Overview

overview

10

Static

static

3

9634f5c9bd...aN.exe

windows7-x64

10

9634f5c9bd...aN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    15/10/2024, 06:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    9634f5c9bd619d2b7cc20409d3d88fcaded8af9d608a6238bb783ff9d749f0caN.exe

  • Size

    351KB

  • MD5

    8e3bec4f465c89a6243c457c92000d30

  • SHA1

    395bb5624d25b9d9e6ec040b4c733d6e8794c018

  • SHA256

    9634f5c9bd619d2b7cc20409d3d88fcaded8af9d608a6238bb783ff9d749f0ca

  • SHA512

    71c452941343bf0fe67258bac71515111a47c634cdb8ee700f9f206130a9c52406d2ed9cc1bebc0198f44e3e7a820712937a0326e92f69c81398fe324194f389

  • SSDEEP

    6144:V/OZpl5YZplx/OZpl7/OZplx/OZplQ/OZplU:V/M5qx/M7/Mx/MQ/MU

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 8 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\9634f5c9bd619d2b7cc20409d3d88fcaded8af9d608a6238bb783ff9d749f0caN.exe
    "C:\Users\Admin\AppData\Local\Temp\9634f5c9bd619d2b7cc20409d3d88fcaded8af9d608a6238bb783ff9d749f0caN.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2308
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2832
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1160
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1992
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1880
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2324
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2124
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1800
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1480
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:376
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3068
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2044
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2928
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2272
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1616
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:580
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2628
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1564
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1008
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1988
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:1780
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2552
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3044
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2656
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1764
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:772
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2448
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2688
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1732
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2536
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1896
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2188
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2136
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2224
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1128
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    314fdc610ddce9814dca73f7b013c34e

    SHA1

    13504f3dc9d315adc3a2140b4f59538f8020584e

    SHA256

    5533c859464e1260c0735151a18d11321345146be437850122926e2f546bb319

    SHA512

    d2f798369d8b18f455eaadb9af18353c317e0cbe602394cd9b28b77a9908ca803b8b8c34e398a901bfbcd4e07e2ef279d5dab0e6937c41d96901da5e531278d6

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    069eaab2e2a57a0a68ce45c15ebc0be5

    SHA1

    2e2a242e26a134f1d1ebc01f58e3aef7224dd709

    SHA256

    5217d2b236cb8daf42cd0198a2536bf51d9a4953d34f4a77d3567cbb2d7ee131

    SHA512

    f5c303d8bea4d4fd8605a0ad3cff7d414aabd94ec5de0566ea38489831b2a3aeeb09778a3050e766761351c947fd3e227385b6a151b291aee991067ec34ef9ea

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    29d2c3b5b0da18d0fde6c64ee880f36d

    SHA1

    a800d8898df499956c3f96255625c5863843826a

    SHA256

    74874526eac8bc3343467abcf8d8f97305532062388a8320ecd807cbb8e3c81d

    SHA512

    67e6c220dd4a3b7e8731d203979a3ad8256a4b813eb28f414c8052c4d8dd99964cb70383f0d990f1af3ca8d3056f8672439fd3771adcd789ee9a1c7d4acdcb77

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    351KB

    MD5

    4aedc86dbe8c53bb0d427f521ba689bb

    SHA1

    0fb2f0f23ea8f93e3a7085c6b7d9789b49728adb

    SHA256

    4cf7fda81ec4b543b986d008169fbbf6d4aa6d460d75d1876a7350eb4a5a41dd

    SHA512

    ef5e8b0c51ecde3566f8668efd8c81a7e7c1d7fe892e44104a9b9b470f586cbaab6f27c90a4bfc0823f49375c4bbd387860aca36f9e4401a7493eff8061e1b84

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    351KB

    MD5

    bc2f1f09a11545da2ba60b820a1111a7

    SHA1

    a9483d983623b623d60f37b6f459447f4bbee18d

    SHA256

    9d90f53346171016331b852d348ba16972632762c16baacf6b54db1bb4121d64

    SHA512

    bb7a654b31f0c534b8261da276fd1e6a92618a7ced88f957eb5e15a1a5bbfa37a60f59b616d42561d4672de03005e5948208cbd20833f918f251d5926e9b57b2

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    cba918bd2d9695d6ffbd09a5944a1320

    SHA1

    830e354914a70e6ce5971a73ff09825b7f85e369

    SHA256

    0ba03c5f57059ce1dfae2ed4d8b21721887094dcf7ca082fa459941ef76534d4

    SHA512

    867f2db71d56c6ce8b0512ffd40c8f924cc5625eb5f9e0d01d071023ecfafa5aca5cad91ecae9708e4a43784724889b7d100572eea1aa7af505f564f95f7e38f

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    02640ed204a9daa0ebeed9b31ed2c3a3

    SHA1

    7716326c433a904e2c0c5000e6f69257d08e5b26

    SHA256

    a7d3923fa7858eda1cd77989d51e44abaf31579ef7daf62d6baec944bbad2f16

    SHA512

    2a9bdbb1488b1e7dd5b7eae68b57fd406b16ede09c05fac15dd92fcc7f5118372f05c0d414f02b9ddbefbfa179331ee07cb1060dda3137da59c6b8274643a5cf

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    351KB

    MD5

    990d079edda38f45f0e63473b593370e

    SHA1

    429759646ee101e9d647060992114ce97e869c07

    SHA256

    303fdf01e9da4278c391b9e092bf5ae082fbb44731b8a36f0cebdc1fa2be19ed

    SHA512

    4ba33497e30b35b98e2ce4532ec86708b5497f809f940da8399e2e302d45dd2c2ffbc3240cd644f311ea91f2f1b5ce5850191040a05e6fec8d5809405ede6f80

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    351KB

    MD5

    3fdffa449a2072e66286adde35ed3d38

    SHA1

    d6e78e3deaad90c7ecb8807adc032db68e80075a

    SHA256

    33f445cc2774b0126e60942c7b167a4b794eb5e8bfe59d2679fb0b4b6ab53de9

    SHA512

    49019d381306109b1500079b6900f00de1a244e1dba3cdc8d716c52ef96b2a3db9b2539cb4c55d8b76d223981613e36fceb9515487dcd0ef01e7f823d2e23fa7

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    351KB

    MD5

    d004d2cd441a1da95e6c3b8ad0c75da6

    SHA1

    5fb4359e9a31fae456b3a652b4cf5623549ce112

    SHA256

    bc0d5c4236151cff2eb024fe70ea905ab52ff108283485a5b1016ea93dd48ce5

    SHA512

    5d6c7b7c53a3af9df72e84a20d499e5be4bfaf74cb36774b077fb4823ddb3d7bb95cdcee48d8ce9e72b8f806a3caab43addda17fc4e0598ba5fc12d55cd8ea5e

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    351KB

    MD5

    1e4a85f4ea22b6d0b37756fbe306493f

    SHA1

    d622e4c4c9b20356ac04f72e0d0411374d6a0583

    SHA256

    7a5b34ca2a5c452e59b8cea853c29169188c95c854c9aa78d46de931b689431f

    SHA512

    84e84cbd08b984e9891caca706be6716ba7a9c49587c4e2e5e5e3f3a55695730125ca1ceae34ddbb9a0cadb5092e160d8aff9a92dca21da6fb360908974a7144

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\IExplorer.exe
    Filesize

    351KB

    MD5

    e4ffd593b8708e0f3bdad4768425a742

    SHA1

    bc6326db495cf2328296b35bd97753cfa224ec71

    SHA256

    3959f6f28f562048a00c4df7b1f2c0ddc8adac77762ab6749bf76f05d04916aa

    SHA512

    ff5562ed572a74336f7c951deb16cd2d219df9da65b391266b1d16aa399e057902c9385917271852116917605f9dd8f38cf41ae91c64afc3c45e9983c555df1c

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    2612746eaefdb8093f971e3c2610260d

    SHA1

    59f95cd50d5f479201f85c55f05db3fa98412080

    SHA256

    5f64c3e2658c4dd16f55d9bf2012b7d297c45cbba4bac951284c4604bb69170a

    SHA512

    15ff4de678d91c38cdcfd7ddd9a7e167fa2eeef6ea9a0fa868cafd26b73befbceadef035b920bc0cb8fe1f85498484653042c36cb6bd632a401e16382fafede5

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    8e3bec4f465c89a6243c457c92000d30

    SHA1

    395bb5624d25b9d9e6ec040b4c733d6e8794c018

    SHA256

    9634f5c9bd619d2b7cc20409d3d88fcaded8af9d608a6238bb783ff9d749f0ca

    SHA512

    71c452941343bf0fe67258bac71515111a47c634cdb8ee700f9f206130a9c52406d2ed9cc1bebc0198f44e3e7a820712937a0326e92f69c81398fe324194f389

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    351KB

    MD5

    83915222ffcb15b8c86727bc0eb889f7

    SHA1

    ceacc22fd8646338a02db3762c36d790fc9e70ce

    SHA256

    55b6252fdf2bd910c3a1ffcf723a8f11ee2bed255a9c3653350e80cd847060ae

    SHA512

    6b382b82537387655824e8d1a358c76cec5aaceedf0e458a68d870f319284d921b64f34ea741b55ee47398bcd297680a4256bf20a772cb88bdc80ff9941cd86f

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    351KB

    MD5

    e498ea5f833fde2cf9e3b67999b02ec7

    SHA1

    405a3b86bbc4c10199be3d1720710919caaf5f0c

    SHA256

    957c8b0caf22b6a97e4a9c06f754bf259e75b748e8fa65200b1650c24ef49f68

    SHA512

    c0b8657310eb38f9c155681f53015474dc3839c857a4c1e7fbcc8790dcf49c496606390da2c04527be81f2b8f5e3a045df46c1c4f1598de6eb601e526398612c

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    351KB

    MD5

    a32c67c2c27012a600263b63e3251f82

    SHA1

    0a417c89c5190a14d4f00328cdbdaac1e7100ba5

    SHA256

    19f00d1d43989f51820838330228ddff555893f80a46fefce04d57512e6a9f58

    SHA512

    b7b5377ee2b98689aa9ba8026000a4f23953ca330b00055aee56132c9816d7a44a54eb0eb2bc82c7f70fd13f9b60112c9c5b79ee6d718354953a5556418710c8

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    351KB

    MD5

    6db34678f7bbc8aaa3f5fa0b780d29e1

    SHA1

    8669424c92b86a026540f20656c52f0c0b3d567f

    SHA256

    296f180357efeda8b3d241e55b322b350627fd1c1493f17eb3cd175298b0d68c

    SHA512

    dbae1eec487c8b31a3c7ef99edc4eb9e69573a1577be1fb0b366ee98a7169239b03a7c3468f01dc44da8c2395443a9306c7cd284f7c465696cd01d912912f9e2

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • memory/376-294-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1008-168-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1008-218-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1008-219-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1160-222-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1160-275-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1160-472-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1480-285-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1480-286-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1480-277-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1636-452-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1732-461-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1800-112-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1800-425-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1988-267-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1988-278-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2308-166-0x0000000003940000-0x0000000003F3F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2308-110-0x0000000003840000-0x0000000003E3F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2308-223-0x0000000003940000-0x0000000003F3F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2308-274-0x0000000003840000-0x0000000003E3F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2308-224-0x0000000003940000-0x0000000003F3F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2308-165-0x0000000003940000-0x0000000003F3F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2308-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2308-98-0x0000000003840000-0x0000000003E3F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2308-111-0x0000000003840000-0x0000000003E3F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2308-100-0x0000000003840000-0x0000000003E3F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2308-454-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2308-268-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2552-409-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2552-410-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2552-411-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2832-99-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2832-317-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2928-418-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download