Overview

overview

10

Static

static

3

2107965df8...cb.exe

windows7-x64

10

2107965df8...cb.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-11-2024 17:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2107965df8e61c464e03372f396feba24a244901977d894354ab691805ba68cb.exe

  • Size

    64KB

  • MD5

    585375badbe2d8858ea991798ad13da1

  • SHA1

    f59369a3759c276a753fac9b76ac1bffbbf6ba0e

  • SHA256

    2107965df8e61c464e03372f396feba24a244901977d894354ab691805ba68cb

  • SHA512

    321f22db96dc047ebd204c4a91ab3d845c48d57a77f18564a3ddc087ac5694d10d07f7218e199ad1c4eaa859931f80d940ffa3cedad4740b2def500a6fa5dd89

  • SSDEEP

    768:VNuG777/+V36n9PcXYvn8KR1I3NznRAQZlh4VkpX179r+R52OwekflNuG777/+VW:V8w2VS9Eovn8KRgWmhZpX1QfwJ8w2VW

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2107965df8e61c464e03372f396feba24a244901977d894354ab691805ba68cb.exe
    "C:\Users\Admin\AppData\Local\Temp\2107965df8e61c464e03372f396feba24a244901977d894354ab691805ba68cb.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2424
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2872
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:348
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2596
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:496
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2372
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2752
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2524
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:944
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2244
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1960
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2916
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2852
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2940
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1188
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:468
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1372
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2708
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:848
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:880
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1612
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2304
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2820
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2988
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1372
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2068
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1108
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2420
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2412
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1640
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1496
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1152
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2016
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3032
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2536
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    36536f067f0fa9ed63f6fe9d4e9ca836

    SHA1

    3f48e1af31b2369c87462af1be364c3ccbbe5602

    SHA256

    750c70d9bbbc4698d6cc4c0c347e31bc78afafc399ade0a8dfde417c96805c3d

    SHA512

    07fa03f84bf7851074b34a8f5b0895bb59754a73a7812ab691042636faff1a6f414f6a729cb27386c0e20c620a14195d4f015706dc81e18bc0ccaf48663f73ec

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    64KB

    MD5

    784cbf8aa670e1500d44ae7b1adb8423

    SHA1

    05a535cc5a3980d4a9dfcdb1bcdcc8b386738a27

    SHA256

    3b17475eb264152a41051952084cf1761dbcd8397e57895343d1f001ac5329ae

    SHA512

    19a12e58b25d0f61648bdd0379d6b4c4fadbbd02fe4d8c602b95d885f948cb4f6b65ebfe67c4ff7f52253bc2120fc688b676aab49af391579bccc4c0732bea1d

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    64KB

    MD5

    96cca098e6b3d94a31356980682b1779

    SHA1

    2186a76db6d8438de8d75401e49f32a910dd55ea

    SHA256

    1d8391884e8532b4fc8732fd39d9b40901e710f5ae0416cf38b5993f5a0d4375

    SHA512

    958824057bf6a9bda518954f8b8721fb42aa1896aa37ccca5cba4b73f040cf73040325089f72b250ea51b1fea02b66689347b6447c0a4f91e23ad8b3dce183d8

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    64KB

    MD5

    7617e067bb3eda8b716471c3f4c070ba

    SHA1

    e1f9033c48eabdd4f98fc27e68dd47cca8f1e45e

    SHA256

    4609cb6c2c1b93ddd32db60e4ea54125ffc6dc12eb538e68a354f9c871982b70

    SHA512

    a8bd0a41cf93f2595850f6e0650c6c744b71a6f0c4b9f64f34d6ded2b8c968a8e21ec54474545555c91e6d27af218f37a9c6e5f1a84c4ad1de2d53a527268a42

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    64KB

    MD5

    07c8f15cfc6f5e32cb496b3221457587

    SHA1

    48ab34b102cd05a017cdf1a2650bc302b73b5de1

    SHA256

    dcbfdfd409205d21eb13a5f77f4508a83206c502386f5b5572e7acf5e429726a

    SHA512

    6879f2caec2af789e3b5ed6c75b36ba39a051c47f7025749b7dc2faeb5d399355201a51d0eb76932d8e60c47e72622ffe9ed4d795eaf8e60b811ee5326bc798a

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    64KB

    MD5

    20e1e7ae90efdbf76205d6aa3ba03fef

    SHA1

    7085de2ae57b1176c72c2970e3edab63f5e8d4bb

    SHA256

    606633e8f035138ee6693d76774b8d9544efa33b50c19a5670fceee9212f3575

    SHA512

    e1a62c14aae12f68448bb5708735ddc749b3a55dd27021b3dea7f5e0491b735ec6b35c96354a542cd67e3e2524ae569faa1c6db6f1c2c98928754c046d7b15fd

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    ddd9ac77fbad9842622b12ab81d339e5

    SHA1

    307c1fb76ad57ad5c82d5a13c5d6340433648ce4

    SHA256

    40e2628d9c955b22343d18cbd3ba748f8b46a1fe43cc822f9fed785f12b445d6

    SHA512

    5b7d7af851a9ca96dd15b7c9fbe019afa094f680e3863e9cba8baba2aed741d58e794a2ffd52db6c2b459fe04d9e6c8671cf525849b5eb5f6c9a9516cba8cc7d

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    fd4d9b856ae34a25db0d26e317405401

    SHA1

    d7010e9af374b944e845cf9e939f0efb5419f2f1

    SHA256

    ba58dbafa6f320c0c26de808f7f0c9819d0598b48cd3542020f4bd87af431422

    SHA512

    ebc83d1fcedd537a57be4e76c90b0194cfd79ea3d4662594b219c9961773a56e956c870f9447f925a4081745a5d5382f35e611dddea683058ab568d08d9c7618

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    425278848d5e5273e16f2d2be5a3f9c2

    SHA1

    fb14bb17f2cf127c7324f048ceacf9378d9af49a

    SHA256

    da70b57153d8a673f6f011d35e2d4b9115eb9160d1edf706d28e6cba8354ba43

    SHA512

    77d764546c210f222ef0ba450730e5cb8b0123440647a9a68c2c5dd41d678dc5f2dbe8e057233821a7f8bbd0e212371a1590a34263f391e102ffdfa2dc4492a7

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    64KB

    MD5

    347de7fa54d44a483c228ecbed9565c3

    SHA1

    f9f515749d52f64af05ff586a22a52639c276c2f

    SHA256

    30b25291c7c31f902de3e15958b4527abfd66b03196ad0d0f4a525a54721de5e

    SHA512

    475d488ed12109ba952f84e6d03143640dcebf94b8969cc7a80233f2379670b7b666227bebf2fcf541fb25914bb8995839bced0a910ffc6c8bed1235e1b6d118

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    64KB

    MD5

    c67b055d3869427bf0c25b239a1a7abd

    SHA1

    4a190c2620098d447583ca9eaed891bed4f5e969

    SHA256

    89356d0050beb0c46b5e8e0e3b28b8dc4adb2c97ccde621a0e7a8a5aabf58ef8

    SHA512

    f6fa210fafd62aad7102ca3c091ea2dd28a8eab730d80cdd8d40851d493170ed021a94d3ff7aa9d20f66099903d9e51984b9d0e191bc727d20bebd5bcb546841

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    64KB

    MD5

    ddd73309cb96fc5c25405dcd3ae3c4a3

    SHA1

    348dd4690dc09639f0070d4af8f84a109d802ec1

    SHA256

    b1d00a23e6afe8a201a4285337ec2c69345ee7e4f363f478a8403191bdd11b14

    SHA512

    7c4f74d20a846b9a26974dab7752d38ec818eec7f4647ff2dd4fa0a0081c79ba226148e2b7e4563b6fd88ae5c92fc0cff5984db568207d22c9a6912c5170bd0f

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    64KB

    MD5

    70f4fc2bf6301c4c348cfc565dd75229

    SHA1

    d70a158bce42f1fb198d2232a5cf38c9a7533dd9

    SHA256

    234756e8568fa128f400a21cac5eaa11859d8bf851d2f5fd478bb56619be550f

    SHA512

    a11d4db4645ec5feec23479bf38020850f7fb88a5d6feec948fae73737284c80c146e9a393a58fe40cdfd380ebb2151c00a40c78810b3afe5f3837af7345f283

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    64KB

    MD5

    eed232d1511803a39c8dd3b1b3282d2c

    SHA1

    423df265077eb5caa283f5e3abebf96763491107

    SHA256

    83f9e9dc59ca193c4444b411f421f728ac3dd6ca165a8a2dfcc5e7b495728ea6

    SHA512

    8de81af3213055d991bb2db74af6964cf6b0758a020b02a0b1a8ce7e01e24319047cc750ff92bbb7056687b9f0b998bd77fb17a614a5aa84c69938d607f0bccf

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    64KB

    MD5

    585375badbe2d8858ea991798ad13da1

    SHA1

    f59369a3759c276a753fac9b76ac1bffbbf6ba0e

    SHA256

    2107965df8e61c464e03372f396feba24a244901977d894354ab691805ba68cb

    SHA512

    321f22db96dc047ebd204c4a91ab3d845c48d57a77f18564a3ddc087ac5694d10d07f7218e199ad1c4eaa859931f80d940ffa3cedad4740b2def500a6fa5dd89

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    64KB

    MD5

    c0ace0d3d8e60b2a173928b8d7004a56

    SHA1

    bacc35b6098fdfd8fe98988871d5bbc95edc91a8

    SHA256

    50acbd100a9795003a5d8f6fa8f287e87db4406079e7f14c413d851165b5f37a

    SHA512

    d81b2adaa5b469f17cb45bf187079c1ca760b0d3e16c52218cfdca2b6d1d14919c67a59dc183c5237fdf2208a51e24dea5b9290235f4f941e7fc061a423ae19d

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    64KB

    MD5

    78541447ef7b50c769fb8665d179da7a

    SHA1

    d4a97143d4c8b403e15e464cfdde755d4e416d40

    SHA256

    c79da8613a48f16afbef8cceedfef7dae0bf3ec7192e1fde85b6d97af8838867

    SHA512

    3f341e1f43cb63c05b7ac0e88dc3cfad92f423421c55c499f8dc913d106e0a9b47663572ffef304a105a42c4dc5e9c66bc360526a8ba69dfa0f44c9c2efce171

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    64KB

    MD5

    1ac5c5417db351a7b68c6004f7d78571

    SHA1

    f9c5e425593c61dacad6478744ccf3aba540d651

    SHA256

    485203259616398b66520c469a04afdada16a57b55056604305ec15729f87459

    SHA512

    59dd239a0b0dcf6383effa2abe5a170b0d529ac82aa75c17e3ce55aac079de24c6c88caa40e2330698e9a76b69b72fe1b29aa12c9c7ea40fbd6a238a33752273

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    64KB

    MD5

    6f59ac91a7d8c33a7caf5f6bdc0b833d

    SHA1

    31f428734779c87dadcdc02c3f1f17b8857cbc67

    SHA256

    7eaae930edba021ff556881d6d312be4afb1d56099d592f5dd3b6497d7efc186

    SHA512

    93956a43a42fd57a1fc127990123da765741ce75069d7bacdb3418aae958132625e9899ca90d07aeeecd97860e477018d0fec364a8fa9768b22e1faa20408d96

    Download Submit

  • C:\tiwi.exe
    Filesize

    64KB

    MD5

    a298f9e3400a9be00d4c1a0097a739a1

    SHA1

    b18b603e6dcae1192b10f1c6492203a36b03691c

    SHA256

    5e912075614c9eca764dba58849dde4e0c2b0696bb83d9d0707597e14470c212

    SHA512

    783c3f18a568a6b76caff5fafcb8aba2c155dad753962e485abdada90ae265a4e9f80e38167e6caf89dfd2ba21016ff63e7fc22160dc5507900c1157c2dcb198

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\imoet.exe
    Filesize

    64KB

    MD5

    3af9078d4ea1113229e1b39925a978b2

    SHA1

    c2ecfcb05988b27e2d1b21857c51495a6e1384af

    SHA256

    a0a2779515824ebfa46f84ca1f7677f83b005b79cf15f6a21329bf3a7f178474

    SHA512

    33b38e2996aa7f7ca01fbeb1f64919bd5cb12469f9f8350cda74070ec18361c024994b5f4a266e2c47450043482a8ad7971ff5b2315c006c28ed3a4bf218ae9d

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    64KB

    MD5

    565fbd47f06968c8ccc8cea1d33fa8b4

    SHA1

    509a469eb464721bf004edb69172adc06dbb42cd

    SHA256

    95f13158fb0c912130d15c8befe4ecc84132ebdefd64de739ed4935a397c889e

    SHA512

    80ee5632d68afcae7fadf3d955de96a1d3f98a1e8201b1f12bc9d6cdca94cd8dbf0fc3ef3dec4eafb4e9511e121027f77f6c3baad33c005ecf94450242b9f685

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    64KB

    MD5

    af04cfdd2bcf0c77afc95c83fa289f9d

    SHA1

    d59929c3146fc212de90c47541430babec4ae353

    SHA256

    f34166c5a7136d3b92d75db45c610d8efa25a89f005fdfcc058a340c3ea74ed4

    SHA512

    5cfa6e71b33de54459c89aea0b9f7976d86522c5724611b704f07083b83dcc64f9c56e8bf1e8b9e9a68f91733b3fdc792e9ec3cb01f2ced85496e4fa3ccf92b1

    Download Submit

  • memory/348-240-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/348-283-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/348-286-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/848-458-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/848-125-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/880-334-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/880-333-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/880-332-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/944-330-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1372-176-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1372-186-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1372-188-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2016-455-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2016-454-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2068-191-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2068-279-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2372-362-0x0000000000260000-0x0000000000270000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2372-363-0x0000000000260000-0x0000000000270000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2412-420-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2424-423-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2424-345-0x0000000003800000-0x0000000003DFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2424-175-0x0000000003900000-0x0000000003EFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2424-110-0x0000000003800000-0x0000000003DFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2424-193-0x0000000003900000-0x0000000003EFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2424-190-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2424-111-0x0000000003800000-0x0000000003DFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2424-100-0x0000000003800000-0x0000000003DFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2424-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2424-189-0x0000000003800000-0x0000000003DFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2424-192-0x0000000003900000-0x0000000003EFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2424-124-0x0000000003800000-0x0000000003DFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2424-98-0x0000000003800000-0x0000000003DFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2424-126-0x0000000003800000-0x0000000003DFF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2524-424-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2524-112-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2536-394-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2752-366-0x00000000002A0000-0x00000000002B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2872-99-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2872-235-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2916-361-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2916-360-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2940-453-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3032-391-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3032-390-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download