Overview

overview

10

Static

static

3

9f3b6c4b86...82.exe

windows7-x64

10

9f3b6c4b86...82.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    01-11-2024 17:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9f3b6c4b8696aaa01c6041fd6ddf7ceb367665581ab1f1141fc3a8b9bdfee982.exe

  • Size

    351KB

  • MD5

    307237e6aa7c78c29f2bfac45ce3d7f7

  • SHA1

    c173014b1d922dd4ed978c158641db9fb2f3a4ee

  • SHA256

    9f3b6c4b8696aaa01c6041fd6ddf7ceb367665581ab1f1141fc3a8b9bdfee982

  • SHA512

    8f24f0dad85c388b6a6f14b36f49917c48fe3a932ce2eb3c8122eaba62aa5b153626e633f8691de5cf9ec3923ae67dc382866200b0a4398803ca0f59e207ce26

  • SSDEEP

    6144:V/OZplJYZplx/OZpl7/OZplx/OZplQ/OZplU:V/MJqx/M7/Mx/MQ/MU

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 8 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\9f3b6c4b8696aaa01c6041fd6ddf7ceb367665581ab1f1141fc3a8b9bdfee982.exe
    "C:\Users\Admin\AppData\Local\Temp\9f3b6c4b8696aaa01c6041fd6ddf7ceb367665581ab1f1141fc3a8b9bdfee982.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1908
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1044
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1160
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2432
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2864
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2552
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:872
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2856
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1960
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1032
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2844
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2696
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3048
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2300
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1320
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2708
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2612
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2700
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2108
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1660
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2756
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1008
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2824
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2608
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3008
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1860
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2392
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2676
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2804
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2572
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1700
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1896
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1920
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1864
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2072
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    02dc7b9c1fd0ad748beec6ecbee2b43c

    SHA1

    29c1f7a39967dcb788901462530108e7cfbaa391

    SHA256

    51d0a99ca45d724d638d3d10cb09c8f0a2bb1ac408cf0c3c658856b513a0a331

    SHA512

    92e3dd302e3774ca6c377f9be1b27c14e628e51155c8da7673c617873fd1f3737942c16c2ffef85b92abfbf8425d3fb69177f622a7e2d795f68f07b5fa2b0dcd

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    d5b1579519fc5240293e467811db42fb

    SHA1

    8073dc54d280d750203162414b597eb292345de0

    SHA256

    6f6430e58e1dba68f9c5ea597377c876973cdd93f5eea7e2d5e9d95e76128de2

    SHA512

    0fe86a7fc2060c04ae2dd6888e41befe03f92fc29696be3e7af41b141fb127c1c1062740ee684d0c558447a867acec39b0f44fa51937864897a9d1c52a178443

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    3ae1fc0a3aad16a47d3c6384068abe9c

    SHA1

    cdf9f58c7cf1a40e667adf4c475af1e88af5ffc4

    SHA256

    0f4f5b5c74e3c094edcadedcce6668947d7c8c5702d91541b3bb669c2f8f73c5

    SHA512

    64e7b381a2adb55e275742f024c52be2b8ac577eca9c2be81dc8df30a0eb93692c3a9b26344d8872bd15676cb8eb8bb747912ead46e016d7027e070bd61db299

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    1264aa678c1bc853c34c6ab0cb2808a9

    SHA1

    5ceae55bcf3b4d25e124cc573a4c294e6f239538

    SHA256

    b37d3dee80e7d851dc96d7d322844c3a3760c34df7014be25b8d089fe4b9a3b8

    SHA512

    c4898633491f39244b23d909caf1261b2666b01f639a18244a4479628153bd6bf47dbf8b277d103ecffd697c8546121f1a7f86204729f59e5ca194b5ba9c853b

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    351KB

    MD5

    dc467f8cc66e2aaa751b4e397028a21d

    SHA1

    01754243cb0222272554e986a1047cbb29b17b73

    SHA256

    276efc0c27172e1af31787f5e77d45c78476c3527db342469a0fc3a69e53ab7c

    SHA512

    bb038eca15167384ec373d229f2385fa79e596fdd1808f89ef7d89f2befbb4b93762cc1ffed1d99d254411031c5b442db14c249775df53597484b60768f28772

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    2816ff8f11e337fe85af870080537a6c

    SHA1

    9fc6c378c6d82e117f8ab14e914348cd5c5bdd58

    SHA256

    843f617e608282b4c6c0b5b1bafd984cf783ed6f0c75a7d83bcc69fc84c8a14d

    SHA512

    248e1dba45cb481e90072fd29e3dac2e6791589cb008d91e1d3a0ede7e4d886ccdd1d7d220c2a94532da8499d2e50f342579bba033d88e3dbbb72fd3af4a2349

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    095d84381f6de0dca7c1e22c5bac30ef

    SHA1

    1c9122c790fa08fefa539752c52988c749a1b13c

    SHA256

    2e2757f3548cae4821e684c4902138250f57408c720e345d5dd8c3908d4ff1f5

    SHA512

    58ea73d9dd567e7c0e164d15adb322a87628e9177afed78455b521ad502ecd014ae2db8704c287128674037e8430eb583f9128a70c672b5cb836b5c614b4cbbd

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    ef2a7367970b9163bb758255e596d5e1

    SHA1

    2b492bf8f235113fcfbcf523e5630a78e1979fd1

    SHA256

    c94e256a787a2495ef9b03b42948c488bb8209ee0c613f6385cb271f2f7949de

    SHA512

    3a03542de917f2ec2831d7e13243cb139cc6af06deae7bf11cae6af8b42a05bae41cfe07273656580a2e2c3d05f851c45bfcbe63217aa3db7892cc23e6859aed

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    1700ee9dfc0e425f68cda90208e7a55f

    SHA1

    a31c78efa404a3c92f21601fca6ca6759d987c5d

    SHA256

    3713436f540b048469866a6de4449c7c06b89e38f4d174468bc5b92841ba0455

    SHA512

    b288d92895aa65ee2adf72f4de78adf16627d4725556f52c9c08584c7406dc10cc2d230548c38065510ee46b091ac6964e643d9889e1e7652d28863796789d51

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    351KB

    MD5

    d8c045bc47b82c3299d5b631a9cc8610

    SHA1

    6057a249b8d29a970e076a7e0872603746f2ee97

    SHA256

    af3af92ee1257a76728994951f3d302712b3a91139f238a8bb64d7e35eaeeebb

    SHA512

    a41219ca06bb8af02f20aadfc0620aa7137baaa600eefd88d36c739ab463584b9203f192a29b5a5dad08e95d7ae49d45fdfeacfc3fbb13867baf8be3323a9556

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    351KB

    MD5

    b1039c053115c94a76902144862c5c5f

    SHA1

    65ae6b1af14b5b4d6c150e8aeeddc60758ddb746

    SHA256

    93a0c56e5d40dd0fe2d3e38406cf2f8ea4e206f865aeb29f58d0b3aec1cc6962

    SHA512

    61ef079bf21b1befde8b53ff94b86104538e2ac6c1eaa94409b2268d1d6f2d4bcf7095f232b8c34a57da80c1c3a17fddcee1b8587c2a969ffaa17d4b5dd9b887

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    351KB

    MD5

    819a23bb637d516d565603cf8de7aa8f

    SHA1

    18e828a4fc6e3a205ce4127ffd361f7e516276be

    SHA256

    2a80f83a3054b43358640a02dd1293de31345eb660f220343aab43567ca66e94

    SHA512

    7aae4aca0fead0f5bf776bf6a208f154d429992fb072c5d8dbc7e2164bcc64b935ac90fe51e3ed92cd8db20d8a91ce81e7f40a5577940a87264b56c37be3bb7e

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    351KB

    MD5

    6485705887cfa17039b12241ec723841

    SHA1

    7ff8cf690c95a6edec64f96c9258166be2dde9b4

    SHA256

    41e60c7e5b16d67485286b0af39abf68fa54b9f2a2bcd46f5c3f4c44ecf5e33b

    SHA512

    23b8efa3bda137cb55e52685c841048ebe05fe8a7f2bd8c92ca95191ecac491aa5ce93fb36a137e70201b7e9604ef483b0ba92531d21437e624e905aef212e2e

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    82242ce1681e7b24a410a6192657bd9c

    SHA1

    88d57dce45502d8c7b172257747cf0daf0be19cf

    SHA256

    51f0002a6ba15e209d9ee9829f79545c42365613a0bf7c4793e6126ea9ba322b

    SHA512

    9054e6efe48456eaa75f6a57595f64f7dd313691e8a16a1615a30bd64cd3adb7c92b815086332d373b89335db43ae7b17f03e29348d00e2490ca869e16abf601

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    bbe1ddea447879dbb2dfe32f84896b18

    SHA1

    01350498800eca3ca50247987fd9c58816254ad6

    SHA256

    0ebb5d04cfbf009f979d3f5cc146cd611cc6adc7b1c9beca4084397ea96cc765

    SHA512

    21af4f6d3c843208a7da01e256ea77f98b2c6bea8ddd0d3118d1c4859bb0927fa56fa93173477a4cf65c0fc3e971ff9e5736876ad4578a31c5c905bb34f71c99

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    d7f9249cdffb7788b86a3d451ac5d6a2

    SHA1

    48d48069354e8b3137f0dd53398a6dc1b244226c

    SHA256

    ee759c9963fd12088e0875e987846fca18818943cb0cbd66570e70f7f61f1488

    SHA512

    75ca1177d5cff681bb0c0ded6214aa5ddde996837a844f16f305ae876aff8ac1357b21e7e827bcd8d8c47f8733838be84da9f8bf82578d96f5b3aa32452e824f

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    9bc5dc1cfcbcb1c2c02e9b095b60bd8d

    SHA1

    f02dd1ce5f4ce46b3204db8d638990df5ad2b420

    SHA256

    a516fc3450c1940ebfbc421b1f9f1276e73fd480cd76fbfef1852c8fe782ad78

    SHA512

    1ff35741df1aa3b8147abb9401be432bc0d74af1852dbd0f3658bb4f074ebedbe10da47f37f5f58e08c56260251df9fff79d2f2029b953a757376d697da3593e

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    351KB

    MD5

    307237e6aa7c78c29f2bfac45ce3d7f7

    SHA1

    c173014b1d922dd4ed978c158641db9fb2f3a4ee

    SHA256

    9f3b6c4b8696aaa01c6041fd6ddf7ceb367665581ab1f1141fc3a8b9bdfee982

    SHA512

    8f24f0dad85c388b6a6f14b36f49917c48fe3a932ce2eb3c8122eaba62aa5b153626e633f8691de5cf9ec3923ae67dc382866200b0a4398803ca0f59e207ce26

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    351KB

    MD5

    e8f2e8d0ddd4419b9f75fd8cb108a846

    SHA1

    bf4ea5079fea15123b98802ad91942403b3b5cf1

    SHA256

    402eb0e78cf361c64030de26f2d0d365e8c3a17f3f9f73e7d8cab4feb28b4531

    SHA512

    d6ab52abf746232db93c5810535bd2443d3fcf82ccadb500a14a699e12cbd8aedc1c7d5335371194ec84d2828166457392683233a0ed9706e76a0e4ed9cbe48a

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    351KB

    MD5

    15bbfbd38f004b82f409a2864ca75905

    SHA1

    243eac8757dd123f6faddfbf1379a9c87ab1f6d0

    SHA256

    f6f600f87138fa2f42bfa7b7600f0bfdd14e3f61b80cbb025f04af211010c128

    SHA512

    0379e295a537775108f1db47e996a946918e70db9f056cb4485553397ae6348e96da7fdb03e5b7fac59477ddde0e1a487dc3a24871e58d8deca320a96f389eb5

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    351KB

    MD5

    17bf077feeac57c7c7594a4c7a3670e7

    SHA1

    b6eeb4be0a9e5178fa496bb3707f96b77e3618eb

    SHA256

    b57fac40e2282177754cfa95c24b71bc20c10652b3b3c295275173d69ff69194

    SHA512

    53da1ba657bf38fbf66ead06451ad007715c09782444a4fd470c287c2f2eaa002ef14f298d09fbf47278522718b85aa07b6d85fa4c6562dc6bff2246ee5ed4b7

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    351KB

    MD5

    39c8fdd076c85e47c28462adf90e5e5c

    SHA1

    ed413a3daa25cd0f92860d016e8af5a744db24c6

    SHA256

    098e754d7670c0e2f6db3fcb7b6f9bf33e294054af4ff7e50df6f39aeef48dbc

    SHA512

    47e704dc3fe75257f1da27d857d9d10087dadad067ce6a9bc0ffdfd1d5223763629784842bfbcc75e0f11062529779943d9362e1628125a2bb03389bfdeef4ad

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    351KB

    MD5

    6d8244262effa2fd51764b5af84fb390

    SHA1

    10aa8b09646b03029e091cb6a2f7555a2ff7346a

    SHA256

    85f9d0c78e6720506c6eaf839071603763e56a75e5ded86233b3d644fa846262

    SHA512

    5153bfa2900ae080e4682abb77bdd6337ecb4635c9ea37be8609afdb4f85939ee3686679df527c76b56da12fecdd4dec8ef756b8787f1338a4123653a291c7f8

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    351KB

    MD5

    2e2f60c8b6ac2c9badc9c6f4830e75fe

    SHA1

    34e4ea65ddac9db678d072f28913ff89e28ca2c4

    SHA256

    558a3bb2f28c8a872abef93142ce97c72081fac60249bdb8df4ff75cef85c45e

    SHA512

    32752e1f4846560c60bf520827daca1b5fce1d5b4dc246e6e11f84660fa2e6acfb5cf9aa4248c3426a98cc8e4926fad9b920247b0c7ff08561430da48d722f34

    Download Submit

  • C:\tiwi.exe
    Filesize

    351KB

    MD5

    443a126fcf8fa02ae37f0aa4ad5fddd8

    SHA1

    7749cfc93cee21f36ba976bbe2d24cc537abbc04

    SHA256

    d003df62606b094be669bc1818778c33a0adfd959fb2bf1ac0065d5adb878174

    SHA512

    86cfc51b4b47a15dd62a84483a31cf1bbbe6bfab6f63963b886454db2b336e1d1d0da038a3d81e397bb419a97f16d1f62755c2fc2448d3b4f5a2018959f05309

    Download Submit

  • C:\tiwi.exe
    Filesize

    351KB

    MD5

    d83cd789405e11db29c31a17408d9496

    SHA1

    10bbfc1ee37fe1e904f2abff57dcc8fa039d0a86

    SHA256

    49987ba1dd82011f3759210c012d32643e125039684780821eb6f83c0a8c4531

    SHA512

    70f4b890a17e33cf4c66a5c1dac2d21b1db5e6402c69ae533e5cf401a3264ca5a7e40b29d4b9f180129d63196aaa52107642cc12e969c7e89b8cdc7ee3524c8f

    Download Submit

  • C:\tiwi.exe
    Filesize

    351KB

    MD5

    6171d16714ff6d97f76860f3aa0b546c

    SHA1

    328882f40c0af1b5a9a3eacf8c05b85e313eaa3f

    SHA256

    2f4d10de7d5d0673f0b06ea794b553621ae5845898f62e3e9a1acd2132155098

    SHA512

    6e174ba5acdf8c88b37505429c6b82c3f4a68aa2952d8cc86da3df26d27b75a1c27961b0625a966a0c99d924f8908b9240085bb69aaff2a548ece8cfa8ad335a

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\imoet.exe
    Filesize

    351KB

    MD5

    9c6dd053ec1ad7f39f76b91bcab4168e

    SHA1

    4d0ee19b8546e69944b757fa89b1a5380d400f3a

    SHA256

    4a3191e59dde3e9ea4e0161506a0d4bd10ea003b22dfb6359ae83214c7783961

    SHA512

    ce5c144ea4c7a753d155b1ef3fd3221790ff4934da103d6503604677cc8847576a718514def8ac92871a69dd0be41758a5c16b944ef4a4713b734b4e05a4dc6e

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    351KB

    MD5

    afd0be4e5d74320d5a5d2661a9572e9e

    SHA1

    770dbca55a820e01d289434d014fb2501ce60cdb

    SHA256

    3c442179e9fa4e4fffaaf2a0d6ee0e81acbde11c466d5549f4d5be34ce000bba

    SHA512

    7405d57e7bc1dcffd43c950b7bcaa96332c421b2da46c2888d6cb534d8938688c306ec8c71bf6525d31fee8f19ca0a4748a3dc1b28a802b1f248543aebedff5f

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    351KB

    MD5

    a9768aad89b26020004a0e5846466675

    SHA1

    c4b6c456719ad1379d0f5c263747edb9e5631d5b

    SHA256

    d54b04e1c24fd113cb75c1799950cab1dfbe0bac22ef00ef4908be21abde4a16

    SHA512

    5fcb2cfa7da3825ad04e674bb77550c533e393d260c318c9954e2ce05632ea90463be8ccf1037b09c904e9272e0ccfc4d765130c42a5d2d30491e317572b3cff

    Download Submit

  • memory/1044-188-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1044-99-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1160-228-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1160-307-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1160-306-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1320-357-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1660-137-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1660-461-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1700-451-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1860-301-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1860-305-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1860-186-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1908-125-0x00000000036F0000-0x0000000003CEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1908-124-0x00000000036F0000-0x0000000003CEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1908-110-0x00000000036F0000-0x0000000003CEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1908-100-0x00000000036F0000-0x0000000003CEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1908-98-0x00000000036F0000-0x0000000003CEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1908-226-0x00000000036F0000-0x0000000003CEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1908-111-0x00000000036F0000-0x0000000003CEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1908-374-0x00000000036F0000-0x0000000003CEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1908-187-0x00000000036F0000-0x0000000003CEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1908-185-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1908-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1908-138-0x00000000036F0000-0x0000000003CEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1908-441-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1908-136-0x00000000036F0000-0x0000000003CEF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1960-346-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2300-460-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2300-126-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2612-386-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2756-358-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2756-360-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2756-359-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2844-368-0x0000000000230000-0x0000000000240000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2844-366-0x0000000000230000-0x0000000000240000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2856-112-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2856-373-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download