Overview

overview

10

Static

static

3

0dbf8a1158...5N.exe

windows7-x64

10

0dbf8a1158...5N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    20s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05-10-2024 18:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0dbf8a1158225ddb88f22784084c5010d872bf8f2971278c9554ee0ecfe93e85N.exe

  • Size

    384KB

  • MD5

    703da70dc6f00a9ed2b8d3a8dd0e4e70

  • SHA1

    78072568e58fdc9f6302b9c4ff6a322a9c585e6c

  • SHA256

    0dbf8a1158225ddb88f22784084c5010d872bf8f2971278c9554ee0ecfe93e85

  • SHA512

    072ffbe10361f7fff5f2669c5ed595d6b11c5f406685cd557b8492c3cca5e009ebd3f0aaf0db79eb02c210e876be87139922e90af7dd3f6b16c3901eb30dd133

  • SSDEEP

    6144:V/OZpla/OZplP/OZplx/OZpl7/OZplx/OZpl4/OZplpBE/OZ8:V/Ma/MP/Mx/M7/Mx/M4/MpBE/h

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\0dbf8a1158225ddb88f22784084c5010d872bf8f2971278c9554ee0ecfe93e85N.exe
    "C:\Users\Admin\AppData\Local\Temp\0dbf8a1158225ddb88f22784084c5010d872bf8f2971278c9554ee0ecfe93e85N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2436
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2648
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1604
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2428
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1976
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2276
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2228
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2192
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3032
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:848
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1368
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2796
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1020
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1532
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2088
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2692
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2780
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3016
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:924
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2500
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2560
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2520
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2768
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2756
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1092
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2056
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2480
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2116
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:436
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1784
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2284
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2216
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1948
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3008
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1816
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    484c3e35feffd25187b9f7661eecb09d

    SHA1

    1787b731719f121e51e883fe0fa78cec2a4a50cc

    SHA256

    f7cc15e9760839d0493aef0bff00f4c57e0753c689718bb89d4d93e711359252

    SHA512

    4e7a2ce6979c8dce315b76dd5021ead6e72517083ac3f9486c4b679b724b01d263327694f51c9f55e6cd7273e9ab06e1b923e3bd386bf699050d09d5e57f6c63

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    384KB

    MD5

    11c0dd8f9cc9c144b634890f4d09556c

    SHA1

    80d265887e31dfaa3016dae32f0ff3ff62b8d32a

    SHA256

    504c635a3e07cbcefa7acc83c110eb5a6f62320ddda3e78ccead443a10eff516

    SHA512

    dacf5a47358d02e4182a32840fb75f853dccc0fadf86e508b8de536e2535eae5e397500181a642dcde4522539dfa032412da2d0740f17b4ad09ea8c796aed190

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    384KB

    MD5

    57f01481b37e3e4f95153d8b77fe7edf

    SHA1

    32dbc0879a5970feb6d5051af1e953cb2c3d73a1

    SHA256

    25a4e29d965db86611a6a14aadfa741aac100bfa7992ac9b6a82c90b76eb2bda

    SHA512

    2f3b050989af7719f8b92bf0fd5ab2e886bbe28f685f46190c2067c6d15e78f4a2f6f6aea54cb0b7b7c666c5a15c5b23867dcd09beb580059fc85359c2f1aad3

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    384KB

    MD5

    9b75bf76501fa2873c4643a248f4cad5

    SHA1

    62dca7e685b7694234863bb2c33361e6ae6a084d

    SHA256

    4e960131cc841ce1f497870b026f15920d1b22161520a2bbdcab40b5d812ef61

    SHA512

    19074dd870e13fe7e03995bf661d7cc907e93c1efc401f03ddab84e506424344d6240a932b5358d56c28d920737697d0ff634f5f680fc8b781fa3c7a662c3bd5

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    384KB

    MD5

    934bb50f2e27324668a65493da126de3

    SHA1

    30d8da0e7ac1db9f3ab3ccc1c333b5eb183c3d72

    SHA256

    6e5e0786be4a49d909ee75402ff9c7d6a7ff62891fefb29df42b9f8b110657d0

    SHA512

    340e2f15082af675c2311d808d533c7b6a402fbdc7f8b2bb856060b3d07ea2b5ca5b29ed227325e0befc5ad7eabdb59b3c1a1306a2ca8a8142ed24268b47bda7

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    854633eb8d36b310ad35008686efd973

    SHA1

    006c6c7139238b50f393fbc915ca5bf360f2567c

    SHA256

    24fe0b680eb174c335144e431e2e6afe6fe34db63fe3bcc42e738d77c4c745a1

    SHA512

    380bbaef5a131debc5aa744ea2576b4899d7531aad69bd54bda3ed7296c3b996bd510b63a8bab79a95013aacbef32daf716b30fc0f22f5afd3559fb660d24836

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    5de587e5b99aadd5d003934106f618a5

    SHA1

    b40faf40e90e2b8a0ac36f5d68984c2e895baa3d

    SHA256

    4a0171ad859c6d4f8f1a6b5a3ee7564c312f8c76e644211def85247ac944e8ee

    SHA512

    dcdd4b4ea89fdb774950ea3643b8a774273b8a11792ef10dcd7ae584ad6661ac57a410c525959d017c9b77751aae311b221009234685b914d5871fa61ea82938

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    384KB

    MD5

    934bd7064e872b636a96f963e8cbd812

    SHA1

    a04ee4f5ef9feff13bb16d5df6714aec4ffd4dd0

    SHA256

    2a4f273f4d3be6e1d98c1f6cabb4464cd4b4a213952e691b3696500391f78502

    SHA512

    20494a857413ce1e71aea4edec02e19728f6c1223a9c25f171744158deea85a0d63b8823a42d16c559bd3fdb958c2dc9710371c9c47b147296e8790390bddaea

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    384KB

    MD5

    ca748f8f60581c83deb7897aded70eca

    SHA1

    9acf77366745410ff5eb8431bc13da3706e82f4e

    SHA256

    a546f3a95444c483da4b90c8354e41d6cae28b13aba65aaea9e276dd12bcec0e

    SHA512

    4e3dbcd81ab21c5d4db4a35266024534b91ecd1aaa0b86bd65254ae76ff052ee537f4cba9bf6a39d88765784486cd6407958b2a400680fe1d56d88db352c842f

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    384KB

    MD5

    3f94a6e8f595c4c59fd269a4f689bf35

    SHA1

    07898751bdf7fda76a1efb96032c597e3904a222

    SHA256

    444343a479e712bf41ff4e270f8881a623e7b075a71f4d5c1a919ee36b889fc3

    SHA512

    460ffe6f0f83c3e2ea0a9ac9cf1ac8485489c7ecbeae04d86cfb0003bbd17edaea2c96533fc38f69e38cdb8554d015a6d9d9d0d91425926ebbe8502ba20beed1

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    384KB

    MD5

    5f97a57c3b67230024e5f69ed483958c

    SHA1

    721a758d364bdc1758e536b097b072185ab62283

    SHA256

    7d679030b36e1d740444c459b92ae13f4d907f6a8c5fc934c42297feaeb51d62

    SHA512

    5225bc5d05aaa3b4985f01821ca33822af44a0a8444d3e15fced6a392475b4a8f8c24a2dd24378934109059c170b0b0f4fc05c46aaade15edecf89d5926053a6

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    384KB

    MD5

    d9896c31ae72fdd9dd4ec8697cb90345

    SHA1

    99142b723f38530b31b53e137c0c67958f6abcc0

    SHA256

    b4d9b14aeab90b55a1ff2716e2f88ec26dda96d056958862e6ab215f02699069

    SHA512

    859430e155f435e44f2169b6782e53cefc6b0b404871ee0ab1939f8e45905ae12a8274df1a701a3351b546af95d323548112ce01b8c095db1bbb3624e9248072

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    384KB

    MD5

    703da70dc6f00a9ed2b8d3a8dd0e4e70

    SHA1

    78072568e58fdc9f6302b9c4ff6a322a9c585e6c

    SHA256

    0dbf8a1158225ddb88f22784084c5010d872bf8f2971278c9554ee0ecfe93e85

    SHA512

    072ffbe10361f7fff5f2669c5ed595d6b11c5f406685cd557b8492c3cca5e009ebd3f0aaf0db79eb02c210e876be87139922e90af7dd3f6b16c3901eb30dd133

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    384KB

    MD5

    5946128fd984dcb439659a6cf52b43be

    SHA1

    b58a1c064812f39cc07b14d034ac3fe0370b5fd2

    SHA256

    907b184913cccbaeacd6c15c9e5a0e056b7786a6ef7419b2542c1066b5fd14eb

    SHA512

    9d89f4b8958e4beea4de743c05d20860f560c6cb75613c1b32105245388d76a666d091886227081bfed50e80bd97b7fc5a2a23c6b0932dd0b2a83b52d03b61aa

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    384KB

    MD5

    6ab5c0fdeac5ad24ac439cc022c1b755

    SHA1

    d6e31b8f1db03e7cd508ef173bb83f8effd60c20

    SHA256

    efa4a38a3f1cb3c7b51f323ffdc651231f7afc0e9970f4852dadc4a22a5138e8

    SHA512

    f1754f1c91cf581e0d4a0884ea825b6f5618acf759c0a9665a724d2cc0acf8528fe2d3e9777c69a26045ca9f98827867eed7eaef9b2c01e956f6cfda00d9e04c

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    384KB

    MD5

    cdb5dbb70944df3d2aa272452683e2e7

    SHA1

    c7cba78abea64093a200bc9bcf899ed4da437d85

    SHA256

    4117c8ca0f76ca861248098fe10505da4d0f45e20449d1a8fadcbaf9df82b98e

    SHA512

    830a872e76d7e05ff5e8d29a879be8d4021ffd784ff85b18a77327eb404367ac363334519a025cccd39ee2f9ee27301dc99e11f1dcc1c3aedf5001043be0db95

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\imoet.exe
    Filesize

    384KB

    MD5

    35bd67ae0230b1b311716157b159939f

    SHA1

    2ac4a741c2fe6486b674e77ee3e41c249dc2d4d3

    SHA256

    3c7f23a701a5079df68d196b4274d85e76f8221d9bfc0ee8724ab6ec4ba8a1d3

    SHA512

    35c972fbc80368ca91468027583ab328c34e52c964cdcf3f3efae9f3be4ddae72cf2fac623a88ac2fc8b0c10180def9d9400e842344da19c793dd0c2b4c8f288

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    384KB

    MD5

    ba2c079613753b8dd842ca2d8560fd1d

    SHA1

    5541ed73896e7cc9dca45ff9d2489e3d16472b14

    SHA256

    0619991e091516aff53add1ad241c2b0d52dab994537b24dd77f18e3955af0cf

    SHA512

    52150da3397d366883c7d062dc75ccff3177ec7433c7d48e90cb10db2cb11e49d01819cd55fb2530d70796c612226d0b132935812b748105b3761e9cfa289fbf

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    384KB

    MD5

    a5254418397d25bd62acc1e2600a4645

    SHA1

    7b2b3e4c88bce427ec62800b6db3d7b21c441704

    SHA256

    7a5a28d950dac7f8288f5af1876bda07b025c0c089541eb048108f8182f18397

    SHA512

    cfb3719691a086f99492ac7ab650b5d99284d719a35dbad83a7014de0ec3f5c2623bef6d21b5206114480aea37ae6aacb3159febbba9d3c65b5ee984fb6bafcd

    Download Submit

  • memory/436-275-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/436-280-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/924-264-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/924-293-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/924-288-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1020-421-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1092-428-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1604-212-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1604-224-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1604-162-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2116-389-0x0000000000230000-0x0000000000240000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2116-390-0x0000000000230000-0x0000000000240000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2192-417-0x00000000001C0000-0x00000000001D0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2276-384-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2428-225-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2428-269-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2428-265-0x0000000000270000-0x0000000000280000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2436-110-0x0000000003450000-0x0000000003A4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2436-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2436-206-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2436-111-0x0000000003450000-0x0000000003A4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2436-448-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2436-100-0x0000000003450000-0x0000000003A4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2436-276-0x0000000003450000-0x0000000003A4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2436-429-0x0000000003450000-0x0000000003A4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2436-260-0x0000000003450000-0x0000000003A4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2436-279-0x0000000003450000-0x0000000003A4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2436-98-0x0000000003450000-0x0000000003A4F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2500-291-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2648-262-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2648-388-0x0000000003480000-0x0000000003A7F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2648-229-0x0000000003480000-0x0000000003A7F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2648-99-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2648-226-0x0000000003480000-0x0000000003A7F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2692-436-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2768-385-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2768-387-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3016-263-0x00000000034B0000-0x0000000003AAF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3016-295-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3016-422-0x00000000034B0000-0x0000000003AAF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3016-112-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download