Overview

overview

10

Static

static

3

b3064b7d98...eN.exe

windows7-x64

10

b3064b7d98...eN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    114s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26-11-2024 01:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b3064b7d985d43ac95233f3139484c93ea15b96d7851f7c560b25948225dd5ceN.exe

  • Size

    440KB

  • MD5

    e12692f81e2dc5fcf33913cb764cd2f0

  • SHA1

    d063cc9c3e075df64b575d22ca52aacf8234a01c

  • SHA256

    b3064b7d985d43ac95233f3139484c93ea15b96d7851f7c560b25948225dd5ce

  • SHA512

    073e088817ffc5391108a7699081d2e31b41902bc70cad7346873db60152b40326cd6e827af70dd53315890e5dd83c84d65b297755a44485fb05d56d8b2b0d5b

  • SSDEEP

    6144:Kba8SfiircLRB/c1BALaHd1LRBXrAkSc5C8SkH8OHNDZIlu0kxtWdks:KZZiT1G/kSc5Cw8OtDZI40krs

Score
10/10
discoveryevasionpersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 18 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 9 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 9 IoCs
    evasion
  • Windows security bypass 2 TTPs 27 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 18 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 16 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Windows security modification 2 TTPs 36 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 45 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 36 IoCs
  • Drops file in Windows directory 35 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\b3064b7d985d43ac95233f3139484c93ea15b96d7851f7c560b25948225dd5ceN.exe
    "C:\Users\Admin\AppData\Local\Temp\b3064b7d985d43ac95233f3139484c93ea15b96d7851f7c560b25948225dd5ceN.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Windows security bypass
    • Disables RegEdit via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Windows security modification
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2524
    • C:\WINDOWS\SysWOW64\shutdown.exe
      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2992
    • C:\Windows\Black Hole.exe
      "C:\Windows\Black Hole.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Windows security modification
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1200
      • C:\WINDOWS\SysWOW64\shutdown.exe
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2584
    • C:\Windows\SysWOW64\Lubang Hitam.exe
      "C:\Windows\system32\Lubang Hitam.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Windows security modification
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2156
      • C:\WINDOWS\SysWOW64\shutdown.exe
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1144
      • C:\Windows\Black Hole.exe
        "C:\Windows\Black Hole.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Modifies system executable filetype association
        • Windows security modification
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2484
        • C:\WINDOWS\SysWOW64\shutdown.exe
          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1704
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Windows security modification
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2960
      • C:\WINDOWS\SysWOW64\shutdown.exe
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1972
      • C:\Windows\Black Hole.exe
        "C:\Windows\Black Hole.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1956
        • C:\WINDOWS\SysWOW64\shutdown.exe
          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2668
      • C:\Windows\SysWOW64\Lubang Hitam.exe
        "C:\Windows\system32\Lubang Hitam.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2676
        • C:\WINDOWS\SysWOW64\shutdown.exe
          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2708
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Windows security modification
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2416
      • C:\WINDOWS\SysWOW64\shutdown.exe
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:536
      • C:\Windows\Black Hole.exe
        "C:\Windows\Black Hole.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2244
        • C:\WINDOWS\SysWOW64\shutdown.exe
          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2700
      • C:\Windows\SysWOW64\Lubang Hitam.exe
        "C:\Windows\system32\Lubang Hitam.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1460
        • C:\WINDOWS\SysWOW64\shutdown.exe
          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2812
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Windows security modification
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1936
      • C:\WINDOWS\SysWOW64\shutdown.exe
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2916
      • C:\Windows\Black Hole.exe
        "C:\Windows\Black Hole.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2656
        • C:\WINDOWS\SysWOW64\shutdown.exe
          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2736
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Windows security modification
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2272
      • C:\WINDOWS\SysWOW64\shutdown.exe
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:112
      • C:\Windows\Black Hole.exe
        "C:\Windows\Black Hole.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1676
        • C:\WINDOWS\SysWOW64\shutdown.exe
          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2868
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Windows security modification
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:676
      • C:\WINDOWS\SysWOW64\shutdown.exe
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1104
      • C:\Windows\Black Hole.exe
        "C:\Windows\Black Hole.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2624
        • C:\WINDOWS\SysWOW64\shutdown.exe
          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

8
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Black Hole.exe
    Filesize

    440KB

    MD5

    6ccc87ca25005ac3733631da8bbb491c

    SHA1

    dca739322c5bff1f233b44d365272747681ded8f

    SHA256

    56ec808e9603da8b5b1f4d9f8f3123d345161b641a6c3ef91271903eb6fa45fd

    SHA512

    492541d7954319303fefac7d8a94ab113da59bd98a7a8a9960ea0f41b862e0f3ae17a7ea441a3df00e8d90f57490614f42148b7f3d714b5d659fdf237824c2a2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\1126202412526.bmp
    Filesize

    2.6MB

    MD5

    33d83c1f59622ad9aa5ffbb5906554f0

    SHA1

    5cc56f17adbd0f10c61aee85264496943c33ba5b

    SHA256

    c2f16aeceee0f1429264d7633f4d87208f022730428a5ddb2fa512a033fbf73e

    SHA512

    e421464139687d60f910b7263a9d41dc207072d00f67cede504d359cebe80e703dd6d8c249f96d3b8271006f0bdcbffabffc7ff6ad67c046298381e5f99d7a9c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\1126202412535.bmp
    Filesize

    2.6MB

    MD5

    77b206eb828b146fe7bc038b70fd6f6e

    SHA1

    971569b4b1aee926debfd10928dfdd4aa379d603

    SHA256

    2184badfee75367a375544d1998de92ce29ae9db00ea1ebeffc77fa8293f0d3c

    SHA512

    d7818e9cb5efce429ffe7bff67d4452ad05e7e1db4fdf649c050e1df2a2d0499c0d6a8884c241c5e16929ff831f7b1344e99269c930edb337be029a424d0ac79

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif
    Filesize

    440KB

    MD5

    d7c7220a7d75e04d2b80b90296f66e27

    SHA1

    834e708e66b76edfa10c02e45dc5fe7537e99aca

    SHA256

    7d24c2a690383eac1d4e74d165e5d312257f4310c0d56c324d83bf54b5ee6ede

    SHA512

    0322e83d5e7742951758dac9ec45d50426ddef35490bf711d57d9e90f0adb938d274c74eba2c47756cdf0b51f9f4ae4d0699f4b81bdfcf215ab729085f69d16a

    Download Submit

  • C:\WINDOWS\Black Hole.txt
    Filesize

    1KB

    MD5

    6635e047c242e6d64b2716d81095bf5f

    SHA1

    5def5300f894e58bbb0caaa94680f7735ccd248d

    SHA256

    9757b4f406657c44fcbd40757d1ae06e833a8e1542ca976e6ae63578031b32bf

    SHA512

    c9bae9bf090e7c67fac53d061bb43c2091e991c8f568889463d0c1af8f48652c79c51785c0906705098b418b2d7a4b200580fb44091ecf8bf24d8b1b45a258c0

    Download Submit

  • C:\WINDOWS\Hacked By Gerry.txt
    Filesize

    1KB

    MD5

    e067dafcbe64a95f5045a281397732db

    SHA1

    1af7095f98c486ca247449980000d06b04ffc50c

    SHA256

    b6085ee8c1f2de574973b9f3a7417257e25573c2b5228b5a8f87e3788e2733b6

    SHA512

    1b575d62fee219538f8d624ab833cbce0aee431559a0adfa1e3ce9cd4f5ab8a2887b394843ebf164c884ccbed5687d644474328471b23c28edba8f99ccf08b58

    Download Submit

  • C:\Windows\Black Hole.exe
    Filesize

    440KB

    MD5

    5c770c8ed3ec8803999b46f39de461e1

    SHA1

    d5a3bb36b19ff15c62aabd08d5b41edc36e5df56

    SHA256

    f1f4e0cedeaa482e08776e7cc7cd2688c644165bdace1d21cca72caa0b70d365

    SHA512

    8e8781483a78df3f8c6cbb90d8e0a431f555f6db92bbaed81f86334647fb72fd767b870acb5508e5b7fe7045b4c0104c47c77254c2797ac05b1c159c9a3df371

    Download Submit

  • C:\Windows\Black Hole.exe
    Filesize

    440KB

    MD5

    57cdac04e2173532c0da27d5eedc7696

    SHA1

    467ea92ed73eae27dd6804367880e30fd0a1707f

    SHA256

    3a5a135567133de5b072c25f77692faeae2882f8b278064ba30b138b7fd72c14

    SHA512

    a19833a2978825145fa5c676b1a00b416a22849a4bd68d2d9ed23313eaa3feb7238b96a8d4848b58f4652cc03dca978cc454fbfc1a1b2335cdab9f25bd4da40e

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\Destruction.scr
    Filesize

    440KB

    MD5

    753ee33ee2ea0de32472e90bfdb99f69

    SHA1

    efe70a9b21bf17f77ceec090969cab368740aeda

    SHA256

    e2a879b71802d54a059c5cb6609088ac488beda42dbd52427c429590d397a6aa

    SHA512

    a94e9eefef9d28a070c1e6ed9e9b5cda08ea6639754842386e77ee691a3220b24ed532f8b466fef1cf2be2419fb5b23a38f333af5ca3b187dae94c395d9443f4

    Download Submit

  • C:\Windows\SysWOW64\Lubang Hitam.exe
    Filesize

    440KB

    MD5

    e12692f81e2dc5fcf33913cb764cd2f0

    SHA1

    d063cc9c3e075df64b575d22ca52aacf8234a01c

    SHA256

    b3064b7d985d43ac95233f3139484c93ea15b96d7851f7c560b25948225dd5ce

    SHA512

    073e088817ffc5391108a7699081d2e31b41902bc70cad7346873db60152b40326cd6e827af70dd53315890e5dd83c84d65b297755a44485fb05d56d8b2b0d5b

    Download Submit

  • F:\Autorun.inf
    Filesize

    93B

    MD5

    4809daf962803cad2b891b94c195d3dd

    SHA1

    707bdd28edcf5e9e288959f62d4da8823777ec12

    SHA256

    3468667630714eb86464ecfe903b59a843670ade55b49ac9d653421b91bcf139

    SHA512

    c9c233b22a853ce17731cb3466f7e8234da4e3de0dec6cc48ed15232303d4f29c49770e20a7064ad9329f8d9d27f8d4b547443d837320f58ac230973bb7dd11f

    Download Submit

  • F:\Read Me.txt
    Filesize

    3KB

    MD5

    5c462f1ea2917c0b502ae0761c0f60d8

    SHA1

    c1d15b093b2843528544d77dc0d9d4e3b8a85297

    SHA256

    09c76898e4fa4174c53c2ad514274b5d2ca636ec6f223be5fda4c6135ec4ac10

    SHA512

    e6219ccbabe77a4999ade79c7074753495da9c61d6451c53be34219cc19746ca9a0dadef3b47cd8859cd59604064af5e9fc2a5044780bcfebaaa13dc08c36bbc

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
    Filesize

    440KB

    MD5

    39b4f47dc2e216f6dddc3d3c130548a9

    SHA1

    bd60a7acf5fe2f2c542b6af57e7210dd190ecc53

    SHA256

    323fc25b6448d47d3534a1a002b489e1fe40be580acb317b5b59046633489139

    SHA512

    ec9709776328c85d5c87c56d86d332bfc708f290f84586aeaf369b5f22daaae19b90fcfa45fc7b77c315799fef166816448eea28238fc53dadad642aecb394be

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
    Filesize

    440KB

    MD5

    190a82bf0a348b971deceeb9288c8eba

    SHA1

    08e3be439b92cac8489dc1efa57a642d2b4437bd

    SHA256

    c3d1e37778fdb3f3807d9bf992e86e980444bcbb1ebc1337e5b0aaa1f788ada0

    SHA512

    d8a5473ab7f4f0af393e89b67df50385ded8dfa293614ffaf7d6486121b0ec118fc1da70622718e2b3fa1c928cd6e1f1875a519db05b518f06d151acb8c545ed

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
    Filesize

    440KB

    MD5

    ab9917aaa8df007247cd341fec4c32d4

    SHA1

    b034838c18cd12bb1b565452ee14af48254ac4fc

    SHA256

    151bb23bafadf37448a571c473cd70a631c329365cf8dc9a02aae5eb16d8c1c0

    SHA512

    73ec6684f222b4138d7e3014046d7cc658e2b2ee00a251b89cfcc53574c56992a63228c1de706a179f6f5cc79fdb4b9c0306977a46564029cfa500c714640f27

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
    Filesize

    440KB

    MD5

    544044413dbb26629d7865b99115b1b8

    SHA1

    c5b991f889787f68187b9c27a9ec54ce75bb7a7c

    SHA256

    47fa8c97b62d0aa9d92c4e55d5984bda203365ec0ec8af382411db6125a55b35

    SHA512

    68a61187d672e9846731b129bf06da6f5f61c755fc89ad0c0c539961456a43705bcde3e082378eaf926419214a973d18a1da862b50fa09add62098385c7cc7f1

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
    Filesize

    440KB

    MD5

    e251eabb29aff37dfdc216a048faec7e

    SHA1

    523cb6ada2b1f7fce5c886179e4ff268b5196f39

    SHA256

    218af1a1c13cf60894d4f753e91e4b7e0d3ce4b051e277930d5d161a71d77a43

    SHA512

    753ace20d0882526b29039e5d5271705ef4a47efc93f156077ae4eee2d08c6e400387dab00534f1947bbf3ff2a72d2b2279f6ccaec1f6ba1aed0d2e63f4e79e6

    Download Submit

  • \Windows\SysWOW64\Lubang Hitam.exe
    Filesize

    440KB

    MD5

    dc3b4e59003b1a4a108778ef2995a236

    SHA1

    fed9df98fcc2f033204acc969ee3652050951b0d

    SHA256

    b5ecd23bb8cae9e38937fe085e158b83beec657955d2801d647d1869cdc26852

    SHA512

    30fb563b75c6bd0a03565ebfbebb9f4e211dce906617b347d28960575340f4762e6870d8fed666a446d42676ce565f1eb8d180346945cc31365d27b1df8a5d11

    Download Submit

  • memory/676-697-0x00000000031B0000-0x000000000321E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/676-825-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/676-147-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/1200-70-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/1200-89-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/1460-862-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/1676-864-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/1676-863-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1936-124-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/1936-766-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/1936-680-0x00000000031A0000-0x000000000320E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/1956-448-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/1956-414-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/1956-447-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2156-383-0x0000000003280000-0x00000000032EE000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2156-662-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2156-382-0x0000000003280000-0x00000000032EE000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2244-765-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2244-764-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2272-700-0x0000000002780000-0x00000000027EE000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2272-138-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2272-807-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2416-711-0x0000000003330000-0x000000000339E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2416-710-0x0000000003330000-0x000000000339E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2416-748-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2484-852-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2484-385-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2484-851-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2524-101-0x0000000000680000-0x00000000006EE000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2524-141-0x0000000000680000-0x00000000006EE000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2524-106-0x0000000000680000-0x00000000006EE000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2524-122-0x0000000000680000-0x00000000006EE000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2524-935-0x0000000000680000-0x00000000006EE000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2524-920-0x0000000000680000-0x00000000006EE000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2524-0-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2524-130-0x0000000000680000-0x00000000006EE000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2524-917-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2524-71-0x0000000000680000-0x00000000006EE000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2524-68-0x0000000000680000-0x00000000006EE000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2524-83-0x0000000000680000-0x00000000006EE000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2524-96-0x0000000000680000-0x00000000006EE000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2624-856-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2624-857-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2656-859-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2656-860-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2676-855-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2960-732-0x0000000000400000-0x000000000046E000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2960-446-0x0000000002760000-0x00000000027CE000-memory.dmp

    Filesize

    440KB

    Download

  • memory/2960-445-0x0000000002760000-0x00000000027CE000-memory.dmp

    Filesize

    440KB

    Download