90480ed

      SHA256

      34e3092817b404b410432b9c1be40e471a87eb7926f40b79fb1ee30fbaf537e4

      SHA512

      0ea973b00bcb9a83432fb82bbfdc7350fac9f2b701f79061c0ab6ce32e08c0287e7bee361771b2195dc8cf26e007f11762bec9a4754efb07a6042ea2ef2bd4ce

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
      Filesize

      45KB

      MD5

      0de776db2a4be61ee368ede08d282656

      SHA1

      60f66a5d84db270a3b81d542ea18e4b008273515

      SHA256

      31c4701c2a2d22af905de923d5243d08ca8f770cc610e68598dc87d6bdb482cb

      SHA512

      7c4953d7531b519e23336a054da0b567e411e2273421066351ec40efed0b5dfb9ad36fb1ca4e838e542d06aff7c5fb966ac3cb16018aea53aaf5ea81a07ec53f

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
      Filesize

      45KB

      MD5

      0528141b16d0e7f6b6df6161ad9688e2

      SHA1

      f0a99146a92294471f64b0ae7aaf6c5877618be0

      SHA256

      85adbbb835d3b152889dff9737e63c268c44a1b8b64fd3910079b81df9a6b69a

      SHA512

      a9779e90c6f2e98e97b0446266659eb92f1fc94a8ac682e0f71ae8009c1575f9faea9052a8672361e5ee4a826428e83e37b3b6f1343f62d4c6c6c08158f9131d

      Download Submit

    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      Filesize

      351KB

      MD5

      e2fbad0cf0e933bb3b4f66cdc190c679

      SHA1

      0aa529a48acc802c50f8d85a2e9dbd091ac8ef65

      SHA256

      93e1001c69592c0da6001cf0ef997428d69855cc34e1f16b67f7173e24d21333

      SHA512

      5ba6ae68d62e938f06a2b4a8444bb37d8f7dca318beaae2927f6646a32d0c0b3c79e867df8da8e74b4c7f9f45f5d3a883ff027befbb7211a2392cc67b6273952

      Download Submit

    • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
      Filesize

      351KB

      MD5

      5d770c3f084f407cab7ffb0e4beab898

      SHA1

      c022dab981a17c91aff2bc48a2338114e12164d3

      SHA256

      9aaca7787ae066685bf94278905a0bf1aa38230540525de08deadecddd9bf3ff

      SHA512

      5ec5a132b18c7f91cb7983b8a4f420dcd8817103331f6efdd37782c20880998e287e9f292016feff607d883c8b50436a5d51587d993ea5a4d9f4426a67804c96

      Download Submit

    • C:\Windows\SysWOW64\IExplorer.exe
      Filesize

      351KB

      MD5

      f1e98ca073105d52a7332204c956be83

      SHA1

      8487d9c5b80ed1eb975a8099154f80a5e7c38a1a

      SHA256

      077e580f280d12969cc8bd1f61382cf7fd2238e223a2ddc2acef9fc6da8de6c2

      SHA512

      ceca5e7b75891df8411ca194e49b8fc5b7a7aa344e227334c904de0079b0744c2d49af6fc2f45f19ed36ce0a153556dfab68587681e9b8189fc8f6d60480f8c9

      Download Submit

    • C:\Windows\SysWOW64\shell.exe
      Filesize

      351KB

      MD5

      0ad5511aedb468b19994ee277d132be4

      SHA1

      e527d93912c9949b7bc25ec4d734fb3593e70057

      SHA256

      544f8377f5cf730e9f521732f0a3d3eb322d1714ceade6d315e2d923dc0c8339

      SHA512

      01263e7d8d2c16e1129d5d895b5f23684e79199ceec548b8a8ed617ce8ad051c8b1ba9bd68113ad6bd41e98fb3af6eaf265f80c9d2bc0b6b8246c34ba1fe6dbb

      Download Submit

    • C:\Windows\SysWOW64\shell.exe
      Filesize

      351KB

      MD5

      ef27fdf7082169a2ffe88ac3b4821c50

      SHA1

      7d7dab58ed43b6124e20970928c453a19a24ffe6

      SHA256

      8e9316fcfb2ebcab1131cb233d259ac7c22732c6af85b81d314e390acf95a09a

      SHA512

      877a5e2938a74e30438d6da76e7e2f5074dba877bb3b0640db624a33a09ad861744d11df394f3c9fe76aaf7dabfeb439e8d0ab6aa8be2b959f746ed058a2732e

      Download Submit

    • C:\Windows\SysWOW64\tiwi.scr
      Filesize

      351KB

      MD5

      ead856b173a09928cd3d7a7dc3d1e6ae

      SHA1

      bfb4fab2f024e953977b6a74dcbd0310c1b38e87

      SHA256

      00d613cb733d2f253d603098c2ac3f47d9fdbd42702fb6cdb05206e90ec69c26

      SHA512

      cdc297c1a790186d6e68b2d08b5f830e9065773db5cc824e21498f93be6ec21962c6e12fd249a91ac317018dce07c841d7197c236b44be0025bb5b537eb674f9

      Download Submit

    • C:\Windows\msvbvm60.dll
      Filesize

      1.4MB

      MD5

      25f62c02619174b35851b0e0455b3d94

      SHA1

      4e8ee85157f1769f6e3f61c0acbe59072209da71

      SHA256

      898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

      SHA512

      f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

      Download Submit

    • C:\Windows\tiwi.exe
      Filesize

      351KB

      MD5

      f754691c174199978b01759e6ddfe36e

      SHA1

      9886c5c66ebc8edacf68bb584d578970b5427456

      SHA256

      91bebb723f4063661057b50e3f7c77930591d0d9413117d3d8bc54350bea1565

      SHA512

      dd07b39a0baed2a34a22dd89de0872cb08dd063a44d43d589f94d0e6bc81eced1fd7a6cab9610d269ace599b8c14a21b17c5c92a36adc36fae2d9eddb52bd27e

      Download Submit

    • C:\present.txt
      Filesize

      729B

      MD5

      8e3c734e8dd87d639fb51500d42694b5

      SHA1

      f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

      SHA256

      574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

      SHA512

      06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

      Download Submit

    • C:\tiwi.exe
      Filesize

      351KB

      MD5

      79b5e66a9ccd1e31ee46a5dfededfad2

      SHA1

      2365904bb610e4f68bb8da43b030727837d7dfbf

      SHA256

      55bab7c0785be43ac959041d0ff7af5cf718377a82bca8e986fc85f8eecf1ad7

      SHA512

      b735ebdf070cb9f25a9ac6ce591139ec43274032779b7a0faae7c716e98ca2d8eec3453311444cd34bae7f213bca30c3d987942c5fe61752e4431342cbaf131f

      Download Submit

    • F:\autorun.inf
      Filesize

      39B

      MD5

      415c421ba7ae46e77bdee3a681ecc156

      SHA1

      b0db5782b7688716d6fc83f7e650ffe1143201b7

      SHA256

      e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

      SHA512

      dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

      Download Submit

    • memory/1008-293-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/1008-299-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/1136-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/1136-234-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/1136-404-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/1160-383-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/1160-240-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/1840-278-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/1840-292-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/2340-147-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/2340-153-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/2348-242-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/2348-298-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/2400-204-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/2400-225-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/3424-203-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/3424-198-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/3620-154-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/3620-217-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/3988-241-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/3988-96-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4304-228-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4304-368-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4388-267-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4388-405-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4512-350-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4512-304-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4524-338-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/4524-302-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/5052-266-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/5052-102-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/5060-235-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download

    • memory/5060-221-0x00000000003E0000-0x00000000009DF000-memory.dmp

      Filesize

      6.0MB

      Download