Overview

overview

10

Static

static

3

bdabc17526...9f.exe

windows7-x64

10

bdabc17526...9f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 03:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bdabc17526e2f24819a2f40417405c676c9ea47ce6041a7889bdf544558df39f.exe

  • Size

    488KB

  • MD5

    37807dccd6ecdc9700ce3c2ac688da9c

  • SHA1

    c63f7e6de6f1f7ae271bff34f96f014f8812d0c1

  • SHA256

    bdabc17526e2f24819a2f40417405c676c9ea47ce6041a7889bdf544558df39f

  • SHA512

    cadff41947cee0e1ff1485b802499f48a94a160eb78f26a699ea5a9bdcd7b5f5e5d9d2176b9faa421fa228304447d414458a4af578fee905c890a4779cb00e7f

  • SSDEEP

    12288:V/M//MP/Mx/M7/Mx/M4/MpBE/Mk/M2/M1:V0K2O2HIBEd7M

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 6 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\bdabc17526e2f24819a2f40417405c676c9ea47ce6041a7889bdf544558df39f.exe
    "C:\Users\Admin\AppData\Local\Temp\bdabc17526e2f24819a2f40417405c676c9ea47ce6041a7889bdf544558df39f.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2600
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2084
      • C:\Windows\Notepad.exe
        Notepad.exe C:\Present.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:2700
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1824
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:828
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2564
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:264
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2852
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:772
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1736
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2644
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:352
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2764
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1644
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1980
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:268
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:832
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2200
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2732
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1652
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1988
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1716
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3052
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2772
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1708
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1664
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1720
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2304
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2896
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2160
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:816
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1092
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2376
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2088
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2728
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1596
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    b2e93ade12259d70dbf428b8434b5f7d

    SHA1

    b6b8880321b2b779d3fe2b7cc6488609d3f387fc

    SHA256

    1d41b09b70c24c57a6848c1a21c1ab5f4cc96d4da7da70d0452579189d3374ba

    SHA512

    13dff2a4ab096559aa95c2a7822f46d9a13b7e8c05069fd201d1319c9bf19dc77e9fd5af6378603f0468f6baa6e1eb132bbf3e570e57e0bc484b6b36eb324385

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    b802d46d4274ec9e7ee916f28c452ab6

    SHA1

    30018b5caca57f9ac200e30d64a288cd52003945

    SHA256

    206ba7a70c337103034fe594bf47d68c561dfe2dcd4bf6b093126d930f3717c0

    SHA512

    c78c942bc7462cb7506d934c7ca92279aa07b3c05419990cb8928c4ce5d4ef884f1c6c9ed8ddfdb1c3a0b27a3a894874b08267a4f71357b16d603086165d12d1

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    b3cba3fd67e8644c20731033a90e1c21

    SHA1

    49db96e442a8809d91c330cd545604110e94af7d

    SHA256

    0dbdea6aabf2a3533996d68b880727cbb7b11784b041c42ee2f5aed47ac36c0a

    SHA512

    f8324af4461da952c642870e4f2d7529def3f3f168cafc89f0c006fc304704e8c30bc488075f092425ff510a07e1376e84376ca97a15a9ee0a9c36a307d0de20

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    91ed61d7bb1f2e77048bce857b37b181

    SHA1

    630b4189efd7b4781a758895dcba2814925c75e2

    SHA256

    d21d79d5848436b143680dc0875ea8cea89ad3662f97da666df14a84435da3ba

    SHA512

    92282f6d4856487bc142fea1e83171e02ee359575174e38773a031b17508d39445ff8a14c2304c97f901d54f8917ce59ff86e36a41abc9711a1413cca6472348

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    eedb43ecd21e3bf7122650fa7456d918

    SHA1

    5dd2cd29d40617461dd64528af918a2a0b9efb54

    SHA256

    b3c48aa2774b9bdd0ff6eafd34b87079d32bc3b5815097f415974aca1b4742d3

    SHA512

    27c47d214a807725a594c4695dbf910cd00a62e0ed08617f3d331c0dc511ec0c75f3f828cec5c858e3b07bf7ae512c340e5264ebd86643fa4ebe60dbcf23263f

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    1949703e2e286fe38b421cdf781c3ae0

    SHA1

    ea0e1e98dd26c2a42f0095160f232aeb817bd783

    SHA256

    af796e361152c6e2a1234da8a24b5cb3ca51754f0afcfd549094cca8a479ad65

    SHA512

    9a4b2ab1d2465ce3676d1d9455b1a336378eaf60d2e8da2c9ae88adb90a07c8d047e85b85d4dd97cca5dd5881b5223f655d493745d5ed931cc020c8d761c25ec

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    d010f90f04d7670199cbec15802c264d

    SHA1

    06c286eed8baa72f023e29e31e65349f6b128c12

    SHA256

    555a2a08a21a9964a15cc586087e1477ae84be6c24c5280fbde0211b8b2b51f5

    SHA512

    d8791e79074f8c29be2b7df25a5928f016b78a92b7379b554c5ad351e3ec2de2e117770320c3500251e496cb2e72af95f8e00390e6da62e18fd96849db8e54a4

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    842a6430ef81ab2dabd01b1c16f941f7

    SHA1

    240467eaea28410d762a0951eb7801326a5c6753

    SHA256

    123d28aa696a36c72db86b98ba008dc8b9c5ea792a97de89d4115c64305bd5a4

    SHA512

    f5076394d230b5507698677b3f9eb8efae96cddc647f788561214593620683e68543a2d628fd07b4dce998e066de34fb063250d134b242a78ef1ed73f8653e9c

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    c6a5fa7c044f5bca4554447959746b62

    SHA1

    8ff477d501d909065d551c9aaa396dd49ef71b85

    SHA256

    6c1c3db86d7b4d51f988d316f107d9178b4330db51a330e2a6f643b5c8c98a3a

    SHA512

    2c8881f5c14f45f63c7d65f08ffe4f14c67bec588af5f09037128e37b44eba0db101deb564747bc847a48df37a8b2f707334fef38c059d1d4a09ff1364e41c7d

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\IExplorer.exe
    Filesize

    488KB

    MD5

    260dc6cbed8e820cd8426792ea1129fd

    SHA1

    b0cf84cbd066fabcd76b64aadfe8bb7f68848c16

    SHA256

    792db64c098363bb7dcd5e37252374acb101dfe00bdd1b4b2b9e8d7580124432

    SHA512

    a3dfac6a9939c183dd47ea33b755b4123363254dfbc630b99c5905b388ba28aa28b59c8aeb30c72d70124703bf77be2c1a83c02851cbbd4c6575e81b72c0e7e9

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    104bdc35609869685f6ecbdd8c00f7af

    SHA1

    a2c5034e8668d6544a7ce0ae0e34382153443dce

    SHA256

    75cc856ee6881717d8779b76ff450133460b9f93499a8541799dd4dff3295d20

    SHA512

    a45455f708bc75a0b27a39cd817c43f93d83763cae95c409c8994cc40286ab3547e6f7dd012976c4a3ee7bfde771b8271d99fc6bbef19dfbd4df1feeda810a5f

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    e27fdd312706e91fe6def74176934e81

    SHA1

    093c67787a11d57698599c77b613714aeec1ed43

    SHA256

    a5a67fe7c25f192e2dc57fa8d4063afc6d8e5462f342f79205b26b7721ff493a

    SHA512

    2d86f1178b225d9984116edfed58b260f5230efbad47a344fd52c5f63acbb2e160218b77b62d76014b8885905426d1d03e764298e26eb82946d6ab698af56917

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    37807dccd6ecdc9700ce3c2ac688da9c

    SHA1

    c63f7e6de6f1f7ae271bff34f96f014f8812d0c1

    SHA256

    bdabc17526e2f24819a2f40417405c676c9ea47ce6041a7889bdf544558df39f

    SHA512

    cadff41947cee0e1ff1485b802499f48a94a160eb78f26a699ea5a9bdcd7b5f5e5d9d2176b9faa421fa228304447d414458a4af578fee905c890a4779cb00e7f

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    ac8bd1322a18db7b5ded8bc0d1b63a71

    SHA1

    f529492a4b961be12ed2e2cccc5016326d8fea3a

    SHA256

    a9e731e0f4c5b6b6274ebcd50c7fbcc98817b427a611bfcdc5c121718acb052c

    SHA512

    5e20197900240699a22e0cc0fae104298c8036a10b0abf184695ed7c61ae0ec7b18ba4c8d76c96447ac781c1de010045ca67b7e53b823956074a79b5a25c536d

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    ce48f6cba314aed0ddf5833f7535bab7

    SHA1

    fd50c96e66464cdffe47da48d037ed9dde23804c

    SHA256

    d03d8c49f021409640a779dd26be99b9afa84a0d31e51c956aa47f0d414d0149

    SHA512

    898d7a70127119dd37e7475806d13d1961d0d3803e830234cf7631fb7f0c8d39088258bf907f7ecd2d64b3cf36b51bbf24c2b9839786c4123c4f3938061d3a54

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    488KB

    MD5

    e31d9e49b8cf226c31a05993b18b2c2a

    SHA1

    fbfa97599b899c7acf654939823511bccc171c3c

    SHA256

    6e86fc907d25206de44b3b0bcc2f527dd8fba09d593a6d46a113023d95b6707b

    SHA512

    059c42e4e396479dcb26fbad7ad1676b8ecc887c569a5aaabbd65455493b6345a08c514c29f1df4805647436b0b3ea6ef199ea354f052afd7654cc9309a9b8a6

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    7d8104bfe4c3a59c7fdbf04f27e2c3ec

    SHA1

    0c886018f0829e4c9045c34a2464c70480b8e469

    SHA256

    5a46167c5fd1507df53ff31471a5139ce11475037d1695c6f26d2fdb0511a29b

    SHA512

    39ab142345808b16a3cc11670f2a2ae42a875d5068c2ed39bd2357d4301a7e42dee1a7e4adb5ac3d3fc8275024cba39a24503feb32ee8c91ebeb5a9a2711040d

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    78338cdccf2c9cb1751f81d61bf94149

    SHA1

    ffadc422e75b8db87e244c5b6c485adb4043dec9

    SHA256

    5e1f5713405467ef33396270dc1be530c3829a2f5be16d79c54d2a45c24f1b96

    SHA512

    f50f666ce8a69d78d9c86126f5447dd10e4349dd52cd91a9868e4ba17d8bf84d4d54d96d1ccbf57ff639c22a0291f0971cc312f242402552a863a3f5464310c6

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    488KB

    MD5

    d42ecc5ac28c09ff435e4957d31a475d

    SHA1

    215f31d642fadddb37784152aed775ae2eaf1cdd

    SHA256

    c08d03d9082bb2b14bc5aeda94c50a8330d739e8d2e5bf2de0b1dd74c1423fb3

    SHA512

    bd7811fb13f4547ffd6c5fbd0663f9c0aa648f8f51913a496fd2d07fe5a6d50670b71138e5e4d0c9499c9ccd683bd5c9c3f29f8177ec82f320f8a046bbba07f5

    Download Submit

  • memory/816-232-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/816-179-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/816-237-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1644-447-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1652-322-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1652-323-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1652-324-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1664-340-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1708-127-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1708-467-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1716-346-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1716-345-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1824-234-0x0000000000260000-0x0000000000270000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1824-239-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1824-238-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1824-233-0x0000000000260000-0x0000000000270000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1824-228-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2084-99-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2084-336-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2088-392-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2160-441-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2160-442-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2600-98-0x0000000003AC0000-0x00000000040BF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2600-177-0x0000000003AC0000-0x00000000040BF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2600-100-0x0000000003AC0000-0x00000000040BF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2600-229-0x0000000003AC0000-0x00000000040BF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2600-230-0x0000000003AC0000-0x00000000040BF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2600-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2600-178-0x0000000003AC0000-0x00000000040BF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2600-126-0x0000000003AC0000-0x00000000040BF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2600-111-0x0000000003AC0000-0x00000000040BF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2600-125-0x0000000003AC0000-0x00000000040BF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2600-222-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2600-413-0x0000000003AC0000-0x00000000040BF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2600-460-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2600-113-0x0000000003AC0000-0x00000000040BF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2600-227-0x0000000003AC0000-0x00000000040BF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2732-359-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2732-112-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2852-418-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download