Overview

overview

10

Static

static

3

0dbf8a1158...5N.exe

windows7-x64

10

0dbf8a1158...5N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-10-2024 18:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0dbf8a1158225ddb88f22784084c5010d872bf8f2971278c9554ee0ecfe93e85N.exe

  • Size

    384KB

  • MD5

    703da70dc6f00a9ed2b8d3a8dd0e4e70

  • SHA1

    78072568e58fdc9f6302b9c4ff6a322a9c585e6c

  • SHA256

    0dbf8a1158225ddb88f22784084c5010d872bf8f2971278c9554ee0ecfe93e85

  • SHA512

    072ffbe10361f7fff5f2669c5ed595d6b11c5f406685cd557b8492c3cca5e009ebd3f0aaf0db79eb02c210e876be87139922e90af7dd3f6b16c3901eb30dd133

  • SSDEEP

    6144:V/OZpla/OZplP/OZplx/OZpl7/OZplx/OZpl4/OZplpBE/OZ8:V/Ma/MP/Mx/M7/Mx/M4/MpBE/h

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 6 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 6 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\0dbf8a1158225ddb88f22784084c5010d872bf8f2971278c9554ee0ecfe93e85N.exe
    "C:\Users\Admin\AppData\Local\Temp\0dbf8a1158225ddb88f22784084c5010d872bf8f2971278c9554ee0ecfe93e85N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4876
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2392
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3748
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1052
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4776
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4448
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:5052
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3176
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4608
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1912
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:100
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4492
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1248
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3808
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2668
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3320
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1100
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:32
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3200
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4864
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2300
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2532
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4300
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:400
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3188
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:824
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5112
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:3804
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:748
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2028
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1896
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2656
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2892
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:628
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2408
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    cfb43ce25998efb4fcbf3845cce9246b

    SHA1

    2489025d47468b103f914d8df208b9868047acf9

    SHA256

    dc66d0a93e63788ffb638bd91f50f2b59973e0d00d399a858f6429633f686b7f

    SHA512

    16b4f1f281fc30c3585a3e517e5d29b7015b2b58f6cccc04e631643c1a3295a0825b7ddf5ac035579c12225f03ebcf6dc59387a6aca0fec0a9cea986187ad049

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    384KB

    MD5

    7df29a7b7de910b7aa812d2a5ef5a3b3

    SHA1

    966501eaecced4a862b0d2442bceafb08ebd6261

    SHA256

    f93f1eebceeec4214b3e419978ab2f23eea15f45773be65e4e947e3462cfcb21

    SHA512

    7899d19dc6b09f91e32119678e879ae1e0469161934c06ad0b30fd969d87e3e1786cb39a1cd541a92c2818994835c195c6d3c88e34ab5a427e3bcf21ad332587

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    384KB

    MD5

    e6f000f806348eb5963bcb4d203b729e

    SHA1

    b4295b55cc5f2b01a9a2fbb4a91ae8700f0e50b6

    SHA256

    02515675817ea17066a39b12b1a906b291b48ce0bde36a153be5124d3fba411f

    SHA512

    3aa53b02ec3b7e6ac725b5ba91c6e95af8257b5cbdb39217a9887c8e04b6f64c14286e5f35725c61fd641f740a0a10b797999fc0ab4c1ef2e498892150bdebfc

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    384KB

    MD5

    6486e1b12d62450d47a9eeb79239afd8

    SHA1

    8f0b08f7accf0732c45d043fe6df506d7ccbe3bb

    SHA256

    45fd65d798e65b2215467e0937d6df68ebe7c5fc3994cd3020e919c9946eebd1

    SHA512

    ab67ac47a727f7db52b74abe7044cf65faeac49b6474587eba11c646c844e74d09656c9963a19efb004bf8f3e5706fa00d2ffedb0bab7176490c64031bcfa55c

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    384KB

    MD5

    322fa43173091f6d478c783cc745b213

    SHA1

    f9862ab4f778ea467f561bf76cde8657f9909e7d

    SHA256

    7cc3de9a4e6515a713b0f5d480bb7b484a80a69d431d37cbac6bfd0620ce9b8e

    SHA512

    583ba7badb1beddc150ea988bf38427c0a31365af13444021a52425de4437f71b04267d24662e4f3256718706e2610dc9dad8a819f3c6198fadeceb8c07f468d

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    384KB

    MD5

    97a076ee1896c8d736fd1bec64154bb0

    SHA1

    ab85d60fb115b53b5f755b5f84a537864f708716

    SHA256

    5d9752df094cebcb4424aa025b5bf3213660d10545bea6991ca4a6f934bf8a6b

    SHA512

    d14e65da3a6b26ef001f9bd0d203577f8b2abe8e7c78810ea25f84eb2de605c4d3b14130a15177a6b76ee6621d11fedf3254c2734e34ed6197e13b0c9f91a5a4

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    384KB

    MD5

    188d08463c4d2879c8106cdc9bfe1c43

    SHA1

    df22cabe6974c40caeb80f32669153d106cbe53f

    SHA256

    911675fc08086b689eb42572aee2e2d6971f5ac6485718f0c3f6fc7e188e2237

    SHA512

    b6a27a65cf8fdd9a2f145ea7a357125265637d480c7d89f44aa3d1bd584fa2101068dbe2c1b316bdb6fd82d8ba75d4909d4ce6d0a424fa76eb599820832ca6ab

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    384KB

    MD5

    4e4bd93cbc0ac0fa11073fb75a9376dc

    SHA1

    43d9ab95a8b8cc9c90a1434432307ce89021676f

    SHA256

    077c343531c583bf9750e3d9b798856ed989fb022981a544b4222bae08c309e6

    SHA512

    3fce2cb5962003b66c26485c662fd85b98bf51829c80172b9d8b9f17ddc225bf6388c558bda1948e2df8a0a2d3bc9143f821695de3ca92ee10bb0fe3c37e55d0

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    d194879cc11221250769fdad69d94e23

    SHA1

    e5b88096eb27e2697d0800448dc24c94698f3b1c

    SHA256

    ebb9ea4606d46d863d49d1c182c10099ed44796ad810eb183692ecc2f560c015

    SHA512

    06af5735d09872ab58eedbb194894f210aa0cff114f5fb8e36b968ac12a2da938b906bd7c1443efb11ed4db8a68baac678559a0a8eb0500285df1731e6fc3673

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    45152e561d1abc25bc2ee922649b1a2d

    SHA1

    c1f3476b767a09a78c100392702fa6e3b36bde4f

    SHA256

    35e47769d3f77e0350a01126f8f504a72cbcefb6fc755dc62675dfad29d44c68

    SHA512

    a892718e994795ab727a4ac58c8d2733c5285da315d79dbdb17a7133402443f79771c3cb019e49401a3db1c6100689b3235be2592650d5edacfefa1667750326

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    7f48879180bb3963a58f6a8e541ce640

    SHA1

    b94e98ae1e47ec94d51cd0704a75d7ccd73cbff3

    SHA256

    d62e42bc98c29e8923e74e754eb5fc035ddb875795f8e20c3cf5c840a40e5699

    SHA512

    27781a785d225bbff05171527377c47d0394d459332d32b6987cc25cb8b7aa890d6f601394b922a9dad853418a51f4ea1a68bd994c683019d1004eba49c7ed82

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    384KB

    MD5

    c1157379af36e2e1e74eb0eaa8e9c888

    SHA1

    3b574bc15e1c85547629d463b4ccf8b2a3e5a3bf

    SHA256

    6c43002da7b2aaf7e5d0d6aec5eb4fd5c0bf53485b3fe91f2651a16b8b4151ce

    SHA512

    8a62a226b228569e71e61549fe88958d7b2de79a77df0c2102b79a3553efe07e846446d9a8c6222a9f9bf2fc3aefd12d9c86895c8d3344037068cb5938e8be34

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    384KB

    MD5

    d141c96be0038f062fdfbab92f2ff2c3

    SHA1

    aadbd2a331f4ea4d1ec3e0a2227d54f7b19df3aa

    SHA256

    09c31fcf299c6c49eab28a2ee859481e174da26ae586a68dcf338257dc2af37f

    SHA512

    fed4ab45c23c54b7c48331248e00958c79eb2d249010160c3848b23f7e6f559211665292f5ab2dd91c97cf9bfb35f893ee4f4d55d718fd2fccb06cf714fa0f33

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    384KB

    MD5

    3ca4580ac43456cc09ba1ef8a5a56069

    SHA1

    40be262fd3b69cf9e3eedec7172ce2ad7f9b8f7b

    SHA256

    73869cb03ff7610a89906d75e09c9f92bc31f69850956f9b7633d461d7955481

    SHA512

    f438d568ce4086d6c75e79c062c251921e63827930a201e0e7ca7abd87172540c321985d133a2d64bc49435abeadf97fe00e6a0ab0b8d1cc36d087aa6f6779da

    Download Submit

  • C:\Windows\SysWOW64\IExplorer.exe
    Filesize

    384KB

    MD5

    5e5d8ae9980dbb4d14cbbc384ac58b1e

    SHA1

    dc409803fcd669fb23d60006de11ac38d61e8bb9

    SHA256

    580720b5b3c486f4b60e656661db35788be488a25770b6fb52a0f99cc2076fe4

    SHA512

    dcd892b9043f1f99afa22c7d3ab93ab5da87b76cd7c38d13833f4f532c77412171780dee8c5a8024f0f1982a164edd82b555e1b10d7743dfae0cfaf43985eaee

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    384KB

    MD5

    e759ee170aa2514d4354e23433f8c3b7

    SHA1

    0f8c25476efe57d79ba51a668746d0dcd22e8db1

    SHA256

    e1e348a75a9f9f8b0e40b84847381ea1e2bc19e7c501adaeec2ecd7fcd229017

    SHA512

    6da892fd1cac4d49987c961fcd011d2355279c8934256acaf0da26210edcfa45d5d6e927bd5dd1a2584bbc4ad31ea27e48a1d6cb196caa815329f8d073a408c5

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    384KB

    MD5

    5050e97b45e44397b61698723429c882

    SHA1

    3b04c97ad20ca6eb2800aeebdf21e202f7c88407

    SHA256

    d21a4fb17106b0e0e1c036a010a15f12483d8f2474bc2eb90ee077b79be1168b

    SHA512

    3df349870e277a280a8b60281a65e6d7cfd393d7061875ad6128f1d8e5ad347b422ca839a9b3b29b468264509d3cfa2418a168dd854bf20c432623df49096103

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    384KB

    MD5

    703da70dc6f00a9ed2b8d3a8dd0e4e70

    SHA1

    78072568e58fdc9f6302b9c4ff6a322a9c585e6c

    SHA256

    0dbf8a1158225ddb88f22784084c5010d872bf8f2971278c9554ee0ecfe93e85

    SHA512

    072ffbe10361f7fff5f2669c5ed595d6b11c5f406685cd557b8492c3cca5e009ebd3f0aaf0db79eb02c210e876be87139922e90af7dd3f6b16c3901eb30dd133

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    384KB

    MD5

    befe3eecb16bbc9d6f0fc8f5874bb537

    SHA1

    91df028699ea6226ee643debcabc2a32cca97e0c

    SHA256

    4e4a88bda70fe87c78ac5ed9d53b8663d1978feeaf1ec38b540cbe3aae925550

    SHA512

    caf902880be13319c5bc65efa0ed0b729dccf989b353939ccc6f1485f5df9ee2397f1d5884392ba9940bf4b906d6bfab729e92e899b400f33e80d2627a19281e

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    384KB

    MD5

    c7834a5e08fb4ba52f6aa7abc85fc0c5

    SHA1

    850f319fc666d715f78e127d2635ce096c82cb27

    SHA256

    bbc1925a4df779e7cb90fe72a682ba528669880c413c675099bdbf5ba05896ab

    SHA512

    a25bd0a7350201a8bbf3e4295eb9c85ac1f44a434e864a11ded192f2c22799065fc20a700b08b42209f6dbb210c3211804d84a706dea198887b0af89383a3d5f

    Download Submit

  • C:\Windows\msvbvm60.dll
    Filesize

    1.4MB

    MD5

    25f62c02619174b35851b0e0455b3d94

    SHA1

    4e8ee85157f1769f6e3f61c0acbe59072209da71

    SHA256

    898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

    SHA512

    f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    384KB

    MD5

    00b45dcb164cc5bbe29909e7c2614dd2

    SHA1

    40e8397ba45f7bb70f1a0ba6f0a4c0d5337951fa

    SHA256

    81ec7d1fa77a7dbeabde79485d6973c3736c50bcb63f52862e05d8ee3924169c

    SHA512

    4a1257f20ee56a1676ed05bc53c5b70ff081071c698ff191dd057866dddca2549f18d329c838a17937f3c2f990888f74b1d8a29d1a5fe01937d5ecf19fbaee45

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    384KB

    MD5

    2cd6e4bf60ffa65192e11183f8adb8fd

    SHA1

    440b7ce5e17fe81baa6124d8431131e7793f6d6e

    SHA256

    61a5e7f94d4fe0ed626bd8018da0f4641302d8381a5351e1ee8bc0e97c093faf

    SHA512

    109fee3d8242fd3ecf021ae2f66ecba233c64ce382d2a39ad1be0003e79392580a3ea0a247b507dfc4a50b52534c3286c43072a5ea22cbb0f5bae4c0c76f9558

    Download Submit

  • C:\tiwi.exe
    Filesize

    384KB

    MD5

    c69013539638df459e5ba528e149b577

    SHA1

    97f23f24d723fef5fa21fcfd658ff8a84d49ba4d

    SHA256

    a5d2c7289e8154201e3227a39dbf4b0ce8dce5909ac9e607ebbf16ca90771702

    SHA512

    45fec496850ea33ffa2d92c5b009f8c5dd2988aafee4f6c8318edb561c8cdd0075df358a0cee979fa1c9da6a9a7b8ef4d47f6280e2ba9f2613e7c33a9a510e6c

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • memory/824-211-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/824-192-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1052-258-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1052-208-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1248-293-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1248-102-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2300-311-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2300-334-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2392-96-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2392-269-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2668-299-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2668-312-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3188-194-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3200-110-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3200-297-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3748-186-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3748-207-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3804-270-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3804-409-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3808-257-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3808-298-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/4448-309-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/4448-315-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/4776-295-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/4776-265-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/4864-310-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/4864-296-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/4876-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/4876-263-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/4876-390-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/5112-261-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/5112-215-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download