Overview

overview

10

Static

static

3

2107965df8...cb.exe

windows7-x64

10

2107965df8...cb.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-11-2024 17:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2107965df8e61c464e03372f396feba24a244901977d894354ab691805ba68cb.exe

  • Size

    64KB

  • MD5

    585375badbe2d8858ea991798ad13da1

  • SHA1

    f59369a3759c276a753fac9b76ac1bffbbf6ba0e

  • SHA256

    2107965df8e61c464e03372f396feba24a244901977d894354ab691805ba68cb

  • SHA512

    321f22db96dc047ebd204c4a91ab3d845c48d57a77f18564a3ddc087ac5694d10d07f7218e199ad1c4eaa859931f80d940ffa3cedad4740b2def500a6fa5dd89

  • SSDEEP

    768:VNuG777/+V36n9PcXYvn8KR1I3NznRAQZlh4VkpX179r+R52OwekflNuG777/+VW:V8w2VS9Eovn8KRgWmhZpX1QfwJ8w2VW

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2107965df8e61c464e03372f396feba24a244901977d894354ab691805ba68cb.exe
    "C:\Users\Admin\AppData\Local\Temp\2107965df8e61c464e03372f396feba24a244901977d894354ab691805ba68cb.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1252
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2680
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2060
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2360
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2024
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2788
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2820
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2292
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3012
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1812
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1864
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1696
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2624
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1992
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2416
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2572
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2776
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1168
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2328
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2176
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2568
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2752
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3068
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2460
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3000
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2392
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1424
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2760
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2896
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1532
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:632
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:552
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2924
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2808
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2620
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    c4bed033535bb091bffa87075b79ecd3

    SHA1

    bcf7c8da4bfdeab98541fb7693070e94a4a4ce18

    SHA256

    4ffdbf6297e8c6b64ffa98513b16e69724139fe0da5b00408b84443ee9357df8

    SHA512

    97684bdd3df80c93f199cc219fbd00111abb1f044b511742939d90e25b7ae7dc30a4be106f9b4db4734bdd3f3db2ca1f640a8916441bcb63666454dd0b250d77

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    64KB

    MD5

    f6a885e788d222aaaffa9665fc27dbcf

    SHA1

    898753e167c472dba8805c6731118fed7112015e

    SHA256

    7c4c37b51ae5aa9071e707fe58b5c319243b2dc58a1a1f1252f8568ddf52a4cc

    SHA512

    5eb21ec449501a5933515f228ac7179c2db3f13af0c1cc8b4dc7ed97d7e912e43de2feab44b83e84b62954a1ae992550a45cb43a921a4aac230f9ef34061a295

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    64KB

    MD5

    8ce1ed9b08a873fe6fc9b015cc0aa333

    SHA1

    65b4254ecd056673af10953cb5236578f32fef48

    SHA256

    96699432860d5ebebe34107fa0941ac83027f86512396ec8a826ebf0a8791cf3

    SHA512

    8e9a61180d4ff1a330ddf7d15e9dc09b566e384633fa1a5417bbc4f48559e4daf3665e24d854a0ae2c3add0a36bb0aa913c9776a6c364c652858137fde5c1596

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    64KB

    MD5

    5b0ac4354d0a7d4c0fe6b2072a983341

    SHA1

    486c99adfa3ce541514b93b3961135d28e699d39

    SHA256

    f250cbf22e8d694e9a5e048b6ec4b6212fed8b73565ac82ab5006c002ccf41c5

    SHA512

    d3bafe25d28e0977200ccc7ee29ea49b94dbb8cb8e0a29a2ae2a20fd39188a47c1b328fae8affe442e819a569660d96e594465c3b22e13be6832d6b2bd04d7b9

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    64KB

    MD5

    1e06a02781aa92d8ce54311494cef994

    SHA1

    ae441946e15bfeaf9a41f107bd70c750b6638a0f

    SHA256

    49321b8fd3fb721bd8a19c5d75c2a41b3b88aff6a88ed389557ffd64690dff4d

    SHA512

    d59758828516fa34991e38ff9194ef5a6ae6623681cc91f09575949effae4bfb58220b7414da376377121cc077524a6a664706cbb14916e69c56e912610fc00f

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    64KB

    MD5

    a40c3206aff798dd3a3c1b0beced306d

    SHA1

    373ec09bf20cf623e0a5c7a5b46dfdbda498b866

    SHA256

    956da80468c041a46b17e25434c9a2085cea353c4a2ad015b434ed2e270904d8

    SHA512

    a4016524616f4732e49a169f283cdf70853fb2e6a7950deb6007706f1b17b15620de6a0704cd660f4871f82a15a0de00e00c4abc7dd0cad2f3d0a97e27845c9a

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    8c3920849ff91e7005074697dd31e1cc

    SHA1

    3abe7aa21825b6deb54d206c3cee90de5532c052

    SHA256

    64dd7c92ee449e14863bc71967a9de84bdeda6b937fdb5432fb99b42a09f7d42

    SHA512

    8bd6c02588388876294d4b712025ed9ef6bf92a765b1891d905fe0cb7e3527231a9928c3c60be869b506afb92cb1817c9731312701f08779468c1141851dff9b

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    0be96d282df0ddc4ada83f724917a2bf

    SHA1

    6c67f0f41d4d2f8e0ca522f500e9585dca25e9cb

    SHA256

    fa56eb19cd010af5ba6265b03a075bfcba5813dde239df493780abe4a7d8816b

    SHA512

    79540cf8a6eddb457fe195a06439a503eb5f2a43dd21f4359c5b60e8a68f19829845b91386cf75fe1ab0f6a85edbf148d586d6fe44e96b5502228d78107ed9df

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    7ac5e0c3d6309bb7de06a0eeba494d63

    SHA1

    45ddf84a2294971602bc9434133c73743f8f1d81

    SHA256

    971656217dc5c01166a16da868a5eec06954a98ecfa80a40dd9fa50436cbfdb1

    SHA512

    c610195ec39e8562ee7eeb5d451f4e6bb469542ef55aa6bb935a7d3d814d2f681247097458d14c84c43f9bd5d6a1b65c3c3c6d775ced3c3361e90b63ba0b1fd3

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    64KB

    MD5

    54c6f17e12cc62859b5d7c8a4e527c5f

    SHA1

    d271fcb15b62f30f2f3b90ba1b2d331ccb356721

    SHA256

    75f46b419eb125605fa8150613aa161d9bff1d7a5e0f78cbd88fe6d9eb72458d

    SHA512

    469a09f8e7420c7a1504d240ec8aac99772455c4ced3d29392066341b7f8a8921302abf664e4c056aae645e516bba52a6fc89e160ba1af4a917876e4128433f7

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    64KB

    MD5

    1b1517abb03556140c7eb5f015d90642

    SHA1

    990ce630625582da73d12532d1bc1a94a202d3af

    SHA256

    4b7e7d647c42d65a208878c33e71fa8b3aa8204e27a46dc4f00c18757b63ad62

    SHA512

    6aba5972929df76026a83337011d6116c26e09f84982db1f2894e042b758a49626fa14f6bf944c8e9e7d36082c1a8b4c91aedbe98b59b871ee6d8bcb9254f7eb

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    64KB

    MD5

    bd83e8620f8baa08da4302670c8e33f5

    SHA1

    db8ae8f66ded2c02be899dc5a84835d2244b2a35

    SHA256

    649279f44b60e5966dad0089ef53dee7dd8d42f3ce837c9f1bd63ac506d7d97a

    SHA512

    fa07ca9af2d113e8c7d54e09a932b7a0cfb0367c08283c2da4f93e6ae94eea031a8286e4675088d544177bdbb22606816f43931007d39137b19f46524871af4d

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    64KB

    MD5

    ccfd3d2a579b6994653adde59b22f89f

    SHA1

    c8482bcd90003d9769ebf5dc76795418ecdd3e02

    SHA256

    263f2966c5ade0e65ed10b77bdc050435306397d9f9d0767e10c8f2739815d28

    SHA512

    3850a4e8d31e9a2cec798381c9fb359563215c8176807ab151ebff788a87c717d70bd1c48abca776390b6e58df4e990f742c2a11c99cbb852733d28ddc6146f8

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    64KB

    MD5

    d588938e138a0fd7c0c024487bf652ab

    SHA1

    ef51e35edc8e46d57706a5323a022c03c69abd96

    SHA256

    3747bd43812cc596a0b6477364d3390f92b2bba35f15a1c3fdf5eb73b9fd0282

    SHA512

    09c64d3c63a3233866e078df152c278c6c69f3cafe205e3c99e6090f71f46b529a351a29e60db95f3355ae4a88c30c82de23bb7749d86ed97f1ae8735200e38c

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    64KB

    MD5

    670e74ef82a23b1292ea4105801d7f91

    SHA1

    580d65a854d3ffd992b1140ed861b40dc699addc

    SHA256

    0e733a8fdf78a2a7016a5525c1f3a69c559f7f6945290318e2192ca6fe7ff6c5

    SHA512

    913218f26404c4e6c467628484838fb44a713c4d856dc33432a3fb63ca2206aa67c364f7edd8d9d18c3ca8c6ee6827003bd1863d887e2f6b8d996b5fe46f2ad1

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    64KB

    MD5

    585375badbe2d8858ea991798ad13da1

    SHA1

    f59369a3759c276a753fac9b76ac1bffbbf6ba0e

    SHA256

    2107965df8e61c464e03372f396feba24a244901977d894354ab691805ba68cb

    SHA512

    321f22db96dc047ebd204c4a91ab3d845c48d57a77f18564a3ddc087ac5694d10d07f7218e199ad1c4eaa859931f80d940ffa3cedad4740b2def500a6fa5dd89

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    64KB

    MD5

    bb05287c663399e926b96f671c72019f

    SHA1

    a0e59751abbc23e7a24b7c3fb45fe180053bb781

    SHA256

    33929c4308857ebc984e24c60d4f70dfab97d94a9698f7045794e65201d6b4cf

    SHA512

    5b2ead8251f1915f2a8b742d33faf5327cb30be58477e3d4aac5a63feadd55978c12fd0aba4b2879bb8d0f05c9e9bb00e349aade81cae23740fe9bd2851f6299

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    64KB

    MD5

    84f6956b52f0bd250c4c4aeb0d2ed7bf

    SHA1

    0f13910f9d0cd0780cec35f86a6bb5cab17ca650

    SHA256

    b478be398c751f6b44afd38202f9361afe79941f7b6d950d00fab8a09393f1af

    SHA512

    c9f39b1a5ef8acdbeecb21d636c7314ad6a0afa7a41824324939f0fab35bb75c9748e439079546a4cb16aeeeed7bc983c7b70f4da049afaec611f267ef5f83ea

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    64KB

    MD5

    19446437e9fa1050bbd347dde52938e8

    SHA1

    a07bb690a07b77de6a8c955afa8e046fa5a05350

    SHA256

    4486c739b094d1feaf131157b5bde8eb289c830328c155389ab2f0dc26f76e8a

    SHA512

    e913b309ab6672c78c04c94017bbb3d134f7635827cb0dac461e3649d28ee0d70c4e30d9ed8205da196f34a4e00b38f9db5fa6f294001353266dc29fcf8a2d52

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    64KB

    MD5

    4744683dd15a66db61d3dbcf63d090a9

    SHA1

    3ec28dba92547c163400d428c9e43dc71d39ba65

    SHA256

    cf3e50b9b89f3e67c9c607ace411789ba9f9cb2ee92aa7b7999426f58350d506

    SHA512

    89db7e673981821a800ec9e230883fd2eb18c7f25bc27a32cd8bb257bfd14e57e275c8e6773f3ea2b4013e28b4df867e89b21b4d1b420592f22e489d6f21a01d

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    64KB

    MD5

    4f0fd0e5497b12a76afa80e1bbe59e3d

    SHA1

    2ba6addf14fa81aa73053a41efb459fd652552ae

    SHA256

    3522c97bef5bb6ca6c1d0bde5ff992a5ec3eda4784d680eeb4731771165e52e2

    SHA512

    debd562f08c52530bd69c836e3d467fcf8564ee1fd3939c713bccea0109f70211d601b3aefb43d35ed2c113052fa6e33d1ae5e3c1e95fc3117442e4568cc90a0

    Download Submit

  • C:\tiwi.exe
    Filesize

    64KB

    MD5

    98c3dec074ce4a1da804fa4e9ff01e4e

    SHA1

    52d6081f51bac3c758e185b6ec2ce766ebe893ba

    SHA256

    b3dae353742dc79eba3ec335481232be47f883af089af7bbecbe3a991fa1ebcd

    SHA512

    41db12e7d5f3c7a8cd9bd26054cef2e1f052a6d4c242bd3d0aa5f7e4a8050534aa5a68af892e9834d0bd5cfd48b3dbababdf92ee89cff89ea1620bfeffe102eb

    Download Submit

  • C:\tiwi.exe
    Filesize

    64KB

    MD5

    cbbbee734cb4276e3084e78bc008761a

    SHA1

    2cdb0a2fde0885867c7fc55ae5c5c4138b3f698f

    SHA256

    7c4b6540c14035e8c2f6e9be92a71bf03ba86237a868aae7318dcd291ddc7b1b

    SHA512

    e55b810c39ccb33b3acc1592958840649f82c5755e1d685a5b60aa51419eb1d01acc10ede9a65ac55542d74bf00d4e65d9c23cd10d814013dfc35ff0d5b50e01

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\imoet.exe
    Filesize

    64KB

    MD5

    e0125502b691ad4a7288520739160bf9

    SHA1

    af1ff10f30f748133751a2b5dace0c54ef5d0547

    SHA256

    0710568a250b6de3d852ef1aa075be9e3bf96b4c9bac41122317ce14f1828129

    SHA512

    443f2529d380fc51ba508b206e686c33a5d400c3926ede7a2ed329f48f2b6bd086fa152305ea1046150f8586850b4d08cc45f220f856eb50177c459f96c3d0eb

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    64KB

    MD5

    52097c5f0c92eca43a24a53df55ae86d

    SHA1

    077bf18e53025d162cd93267547f053c6f92a1c7

    SHA256

    9f91e2acdd610caf523036def31ea8193f95af3e0ecb46a3b1119e83b0c2064e

    SHA512

    19c86f421c1078d6569fba6a1351ba466344bf2e6ddda4c6a243cd9fa2d1772a166505f6fe6ebcb0fa6d0d4e36d7aa58ec7daf581881fa173af909b7837e62b0

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    64KB

    MD5

    997cb37f19aa2141c57742a04ffab172

    SHA1

    c835bb66a7969f730620290899df41280811da55

    SHA256

    de5f46daab8d4a484a62331613ca1052ae04a360a8be18ba79f1ee88404674e4

    SHA512

    7845b77e337aaa4f4439067c8b5a295d6374254a95a763b5613704bbf874ddbd0da7d2644fd2e1a2997208a57fa8e5e5c158709989ca25e0e78e97a9aecf3744

    Download Submit

  • memory/632-301-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1252-216-0x00000000038D0000-0x0000000003ECF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1252-99-0x00000000037D0000-0x0000000003DCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1252-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1252-124-0x00000000037D0000-0x0000000003DCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1252-125-0x00000000037D0000-0x0000000003DCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1252-136-0x00000000037D0000-0x0000000003DCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1252-306-0x00000000037D0000-0x0000000003DCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1252-423-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1252-138-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1252-111-0x00000000037D0000-0x0000000003DCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1252-347-0x00000000037D0000-0x0000000003DCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1252-214-0x00000000037D0000-0x0000000003DCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1252-98-0x00000000037D0000-0x0000000003DCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1252-110-0x00000000037D0000-0x0000000003DCF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1532-425-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1992-291-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2060-293-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2060-298-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2060-177-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2176-342-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2292-419-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2328-126-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2328-420-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2392-341-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2568-345-0x0000000000260000-0x0000000000270000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2624-382-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2624-112-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2680-176-0x0000000003770000-0x0000000003D6F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2680-435-0x0000000003770000-0x0000000003D6F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2680-100-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2680-213-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2752-355-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2844-422-0x0000000000230000-0x0000000000240000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2844-421-0x0000000000230000-0x0000000000240000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2924-348-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2924-349-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3000-137-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3000-434-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3012-426-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download