Overview

overview

10

Static

static

3

0b7ea3b47e...fN.exe

windows7-x64

10

0b7ea3b47e...fN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2024, 17:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0b7ea3b47ea30ee39442b030d377db49379cd2b97895d397c8f70cf8423bf93fN.exe

  • Size

    384KB

  • MD5

    1cc81e95ffb00d473cefc42d1b73ead0

  • SHA1

    7a83b18ac33c84ccf86b2a7d204c409deee108eb

  • SHA256

    0b7ea3b47ea30ee39442b030d377db49379cd2b97895d397c8f70cf8423bf93f

  • SHA512

    fc88505ceb2bd185e7524b9ffe70db6ab8fd95ff29374a32cbc97d175d3a933357bc8818dc3512f90a5763d397c4fd5b835ee538a84245c97783fdcdaff8e7b1

  • SSDEEP

    6144:V/OZplu/OZplP/OZplx/OZpl7/OZplx/OZpl4/OZplpBE/OZ8:V/Mu/MP/Mx/M7/Mx/M4/MpBE/h

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b7ea3b47ea30ee39442b030d377db49379cd2b97895d397c8f70cf8423bf93fN.exe
    "C:\Users\Admin\AppData\Local\Temp\0b7ea3b47ea30ee39442b030d377db49379cd2b97895d397c8f70cf8423bf93fN.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1920
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2588
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1736
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1712
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:764
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2544
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2980
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1900
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1580
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1976
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2800
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:1784
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:316
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1220
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2920
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2832
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2928
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3060
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1800
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1620
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2056
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2804
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2468
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2028
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:308
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1692
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1444
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2724
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2640
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2940
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2156
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:480
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2792
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2004
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2012
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    86ed3a3f2b91fdf7ec4eba058617e135

    SHA1

    d48c3bde032d6526938fde57886aacc1be880c12

    SHA256

    7c1875a13ea730ec0057be6636534abc8992d2530b2fb24f677990cfa5350543

    SHA512

    574fd793fdad334b834994cb8cdd3e1c6dd0080055da86a25528545356d8f47610cdb7c6ffba2ddc99cc33527ef8f39ef649722ed399ecb996fe8546ea3d8514

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    384KB

    MD5

    2499e646179ee9747e6005af810d7c51

    SHA1

    9dc58b3d73e2dbf6c5d67c1a81ea345fa88fd8c5

    SHA256

    0e43b546efc58df42c129fa97cc8d600d42ef72972cf1279edf70e9b598dd76f

    SHA512

    f015776fbd05dc19b749c96f964eae1d0ab1008f6d6345e3ebf853e9b40094fa376fd29b1e634232b166a6d4c9a1b6d35598d45c864f944e2983f5c8f92cdaaa

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    384KB

    MD5

    1b1e00e81c56fd1aef66acd3cf4b789c

    SHA1

    296449fbd6fc1fe58a0ae162ec3433fcf185c261

    SHA256

    c677ab9986efb20e9e22748b938fd0aff83bf83ecd6490c8c51b898cb932a020

    SHA512

    749acdc2f05d6d650eeddcfcc44c83ae0f21296e6dbd8ad708b7d70b317bc361e775881ebaba0b0bb43f2ca0351b808e078b01acab07336b1b1bd7c956956c2d

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    384KB

    MD5

    31628032aab2c101a48fcc9ac6eb784f

    SHA1

    f71ee94c3b43a2322ab35f67292741ee1a947dc8

    SHA256

    f2ee5902fbf37014d4d00ef140087e6fb96635f56987bea1a6816421d0e91f5a

    SHA512

    a86de65b170aecbd6ea1cf39ddf83396c9931235a4151a48f3c907ad353d19254f397af720f015a15ffd2204e4c8c5f5c6197109b7b00c2db778b8413ba56413

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    384KB

    MD5

    31b08644ebef5202df0630a13de1c476

    SHA1

    ae246c0663b762ee7d03d4d83282fbfab5b65e4d

    SHA256

    e3dc6651ef614abfde00ea1cfcc9e8ff82d8e4ba7c296d72ff093ed9ea7d4986

    SHA512

    4c59d20eaaece571985f391c780f2bed00191af030c1f6c2bed2fcb95c9b2b67c0e0679477021feddd29ad6d5ff10c05a9f22d16f3188311730b368e0f33b486

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    d800e42ae7a5e1540337b4c2b0f1d149

    SHA1

    d2f5e4d1b47eed4c03eba4101a0b2c6ea00d39e7

    SHA256

    c36c478f872b4ddedd876b236a02a2c455cca00805131bc55a0897cae7b4aa8a

    SHA512

    2e013e6d626ce33cf97c249d9290f4a27f1b42c81758f844044629e27149c90b990a506409188e16f33e7a69ed3ff75ce67cbdd9e3c189bb46c8cf68db353002

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    e214305288671370cf561225bd34a0c6

    SHA1

    c670543cfa96a584f65aa130fbe8d705190a2d1f

    SHA256

    9b95610efcaa4215ce1417bfc7dbf1f208491d62d7c991694e01636caec99134

    SHA512

    2721b4c087c499519ad95240705aa60ab2e1d4bc99526e7b598615d0d769da06948596f72e3b8d697d0ad58dbd444c0c27bbb8cb156a669364ba50f14f5cd801

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    384KB

    MD5

    320ad185d800013ae59d67ff74bc692a

    SHA1

    847e65243e62b40b35c4ec022cd5683d3d4f7002

    SHA256

    4fe8fdbd3a030e291c649c8b9a6ae9aed9ed27479f7a8d312f315195ae3706f5

    SHA512

    b578d1b84bbe947267e8986c5b770bc173a0a7b5f80c02486414950c29a1a302816950fe886c44244f585d441f5fb1caa4a61a1dacc1094587155ec61011923f

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    384KB

    MD5

    2ad4521dec2481651d57c3d83f479598

    SHA1

    fc9edfa9e1095d9b664a31dfb3e82caa28d87d34

    SHA256

    207f63dcaf08c6cab41a205e707e63437c4abcc163ba94e4dff847cc340a96a6

    SHA512

    268318ea701b9fad243c75bb0cc1adcd064d2b692c44db9ac458d57093fe884b35f6ce6882d2154eb438f422268ff34092e51ed7caabe9975a72e9afca634581

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    384KB

    MD5

    2ce348f43023206547ef9bb98b3387b6

    SHA1

    047c44e5e63319e3e3ef086c5ba53de089799513

    SHA256

    bfed4b17e262d5e221998c84fe0e04826167efd19d23cffac7680cacb475e0d0

    SHA512

    81f25ea1dfb24ee3a6509062e2bf4475db292af0d4a54a95f992ccd3fb09757019d6f95ab1d7254a77a5be666105be46a42af72697cca849de8ab49decd52b03

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    384KB

    MD5

    9777d065b1f003be3180c18156a5ab91

    SHA1

    944f02b16b8d6b65ed7c886bef3a3eba2c046ecf

    SHA256

    069f469207687646749f61312088bd2d9cbb4a757df5d740d3a16c47722dd33f

    SHA512

    78cc6e7dc60f4854ff38437ac04e38b329173e87d9795ac63d193c48bb725718286222b4742c736f6fa46d6d2b71131f3ffb4e8e73ac8e29c001d2e651a2fb2a

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    384KB

    MD5

    1cc81e95ffb00d473cefc42d1b73ead0

    SHA1

    7a83b18ac33c84ccf86b2a7d204c409deee108eb

    SHA256

    0b7ea3b47ea30ee39442b030d377db49379cd2b97895d397c8f70cf8423bf93f

    SHA512

    fc88505ceb2bd185e7524b9ffe70db6ab8fd95ff29374a32cbc97d175d3a933357bc8818dc3512f90a5763d397c4fd5b835ee538a84245c97783fdcdaff8e7b1

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    384KB

    MD5

    02dc934ae82716b4209de907b5ba7340

    SHA1

    64c752a2a7367bc71b817c2d54fe8813dbc69ec0

    SHA256

    a16a25e9ade7cb9c42d7e63533d69ff0ef8d4e55cb198a2e98021bdfe58fc494

    SHA512

    8ec9f54c34ad1feb42b983bd8160432cef8c3a1aaa7ca1dc6031bebfa7f00eab8c493043cf4ad190434d7ff328834aa330ceeff16c2c1073787ce1c29bc5d935

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    384KB

    MD5

    0a5976ed3a775388d3e58d7798d4059b

    SHA1

    7d7f874834115b1129209abc2dd4a2be2d83e839

    SHA256

    bade254293909b776a438cc28cdbcf641d5a53eca725dccd7d62c7f014ec23f3

    SHA512

    02c7a5fc33e39750baec8667842be1af07cbeeeb94463a865a00bf76aa37651a80d76882e4893c4a57065650b80f8e9e421e5ebce067df89180de645750b4f44

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    384KB

    MD5

    66bdcf8f119173939801ce4e7a5c4014

    SHA1

    728a6f37aa6e5a1270d616703cf2ac5d92986bd7

    SHA256

    5ab7bf0ed2baf6b60fcf396b117af61f4e903415f88e872e67a34fedb440fa86

    SHA512

    2efad73567ffdd0daa500ea3974bea6d5dea6fd3db52151a74ff7d31a1b622cfc47444d2f4a30fc354eb1a49bfccdbc1ade939d5a9f30e2b20937c3bbf2e6f95

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    384KB

    MD5

    8d9caef8e732ec9182c3b553e1688b22

    SHA1

    61fe94fc8cf924fc58f5dbc9d159e712cfa6efa0

    SHA256

    cab9fa37775877c0add9169d2b51ef338455a3fdf6197a4254a79efba889c330

    SHA512

    596ca408ce8eecb0734942fe9f6138ba5eef302c0dfb1ad4a402b12582a8731ff21417277b19662e49ebe93f0939a942e94fdc4327fa9d97920a6706ef56ddcf

    Download Submit

  • C:\tiwi.exe
    Filesize

    384KB

    MD5

    7bca8f5b4374d27c5c0042ab8806d6b0

    SHA1

    3c2b81a9df044391702229fd8415a46bdf1d467b

    SHA256

    0bd396c5c9910cf5e2159f759a75026d7404d01230913924f8259abf970b97d6

    SHA512

    ee19c6dd48e1330e7490868f3e7c6cd56c7eae43222916f7176e24483af72dacdc6adea8bd9bd47cd51aaaa74fadd1f214dce756190e6369bb6579613cd5b3bd

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    384KB

    MD5

    c8f34376a483d891242dd60c4e4bf475

    SHA1

    0572e5644ffdf201a57a1d3f9eb298301d83c1b5

    SHA256

    63835cca2dbded860c2c9591692a793cca2767fdf662c7b57d04604ba051626f

    SHA512

    5b0ca3e1942987312afc5a116d69ac3a4b52a93a245b367d175d252b1bf1eaefdbe538f2a79f6c89b0f8f4918decf4b2ffbcb9977908baa7869bbdfdd3af54e3

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    384KB

    MD5

    a1d8e70c13fa665c196770cc78f076f3

    SHA1

    504e7e12c1fbaac282f1f6cdd903a665a0cadd67

    SHA256

    d0e4ad05e873f9a71a89a6afe6844f606b34a61df3f8169930294cb369465df7

    SHA512

    ceea224b1b08663e475840ad39f836b179c0a1925facc51432728eb3451df2060393791f5791e4f7b0e8faf43f849c9f3ba20d03438eeb451e5bc226bbbab27a

    Download Submit

  • memory/308-330-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/316-434-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1620-333-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1712-329-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1712-270-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1736-220-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1736-247-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1736-248-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1800-321-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1920-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1920-97-0x0000000003900000-0x0000000003EFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1920-219-0x0000000003900000-0x0000000003EFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1920-176-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1920-125-0x0000000003900000-0x0000000003EFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1920-175-0x0000000003A00000-0x0000000003FFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1920-456-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1920-124-0x0000000003900000-0x0000000003EFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1920-110-0x0000000003900000-0x0000000003EFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1920-98-0x0000000003900000-0x0000000003EFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1920-111-0x0000000003900000-0x0000000003EFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1976-447-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2004-435-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2004-436-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2028-437-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2028-126-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2056-352-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2588-459-0x0000000003A00000-0x0000000003FFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2588-100-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2588-251-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2588-250-0x0000000003A00000-0x0000000003FFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2696-454-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2696-455-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2804-379-0x0000000000260000-0x0000000000270000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2804-380-0x0000000000260000-0x0000000000270000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2940-312-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2940-313-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2940-177-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2980-403-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2980-405-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3060-112-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3060-332-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download