Overview

overview

10

Static

static

3

f185ba07c2...03.exe

windows7-x64

10

f185ba07c2...03.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 05:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f185ba07c238e1f1e1b1c596a03df283a7711c17e476d9444dfc99b095e99203.exe

  • Size

    488KB

  • MD5

    a9b50102a0433ff0716e2a3c012e75c2

  • SHA1

    7d4d5a1160563d43e9f3e979d96fb6b5bb18b622

  • SHA256

    f185ba07c238e1f1e1b1c596a03df283a7711c17e476d9444dfc99b095e99203

  • SHA512

    bc252e655d0a4556ee3ff22bf0423d014ec02fed4f53e0692dcbfe7330fe7683e68f0ec3e5b8dc9cf0cbd9ff8c6d292274ebd6ce99fe590dd966cab6435bc120

  • SSDEEP

    12288:V/Mn/MP/Mx/M7/Mx/M4/MpBE/Mk/M2/M1:VAK2O2HIBEd7M

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\f185ba07c238e1f1e1b1c596a03df283a7711c17e476d9444dfc99b095e99203.exe
    "C:\Users\Admin\AppData\Local\Temp\f185ba07c238e1f1e1b1c596a03df283a7711c17e476d9444dfc99b095e99203.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2820
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2556
      • C:\Windows\Notepad.exe
        Notepad.exe C:\Present.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:2700
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1872
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2284
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2688
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2624
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3000
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2848
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2412
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3056
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:760
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2960
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1640
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1464
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2660
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1536
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2964
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2260
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2488
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2104
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1588
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2240
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2828
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2840
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1744
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2336
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2172
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2968
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:776
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2652
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2112
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1208
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2264
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2708
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1940
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    8e791603dff3706c566898d10b8e5cef

    SHA1

    cae493a70a42a665a4d2e5e1f2f75cb7284a26b4

    SHA256

    fb385f2a8b78db455ba82672fa2271030c8a52ebabda211b1a9121026cce5462

    SHA512

    ee815850f7bcfb0aee40f08fc62263ad880b283417c6fc1c4dab76315bc3161f6f1bd71b7e6d23e56f7b7c65e8882ef3833bb58afff1c6873e03da93e06ff38a

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    488KB

    MD5

    3ee4d9d11c4dbc1a4169a831fbfe1aa6

    SHA1

    041285d4c30fce07db641e311cf85744407861d1

    SHA256

    71ffb7ac77a759f3b2637282561cfe1d6e9a47e56e9232e7c3bec1392c99a012

    SHA512

    1a4d6d5a9264e58a07c19c437e3879255ee32c9d57d30a28e9fc38f76bea05701713306d84f21b0be5a5df71b85fe66a8337a0039cf3085f5d76e72ea9fa3bb0

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    2a7465918cd59020098879111b7f2a17

    SHA1

    775d7beb03208e3d0e9c4193baad3453f7009822

    SHA256

    0e72771928842a57d690b9a02683da77483242bf1c2a6828899061a82f88b86e

    SHA512

    59b0d2c6faf379dc441d3f88da37fda4d98a6415fd57bcab9816325e444f00146d49d60464527cb63c36b557bf5a4fff825947b276ea72a2c6f6a8438fdeb2ed

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    a57f703440c37707b066e902d3314492

    SHA1

    f0588bbc2dec5c23c84f41e649c1908fde5210d4

    SHA256

    30e290d63304bc41cf6848174f617bb5058234649a5bf58546f2aaa1534a4d3f

    SHA512

    825f7eb191c4900f4e35dcc8bc55022018f24a01fb08a9fda8005dbb8e4bc652a8e870b62b93b0ff62b67c66f1478531824472a92895683e999278af7a0a4407

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    6d930ec5ecf1aee103b62ca3032a7253

    SHA1

    702087f473d45bcbd08cb71101cb4dcac7ef1593

    SHA256

    ffae86920ad57c7de60a8b1f6024daa15a832277bb7a65735b25ab3eb6799f01

    SHA512

    34d06829a5a6441b2079a3a57cb16c6d16c8f0c82693a3a4db96882d8e1c1d7d8e679a1c2a5c37fd4efa126bef0c4a5e12dad7b4d30966746cab20168bbce344

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    488KB

    MD5

    95755592961d2e8795fe49dccd016407

    SHA1

    9ed8a93867c058f829ababfebc76d9861d3dc707

    SHA256

    09c74e311bdec1821ec5d44fd8e40148b40f236838ecd470e732226e38cd73e7

    SHA512

    6bd5a2b80e32329938100d952e35b9e1ecd65614359257f58c4f6daa3cde5fe437c70b5dcc4ce164b614392cf0abde3364c2f35bbbb0ba60edde18b22527b7e7

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    488KB

    MD5

    4ca9f98ae321bcf4046b6fb7cd5b4e6c

    SHA1

    533264e749c3caa26029543a2879c6fed910f93c

    SHA256

    1ab5b92049bf61e422315478248e60ccac43c760976502a16882c6ebeb22bed6

    SHA512

    019a76216c712f75d744717a478deb9de0517ad8203d338cfd6ec1da684149c8cec5ddc2f01b577535fa6aa1e199fbb3222142291205c514b70ebf823b9b47df

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    048eea3b8860ec676befbd9ce1f4e29e

    SHA1

    d603a354e99389f46af0a4037c41221b8c2270fe

    SHA256

    13783aeb60e2378467a8af73fd5cd60cbed13890033f6ddad61b1f61cf9f4204

    SHA512

    43cf20dba2f64209b24240292024596d797dab1ecd8412999a575b533f0cb1d53cfb89680d4a9e640963b1e8e759f44fe099d0da41faca1fbe1b43905502d0a8

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    af7dea4269a439cb3bdc033ed831a64a

    SHA1

    6bc8985992cb884790bb7c98d212fd46d1dd7bce

    SHA256

    3a6ba55478c6c178f13fe65be7a6edcab19632aac92d1a5fd8cf2bc78c96bf98

    SHA512

    8742d1ea5e6f979a90b75fd4c6e451bd8b370d09ba3678f44c5a900d503ce6878abee5265e29fdc93fee1686707ffeea78ced0f9bc733495e504b83ebb2bde9c

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    488KB

    MD5

    525514dc527a90d3fa6f71dbc1893674

    SHA1

    423d9c8c4653025c35c58e1af451ada592694f09

    SHA256

    c6686b62d1ca8c2cf0eaf802b83cd03488e22cb2dc30456e263caf24f0a5d71e

    SHA512

    99cd7ed749bf044dc9c53f0b200457b80ee3e90f9a91303661bd8bffdbb87c91d5e40e1191338186f32de27f271b4cd1074b7df971b62617f2e5739822baf70e

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    488KB

    MD5

    d403a493a5c09a67e6b26305a43542c6

    SHA1

    035508a92d61bca14b69b954927523d243961a16

    SHA256

    b9944c5e9a1a80b758f439ccf6ac504e3c5657b429cbb96380deef93a0fc504f

    SHA512

    ddee93af34e905f0347b324264b991eaedf4ac4a25a38bc151ac68db89a708a8c37bd1b6459418725ea41b66ef433063620b946505d04b27dc23b7a668db011a

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    a889596784100067964d8bccd288f915

    SHA1

    0b6d8eeb2b993c206c23632096c6b2a62aa0eea8

    SHA256

    ea6b3b89ead6f2206c6940986cc3b2de9bece7a4a7ea40efe46460fc69dd266f

    SHA512

    8d29e30d57c757156e0fbfd660b0289065966c68ca92d07f626bfab4bf66a0463144fb214dcca3e21096dcc1279c8d2ed1036b341fe32dbdef5686937955e5f2

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    488KB

    MD5

    31851ac622530836a7e4b6db5cbe62df

    SHA1

    453a41aca649ce7fce78e380161694e865dd70d3

    SHA256

    8048a07112bf91c1e02ba33c23265fb9611f9c129f03348720a4f9e4d331d6b4

    SHA512

    9da6e3b9ab4b6cc87f2ced09b120379f875daa847dde76538a53d7df76d1a4bc6da88c1d49ad1adfd2930d0a4c0b5068575890f8514a1efb463e56ae716de3e7

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    45650f2ddfdd47dfe1baa53c0aea26f8

    SHA1

    eddb8fddbbff75d56b93a11f0ae961bb026da1ea

    SHA256

    5f21a41bd5cfa14508a28aa6d128444fdc490cca31cbaf4f12673f41ad83e58d

    SHA512

    6d3695a6d6eed2f5f18e0c63fddbb88ae507f9839da89dfde6927c655c909f8ff751a53c80ea68e0c663ae7a86754aba4c1f90e9e85c96d13c076fd42f5b660c

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    6dbffc2a93a85c55dac29de8cf0ba8cc

    SHA1

    6229742c38c4aba812d0ffbba4e98f14d06715ef

    SHA256

    869dc8cb040c2bca180cd29c74978472c9a14a473ba75ae61a7c4a9f7ee789ca

    SHA512

    d55b6dc25b53986ce362a7498fe9b22f9619c5b4f15b8f70c829a8ce5288ffcaf97a0028b35c75055830bc7bde1210943a806ff3bb4231992ecd2b2a5cadc155

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    488KB

    MD5

    a9b50102a0433ff0716e2a3c012e75c2

    SHA1

    7d4d5a1160563d43e9f3e979d96fb6b5bb18b622

    SHA256

    f185ba07c238e1f1e1b1c596a03df283a7711c17e476d9444dfc99b095e99203

    SHA512

    bc252e655d0a4556ee3ff22bf0423d014ec02fed4f53e0692dcbfe7330fe7683e68f0ec3e5b8dc9cf0cbd9ff8c6d292274ebd6ce99fe590dd966cab6435bc120

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    488KB

    MD5

    9eea77ebe50f15eecd3b91919ee39527

    SHA1

    d5266b63dc7aaeae34dc77aff7527ed89eef6c44

    SHA256

    9cdb9a10cb27fb758d832a2aa8a944649cc0b233220eb16ac7df1aeaf56ea99f

    SHA512

    f56a484ea8313203ff885ff27afb28592e07038efe2a82fa8131b1d6cb67481e5d622dd032d3f0c585536b91cbae7306838eb4010baa185fd4d3c0a928b18a38

    Download Submit

  • C:\Windows\msvbvm60.dll
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    488KB

    MD5

    012bc36e21cd78222fb09ac2b6d380b7

    SHA1

    f2cd2a281b77e1092e8c3a2ca5dd9bf93a74e541

    SHA256

    78d8eb869ccf1de00b4d32e724d219ae046175b62332038787ac1655a2deb794

    SHA512

    065e4dc28cc1a69d1f2c9951b6f232b208bbfa8c5c0614f2148bd42d237b2c6f005a66a3be8b00cba255d598fa5d5625103027857f2872778f6d06146ca18cc3

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    9e71b0bce431f4df2edd7d2d577238e1

    SHA1

    6370a917c4da5ebc69d0a430950e46fed45facd7

    SHA256

    6874fb7df42d4f5e3b2cb17791ce05bf3bc88316a0da9856145a8e872701902d

    SHA512

    faa57f927dd0fe4b2ecf11ed2414a78d2374f28beb0b15a38df205caba231c8c6a46a8676bd0a898e58e1cd1a169418e12fec817fd7bd051dcbf9897497903ff

    Download Submit

  • C:\tiwi.exe
    Filesize

    488KB

    MD5

    f22cf4336b5c99cd2da0d2e17ac52fb7

    SHA1

    fa3daa83a06931d7a351863eb06d728acbb1952a

    SHA256

    a8b079c5cf1166340fc0c1b002857dcabca48dc3e565b9a32b9cef175d6d410c

    SHA512

    1cd4e9a8324bb0525ed472a3a8c24ff482c74d340d57729e07f66ec383bcd325174ce7493061657ee3b2fd21b76c79997466c390a2b85b2ed3427714684d7b85

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    488KB

    MD5

    683122d67eee89a2ad32205a8a53a1a4

    SHA1

    e189c4d701c98bd273ef380d1189fafb20d3520c

    SHA256

    42a88905b5760ba84da7e42bda460bf15ec298bd62424daebf2aebb2d028c4f2

    SHA512

    18a732ed6e4930b539398ed6d722f21fa27e745ef2ca13f77bb22abc06def97f7a80d1156fa2ee67c823fe30d7a2d2ffb65c9b43758fc3f2acf045fe3d82725f

    Download Submit

  • memory/776-411-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/776-409-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1464-290-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1464-284-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1640-164-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1640-338-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1744-430-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1744-429-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1872-163-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1872-159-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2284-169-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2284-218-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2488-220-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2488-265-0x00000000002A0000-0x00000000002B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2488-266-0x00000000002A0000-0x00000000002B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2488-270-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2488-271-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2556-277-0x0000000003490000-0x0000000003A8F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2556-373-0x0000000003490000-0x0000000003A8F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2556-174-0x0000000003490000-0x0000000003A8F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2556-295-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2556-99-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2556-171-0x0000000003490000-0x0000000003A8F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2624-331-0x0000000077AC0000-0x0000000077BDF000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2624-333-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2624-332-0x00000000779C0000-0x0000000077ABA000-memory.dmp

    Filesize

    1000KB

    Download

  • memory/2652-415-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2820-219-0x00000000034D0000-0x0000000003ACF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2820-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2820-156-0x00000000033D0000-0x00000000039CF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2820-155-0x00000000033D0000-0x00000000039CF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2820-100-0x00000000033D0000-0x00000000039CF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2820-294-0x00000000033D0000-0x00000000039CF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2820-264-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2820-98-0x00000000033D0000-0x00000000039CF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2820-433-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2828-418-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download