Overview

overview

10

Static

static

3

e76056c0c5...b3.exe

windows7-x64

10

e76056c0c5...b3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30-11-2024 05:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e76056c0c55be08312dd90e1d010737c8e5be0f76a5a6fc065ec992ddbe94db3.exe

  • Size

    64KB

  • MD5

    4e0cf4ae6d67a0f7544148bc3a10deaa

  • SHA1

    97a5175e1b4e11dd7248132be773eb1fb4de6477

  • SHA256

    e76056c0c55be08312dd90e1d010737c8e5be0f76a5a6fc065ec992ddbe94db3

  • SHA512

    718679ac586f512de52079edb16d3a7619a3a8e31e2c0d8d8bee3fca743fa77b62a319d1b4237019ec850b47508e3d93a7135c15333205b27df16d38ae12df4d

  • SSDEEP

    768:VNuG777/+V36n9PcXYvn8KR1I3NznRAQZlh4VkpX179r+R5TOwekflNuG777/+VG:V8w2VS9Eovn8KRgWmhZpX1Q6wJ8w2VG

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\e76056c0c55be08312dd90e1d010737c8e5be0f76a5a6fc065ec992ddbe94db3.exe
    "C:\Users\Admin\AppData\Local\Temp\e76056c0c55be08312dd90e1d010737c8e5be0f76a5a6fc065ec992ddbe94db3.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2380
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2552
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2024
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1796
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2452
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2204
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1056
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3012
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:772
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3040
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1932
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2824
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2068
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2764
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2968
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2636
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2704
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2820
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2508
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2908
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3024
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1680
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2972
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2948
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1472
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:780
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1612
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1232
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2924
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:840
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1952
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2992
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2904
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2916
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2880
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    e9657a4383c1d7545a7ec9b93c098ccb

    SHA1

    7c8bbcbc5ff4de3001b3e42bd2fca9aed34e79a5

    SHA256

    1b33f73c8b5bb7d0191c11b422fab79510ffcca59d3e285d4a0cc5343de0c863

    SHA512

    97264da83973116d1ba124cf3201e74be6b886f76a97292ae7546525d67443dd993219b4c34028088fe24899005e7e6a305b81934402edf6bc821df4a290f596

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    64KB

    MD5

    c2718686d85efc135e8a873af259bf1f

    SHA1

    f9a53f49eb1f3e9f63e6ade1e41c97b86d8cbd2c

    SHA256

    33d58c03c26b6d41a6d38169b920485517467dfb8d5a55c0d19be7bbdeadf43d

    SHA512

    3d12bbfa30dea4d5453dab32744beeb3d8ddd46c73bb472931b353836e2fc897f1cdaf914d5e40bd47d4612a3b13a1a94e0bfdd984ed6981ff7dccdd7948aa48

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    64KB

    MD5

    cb5d7eff4114ee5a9a177a43c350d87f

    SHA1

    eee85c8ac59c5abe6816c93bf21e74a2433b2487

    SHA256

    b1983f79f6a466f3af0f3205364a14dc2d89ba84c14ab6fafeddd6111bd37b95

    SHA512

    17d46de58ca9c1a41a5757aab94c3ca9ff93670cbd5ea303dbfe71292f48d546bec447cb4c232d516bdd60c1df57fc3c8d0fa1dd8fea6c951c4352981a4d534a

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    64KB

    MD5

    37c5c83ff11b2af6bc0f8c6c33b6c19f

    SHA1

    830d21f036b82f317d7ebb38722cd0d0b3bd6f6d

    SHA256

    2622abd7149789772a7156bf3195ac6952f4978e95852f58bd825e5e8594bddc

    SHA512

    da1830d3a69cb0fb69cc2e43ec5304881145ecbfd8884d5bb68662bcf78ac6248835ca8532dd4641342a7aeb2761e9c89579e39c9e74e127172ce7645c6fabec

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    64KB

    MD5

    2509ad230b4c497d931b7ac44985322c

    SHA1

    325ba784e228a6c4c8290bbf9813a214093abdc9

    SHA256

    aa2bbd08d5bfd3a29de21ee0d3881f0400e74a54a19ac01ebc2317d6bd35f999

    SHA512

    92f2f146178d4c2eddfa4dcf4fad24af202d7836b577ed80636c4d3d5337a5a042a4aa46e0ed6fb4853d399ad731bf19b563ee3dc81063363a4594f68d510dbc

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    64KB

    MD5

    8147b3e394c23e7b6dad4ba4ed9f07f3

    SHA1

    6eccfecede806f2c01c19d845a423b8f1cc0c5bf

    SHA256

    504e823328dcfce2c6d07b16ab84d7d5a819259a2609ff796ebcaf42dcb77aed

    SHA512

    abc884ea40dcf064e6ee08daf370758ef41e0ca0f89cb3b76de4be93246e45559825b214d886fed2de9e0c31d8ea4417dcbf22113741131694da128d6cf0743c

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    e6f3041208d555cab9d8e4f9d186caf8

    SHA1

    6b8c04855e11bbcd6be283b6ff0816f6883fbaed

    SHA256

    e52ffa75c1a12c666d81ee2d50452a263bf62ccb23600bbc31ef0ee35b60b761

    SHA512

    6ff6282b1817465d5c06b68f2a0b0fb07cb0dc6afffd36cea1b1c3cd98f3d93e9478b2ce25ae79ff992e56bed39a136a211be01e72b257b6d557ebc4a022ad37

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    5e7ac2dc92e9ae10ddeaa44454d551a3

    SHA1

    a1ac992383b9c610e60d51a9e3fcefb68dbb752d

    SHA256

    27254fb828cadbb442c659680121fec16df55bd461554c2307d2df4e4bba35c1

    SHA512

    31165905c483d51cb0bd6564567d6241404f6f29ab4875db36a9365c5d5f4660b7f5965ab100c61cdb1b38d3a4ec136d2319beab0a008a2ccc3217e0e675841c

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    0bb3cd22fb3132c045b3bf8539b8b2eb

    SHA1

    b1942af0f0004124a2b5b82e97c5ae27f1c61e32

    SHA256

    cb31bec3f805ed6ec69a347a577f29250098cee57a1ad09a7570ba30d84543e3

    SHA512

    e9ad87176b21a2dcbdb07c0e9036ea6d702654dd26d70dbe2436301ee64e4ce274d63797c81b562d62920d00426225d6a91f5ff6cb418360236b245c986bef1c

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    64KB

    MD5

    5e27b7888ea08daaaa5f1758c588ee71

    SHA1

    e59d9058797f474a575d0b3dc101c5e38ebf231c

    SHA256

    86acdb91c368f5cb04a8bae5b3d4ffe79d449c5ce48d217492e8712579c36953

    SHA512

    6e825e6db8dfcce15ac6a2d53de701b7af2d8f2f6910a9f79dccbfa9239eca7ac7026203153c584bfd55fdacfeb99771e117c0d6b344d404732402a8f32b1711

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    64KB

    MD5

    d112c4ae28d06358866dac27f184e2a0

    SHA1

    ad20afa0018582016b028212505a3520d77a5637

    SHA256

    2ae96d5819974befe6666e31b23c0a7c4909061753bbfdb6abcab4b275bd58c0

    SHA512

    18bdcc1d627a7b426e6c840c053650799547808baca92ce74d32954c65b73f247c42ef0110da966549fc682a264af63b82d6257a4f5def8046c0d8b170b94ba3

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    64KB

    MD5

    083628c8201b58bf507997fa9df7d9f6

    SHA1

    99d2c3b868b58436016a02953057617af7a9979c

    SHA256

    c5eb86fa16e8a7483187810ea79131cbbfa39ff82cee328e24f3052a897575fe

    SHA512

    2d039201a1be82f55ca37b04180ce79ba3203dea29dfe2b7eba8a20922575528b57cd9b194f93adb65a70025d8812bb0bb897935b03cd72cb1dca387f4b53cdf

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    64KB

    MD5

    d56bb6c6bbadbb90387c42128475f42a

    SHA1

    3caa53ea8528162738c433a610d2c2012efd6f9a

    SHA256

    f5371fa816e07e7491045a69a37e6f149c99219554b4fc894f9d8949a14523bd

    SHA512

    ba7ccde0bd864acc9bb818e5334ae54b595a83bbbcef1bd140ceb6994011f29f3eb2b769f14ee422ef2945f1934133369f378beb6b934b8b4b84f9f610620716

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    64KB

    MD5

    4e0cf4ae6d67a0f7544148bc3a10deaa

    SHA1

    97a5175e1b4e11dd7248132be773eb1fb4de6477

    SHA256

    e76056c0c55be08312dd90e1d010737c8e5be0f76a5a6fc065ec992ddbe94db3

    SHA512

    718679ac586f512de52079edb16d3a7619a3a8e31e2c0d8d8bee3fca743fa77b62a319d1b4237019ec850b47508e3d93a7135c15333205b27df16d38ae12df4d

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    64KB

    MD5

    9daf07328762cfe61d174ea430ea9d45

    SHA1

    0b0551861cd41bd2d24d1503c33450a13df753c4

    SHA256

    43a0c23e6aa6b5fcafdf86f9ecc17f3cc6c5043acb49977b697604b490b61758

    SHA512

    03073f37fa6c82c57e24ba6cdb5340b8e30c7c68b55f0753b8f1d89df123254e4ad33c43ae19996515e019f2031730ca0f9df60eba79509bc4d6c3a289c0a5bc

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    64KB

    MD5

    3b0c56a51f6a115976582aac9f20432a

    SHA1

    a1f75403454f14baa0b06d94b352a03d551fa828

    SHA256

    d496241476fea40b364c1a79b73b66617a5689ef915ce9a0cd94ac8cf029c0b7

    SHA512

    95afef8115f6de5eb09ac0c13a78fbc894dd463a5af07deedca2da3ca13042fca2371eb4abebf8bde2598e66b4645642428fc91a5ce5c4fba272b523f26f17ba

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    64KB

    MD5

    323a46e727868c492beed95ae121a1a6

    SHA1

    0f8501e06225adb19661314290c0af1a99fa4879

    SHA256

    62a7ff4906c8d2fbe0f589cad000ec01ed4f5fb4d30de503fe6db856d44e971e

    SHA512

    7e978d8389758ff2ea705b2ac17d17143bc3b47661f25eaaf1b16573e6d1752403a965247ba65a57e8c6006674f6775ed57cb86d35327f328f26b8c6350eae6e

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    64KB

    MD5

    18eb5541f1bb36fddb9896ab1209441e

    SHA1

    988023a07de13d3b4c828e00d4b9bb96e76737d3

    SHA256

    a968549bbd76bcfa7f3ac601cfa4f14bd45554f245aad58fb14cae2a5c4c397e

    SHA512

    553cc89c84c52ee047c90f55145f5f29dec806f602427ff864353dcc295b707e49a583d54c2af7404941b73779cd902f1adbdcf19b23b11e27ac0bc621a10164

    Download Submit

  • C:\tiwi.exe
    Filesize

    64KB

    MD5

    dfe094df805957aa4831a74cf83992ed

    SHA1

    e4fad8633c818d7cca9e0ae0a1a0caed4ca91631

    SHA256

    7e17f10f4c76f75ad4f5011b43987aafe6d243bad02107ffdcbf6776eaeac360

    SHA512

    51d1119649f3dff2b35fb7c560ecc27c3d9b3021dd785b0ab4ac3b24043913d09e064816ded82bc5d62798a32bd516c9100e510fdd7def5eebcb22e3029ccf4d

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\imoet.exe
    Filesize

    64KB

    MD5

    901b36a70ad36d999d00246e30350731

    SHA1

    133a7f9c8404651f30924500c7748c167d4a006f

    SHA256

    937117aaa6b8775b47086173be4ff3541c7687932d6a4969ca48d77ecca13301

    SHA512

    fb7b099eea8df1c5d2b904accd2dc211926f9fb11013f5deaa8cf814ec1ce6b75ca3a423470f2b13852ce0a84f5015a538269f4da2323beb876c2c0b864c82ab

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\winlogon.exe
    Filesize

    64KB

    MD5

    6a76a0389a4dc69c168270941980b936

    SHA1

    743f1ce57466c6bc4b69c9fb69b653a65a7ee9e8

    SHA256

    2318afee3955b19135129fdbcebfc1bc2e25a4769feb9aea2f6ca302ff5f4194

    SHA512

    8621ce0339e465183481b4075e0eb4829ed77f7fdf55489f72708b6b52e0d403124ebf09fe76e2d6f992cccd533528b00c9805099a9fdaa1cf846d48f20c90ae

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    64KB

    MD5

    c341fb7e2bd7b5b50032bff5e9822672

    SHA1

    53aa20b2ce4e8cc62d8b003af22d1c5baa086888

    SHA256

    fdc9aac4977367d87250dc42ae4629cb9b0686e45209650cba7210e2b8ebcbc4

    SHA512

    0d3e30be66f11f075edfea7bd1a24d64c4ed28b0013a2ff9215725c4c6d808a7d0f58d268e2e4c35240730363333a7f57be4ffbb9fed789c425c622240c366e2

    Download Submit

  • memory/772-337-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/780-445-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/780-446-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/840-444-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1056-371-0x00000000003B0000-0x00000000003C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1056-370-0x00000000003B0000-0x00000000003C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1596-410-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1596-409-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2024-236-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2024-220-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2024-237-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2380-440-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2380-175-0x00000000039E0000-0x0000000003FDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2380-124-0x00000000038E0000-0x0000000003EDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2380-111-0x00000000038E0000-0x0000000003EDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2380-340-0x00000000038E0000-0x0000000003EDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2380-98-0x00000000038E0000-0x0000000003EDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2380-110-0x00000000038E0000-0x0000000003EDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2380-100-0x00000000038E0000-0x0000000003EDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2380-226-0x00000000038E0000-0x0000000003EDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2380-219-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2380-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2380-125-0x00000000038E0000-0x0000000003EDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2380-230-0x00000000039E0000-0x0000000003FDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2552-99-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2552-227-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2764-126-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2764-459-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2908-228-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2908-176-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2908-229-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2948-413-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2948-411-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2968-345-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3012-112-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3012-414-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3024-282-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3024-231-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download