Overview

overview

10

Static

static

3

68b70126a5...15.exe

windows7-x64

10

68b70126a5...15.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    20-11-2024 23:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    68b70126a560480e9ade07db36665d6f5eb7a74bcd879966761ceb129feac115.exe

  • Size

    64KB

  • MD5

    0a26145319b1c70a1f3f8486ee5ff19a

  • SHA1

    5cecccfadb7a75532be052da9393ef95238d8220

  • SHA256

    68b70126a560480e9ade07db36665d6f5eb7a74bcd879966761ceb129feac115

  • SHA512

    e8b43e143d38f49472531d56fbe509b871232a644780396f646bf0331625e12f8eb08d728e66e136c948ee7ffe423b4412e400f4c009bc26ad1ea02119deb931

  • SSDEEP

    768:VNuG777/+V36n9PcXYvn8KR1I3NznRAQZlh4VkpX179r+R5UuOwekflNuG777/+M:V8w2VS9Eovn8KRgWmhZpX1QQwJ8w2VS

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\68b70126a560480e9ade07db36665d6f5eb7a74bcd879966761ceb129feac115.exe
    "C:\Users\Admin\AppData\Local\Temp\68b70126a560480e9ade07db36665d6f5eb7a74bcd879966761ceb129feac115.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2116
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2856
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1780
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1424
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:768
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2236
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1236
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2932
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1492
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2136
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:1232
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2804
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2524
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:944
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2984
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2580
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:1628
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2976
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2272
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3028
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2740
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2460
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1988
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2400
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1656
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:760
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2828
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1056
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1532
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1764
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1612
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3012
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2540
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2344
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1324
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    e72050c7939b90c17fca89aaae2cc1b0

    SHA1

    e1843205f9453f5c7ebaa8d2f54fd9bd2b9647a0

    SHA256

    2eefce0e2f4ee7548339f738a97d433f54241a557d9d7550805c47aa63994d6d

    SHA512

    5fcdb2ec205ff0609654c4abb8170264c7c4b94d333c5009f439a741b9af03650f6b8861eef00948b2cb96998af6d3ae4c542864027301183a77ccc9074c2add

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    64KB

    MD5

    833d2b7557bacfdf6a5a1a6891f58281

    SHA1

    348571ba2ee3c11a5e5ce4469e3ad301f791a356

    SHA256

    24dc1980ad2001b513fb288c12e230ddedd371ea6d780892778aa39f4677d759

    SHA512

    1f797d8f21acf4cd3bb9b36cd0bd1848dec84a74eba160c215018449ab7ccf7006b13f81b1b7305cb08834478ec2600cbe1d712f28b34bf6d78484b7989bae09

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    64KB

    MD5

    79b15856094c3dd257d9fb86377b8d5e

    SHA1

    993a74f2cee73feae22d9df237f2333810698346

    SHA256

    9e03e41fd8fa90372fe97e4ce3a79cc6cf34719ff9b8ab03cfe54643f5212723

    SHA512

    1ff1f0ab1c55313d4dbc746c23ae50cb31e5eabaf409eda5fcf48b30071a429bb5672e1f0f6ebe37fff61a11ea4756d6772208f660e79270eb0bc5b16a4180dd

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    64KB

    MD5

    3d16cd919cd14703e6a7d671dfd0a529

    SHA1

    cc68f024702fa8c185f8ef635ff6efcbb21b9de7

    SHA256

    2e2e735bb26e3deff7f76da0e96859204eafea19d8ab51c80ce70f67c54376cb

    SHA512

    510b52bff1176ed69895ec0a4472b2937bd7e939bf5538125ea3e2f0acc9e47f0bd8826963897b57df2d08d54217997a01dc4c2d1409e903848c3fcce75a20f4

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    64KB

    MD5

    ce07e148d1030fe7f9a9e3fc66bdad49

    SHA1

    4065357fca4be92c6e1a9d750a98cbfb40f322c2

    SHA256

    0e0ad8f03e81485272c32ab65b71cb03c5937892134b9f13144787afa6475531

    SHA512

    c21e235c7766eb1b7a2a8a853ac3bc4d252224e11db3b3daad58cbe083a35f1a9ce9fd5df67c83a60a92ed0199905a7489995e54eaec346f71b039091528a369

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    64KB

    MD5

    c36f0dcda682f1cc77818eb38dedb35c

    SHA1

    8bd52d7a5835ba32fcf95f60e29bc3d5c1cfc253

    SHA256

    ee667b254f6cd975e0a4aa8142b816ff34f2c961be3edbefdd74f8bda13897af

    SHA512

    ec8de8ba39e7c503942b39fd839695c5dee47b2fd1324d253e1c2ceddf8a9cc679fe5f17752d9a9e7492c9554c0c8fbf519e7d2c01c88c550f79c05dfe2028a7

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    64KB

    MD5

    be1836817ef4fc9bf1c776409c13e107

    SHA1

    91d9f5c89c380465a47b5765471985a56def9cd2

    SHA256

    129c43c9a16c2f346224c2fcd9f645df2dd7d615d8b1537f8c0d0967cb155011

    SHA512

    6f272746384f257cb17387da33a0f3a97ddeb28b81e5a233e8982e25ff0e2e0e1798bfefd647e72f4bff02839954b906ddc715d33821a3e0e37d83fa3a886890

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    faab813b00b24a6f4d24595b8cbb6a87

    SHA1

    72f81766dde915856d092a27d33cbfaa59b7dc1c

    SHA256

    8ca1f46732955f833dac5f73917c2fc0bc729d0e81ff5d44f3c4e20b582d4df5

    SHA512

    15a94343059d8bd6d6c7c5e41dd0c2cd564019d2a0d85d315cef5e00d25bfa1284f7ea3560023c49a87d905c5b1b366fca1f678e88913f6a4f97a116660cacfd

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    96d14d3ca13609a0c13f7e898d9b7798

    SHA1

    001acf097a0da766fdbdd3e7e31de4458a5f1ed5

    SHA256

    755c261bd8e7bd49f88e99f167b20ea6c9c0b9f51d9effe5cd011746f9463d3c

    SHA512

    e07cf4b7d22de3852106cf634bf375c9d64dfc9b66e2c96cd722cb862bcecaa3ecbf8b02259203c32b096ca5051065f63cfc9f6098c03ceca536b5dfe2c245cf

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    bf846c0dc28a8adba4d0de8d74471725

    SHA1

    d718a170f5c686edbb10de51a3d42bf4f4658e0b

    SHA256

    bbadb07488fc8377c8784ef3fb2dfdd3db1c92832a455e1826dc3f86b855cd90

    SHA512

    b8c60e3850baf49aff0bc93a8b7bd08518c19a732710de6cce2a21bbeb68fa0d430b6ecf825725d166eb2626be48c15700883659cc8f746547494e6213301101

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    64KB

    MD5

    213a89a81164d50c86bcf1e5763c941b

    SHA1

    149784a14363ba4ac2bbd047c83fb34ce702b115

    SHA256

    70224cd6bce9ab7dadd71c20a3074836f1b23b2fddb782b69962222ccf1620a7

    SHA512

    69cf519e53354680c29c6795a2ec2786f039a7bec32dd85c4a3724101f68617d2a92877c7d10ae4fdb2eb43485272e0f526323d623a68701b7a73c317042cfb2

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    64KB

    MD5

    743924f4f7eee068faf2c4a9656372fc

    SHA1

    1dd2adfe1f8de740db50c2d235568bf0c585ec42

    SHA256

    a48c635245e99c15749f017abb96dc83815e31f378a8556c6e7d66e4a5a16187

    SHA512

    97736c3e2e36df5a8186a97649d412a96c5c9b5e365b6f813a8117ff18d1ad5313c16a31ad69908f283992990c38ace8f45f3b1372496527448069f2328afa78

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    64KB

    MD5

    667f92e08c7025fda0b96ff73db9ccd6

    SHA1

    4fb07e1270f7edcb763de970a6d74d38667bc288

    SHA256

    8eae3b3f183381e58f4d83caf8221b33a162c98cc8f6ddd6ab5d79c5634e012c

    SHA512

    9c32063e62be2ce9717f18552a3eb10530a7b4986c03c8e490acfc96262a6af00891049770a7ddc3d4614bf6cefbbda3cc2602d2c0dea3a18f56ec4e961056df

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    64KB

    MD5

    f9800c348a4e6ea982ed9928190bc5f5

    SHA1

    8d04ef30514c5b6311a3038da01c46155995fc78

    SHA256

    c0bd9323593afdd6db1e4ddf8496a2a01b180092a5db47f43fe997099a09af9e

    SHA512

    68c6de03f92ca548fa0021d71f2f19e5c5ab0d1a7a79245cb36b9310a04b41fc5cd2c6bbd5f2021faf9eeebaa00ca3c85e7491777d66c61d4836982cb20c2edd

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    64KB

    MD5

    4c2fb2a12f90c03b46849ce57426726f

    SHA1

    12ed9b2987e3820ed02ab33ac9d32179ff89d4e9

    SHA256

    93d2d24160e47e6dc7c0be5fefe0d5ac6d734080db35469d0e8cc195d868eb95

    SHA512

    a3813a0e9792c198818d955d839508aac19ea5381d89f91a8b1128285bce6bc9085bc65146b2ce44c50df7754640028d539864b868a9dfd9f7947ff38661b5ec

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\IExplorer.exe
    Filesize

    64KB

    MD5

    8aee88d0d43dacc76a364c23b52d6523

    SHA1

    64f57b55791b5789bdda8857367a543f27c89630

    SHA256

    08f927a8627d0c714e3d429576f2ac52f4f2a6bdf55becc02f1d0a8e2f2df0f8

    SHA512

    bef3fbbabd9c1f672b3382efa7c8b0d6c777a2a88d6dbbc158047007499d766fdc0b7ba6bb3c0932b28b6e232023addc0c984fbb20b24ae4e9201fd082fd56ec

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    64KB

    MD5

    1cdec00a4c64191f0dbe1a3495b6c1c5

    SHA1

    48b9635d96dcd6df8e3ecceaaa132aed5e657e61

    SHA256

    1872ecaee96b2d6214c05e1f6bd11fe2f41dcfc0153074438161a840b9c16f44

    SHA512

    5e751dc1261e5f4b9b830bbddab7ba1e5311b9584100aa1f3ad7a8b25eee50d5522fc512f87dc9bb4603dd7d10ad3bfac26d3b8d3f1d3e70a44e8d965646114c

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    64KB

    MD5

    86fa6e815e641bbf6769a7992e0073a9

    SHA1

    aafcbac1c35156604f6dc20a5ec816e6ce6a220e

    SHA256

    0ef471e11ab143333eca98e837b2b48a17d981ba8b84c4a7a5ea583bf98cddc4

    SHA512

    3b23957d0ad14ab5bbc2b0226db0e956d9c11da9548a23e4205349a3c8e454f5ef06b83382b381aee36fe3f4e3cc549469d0b888daa587bae704f3936f022d48

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    64KB

    MD5

    d7ee2ee20e48cac56463680611ebe4f5

    SHA1

    f06a06375010b149e9a934010ff8655bf0763897

    SHA256

    17cb354b9d1228426a78c469de6f30fd0f6c9321dcf903271959c58ab89527d0

    SHA512

    19dafc8a3993cb6d26da57b04fcc4f1ff6223630b5e5f47c92fcab4f4666d4ae47fe1bf2bf4b7f0b07a30ad9236c57640ac89a16a03dfa484bebc02aab8e89bd

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    64KB

    MD5

    0a26145319b1c70a1f3f8486ee5ff19a

    SHA1

    5cecccfadb7a75532be052da9393ef95238d8220

    SHA256

    68b70126a560480e9ade07db36665d6f5eb7a74bcd879966761ceb129feac115

    SHA512

    e8b43e143d38f49472531d56fbe509b871232a644780396f646bf0331625e12f8eb08d728e66e136c948ee7ffe423b4412e400f4c009bc26ad1ea02119deb931

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    64KB

    MD5

    ff1c4379a358409bfbb9f949b258339a

    SHA1

    90ac71832ec022b1020956b2526b06642a4a9d8b

    SHA256

    2486f8989d64b5ac86951a9c6b9d38a20309cf6314177d7deae29c20e2ecd01e

    SHA512

    b2485699c626226bfdc1f8155a80df7a2f0965dda56397fed40b6ebd7b523b76303c4e9d67abff4e7a947273e68823da268f8fec1fe3596d1868841a2364c3e5

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    64KB

    MD5

    8c20c35306f1194735796994cb2e9f53

    SHA1

    2b524ca9a092c89f6bef5ac2fc05d13643650556

    SHA256

    f185add86e8cbdff5276e3274ef0a761b5f6b7866eda665b75a53dc3b027502d

    SHA512

    c0466e1d19b165d7ef3bd4c88ad98604d0194ab9da29b471e99c446a2b1d6d7d2bfe0dc5961dc7f3c5c2e4f7f4cf7d5298c47f82eaba512ae75fc5fd09e43363

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    64KB

    MD5

    8774db2e3e3e3166fb9ce7ed5b03ac11

    SHA1

    4a4c1a90ac2bce51538a45e3ce79b8b8a6543974

    SHA256

    aa28727ede0b02e90f05526c6904d2c4bfef8be8451bac84d6fd00f8d7abd4bd

    SHA512

    0ece48c686122ed26e50efdbbc87970930dd94c2e683e971534873f7e6c13da521b3c97a708210bdad7ee6200587f0260a80ea9e245b7fd7176c126d8d933361

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    64KB

    MD5

    c0abb92a1f81acfdde050467f6f379fd

    SHA1

    0c121df13193ed09315cbc336e72434ded7f5e04

    SHA256

    a84a22ee25270ce9b2ed9526d1d6c854583c3f7e9d4c4ebe7dfc31af30d5079b

    SHA512

    f3d5d8737afb91453b8d9465eb7c2672dc1794937197fbb5b967e88931b267f9f4347884b8c01f6759a8a010d0cd4bb68c4687084ab147fa7f2ebd05d09a30af

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    64KB

    MD5

    98ad27556a8c49c3c25b3a00c29814e4

    SHA1

    55cb76ac77cd1ba09e09e011482a3c9fb831d093

    SHA256

    0ba9678d9e9c0c36d08b03a8424cd483f4da7dc60a9eca3d2b538a2b96292b61

    SHA512

    f7a1bf08755d2e9bb51fda0fb5b08bc5ee03f2a074e96f74d5997b88d904f0ab798cf6d46e3ff5c62426356d32a292e262265088a4db287a64b04ddb5562d991

    Download Submit

  • C:\tiwi.exe
    Filesize

    64KB

    MD5

    eec69645b5cd0d694dcc5c4fde1b0ff0

    SHA1

    4999049a8b81ccbdfca565cefbaa90cba9b8a4a4

    SHA256

    80f93819fa58e979e93842700c2e5ac69fd3fae8fe524c2a09a340d2fd4b2a3f

    SHA512

    b66fc49d269188df4111d797bcdb507f4630c85d8e7edeb6eadebfa85b79b0bc619fd9aa9c050a42b0e18961dbc7870730273065de1b43b1555caa7a9702b2da

    Download Submit

  • C:\tiwi.exe
    Filesize

    64KB

    MD5

    8c94f525ed6bb2b56ee0d9bb3e707146

    SHA1

    2c7ef38f327e4ecd1aea7f5f45628cb0fb68184c

    SHA256

    4ded0941c929d6c9ef62acaa8f4fe368b2057ac9698f29a700bda91cb5ac06f7

    SHA512

    b4d961c319c88e09580f2c2dfce1463a803431b3c8bfc8ea505248ba12b6452ebb677e0638539098f1db770ad2cb79ae90410d3d9156f5ac13e660da478cd29c

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • memory/944-413-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1424-237-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1424-218-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1492-416-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1532-277-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1532-276-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1532-209-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1780-210-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1780-214-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1780-211-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1780-216-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1780-162-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1988-111-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1988-408-0x0000000003370000-0x000000000396F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1988-271-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1988-273-0x0000000003370000-0x000000000396F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2116-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2116-217-0x0000000003460000-0x0000000003A5F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2116-437-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2116-252-0x0000000003460000-0x0000000003A5F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2116-110-0x0000000003460000-0x0000000003A5F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2116-112-0x0000000003460000-0x0000000003A5F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2116-100-0x0000000003460000-0x0000000003A5F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2116-208-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2116-206-0x0000000003560000-0x0000000003B5F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2116-98-0x0000000003460000-0x0000000003A5F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2116-330-0x0000000003560000-0x0000000003B5F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2136-425-0x0000000000260000-0x0000000000270000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2136-426-0x0000000000260000-0x0000000000270000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2236-333-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2400-282-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2804-396-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2804-398-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2856-220-0x00000000032E0000-0x00000000038DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2856-393-0x00000000032E0000-0x00000000038DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2856-219-0x00000000032E0000-0x00000000038DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2856-347-0x00000000032E0000-0x00000000038DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2856-254-0x00000000032E0000-0x00000000038DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2856-99-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2856-253-0x00000000032E0000-0x00000000038DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2856-221-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2976-401-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3012-394-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download