Overview

overview

10

Static

static

3

b283a03560...b8.exe

windows7-x64

10

b283a03560...b8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-01-2025 09:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b283a03560d69a54742c2b78e27727f91a13e4c4c26b4054b7020cacfa0900b8.exe

  • Size

    56KB

  • MD5

    01fce7d77edd9cb87d7eda278c91f36c

  • SHA1

    2f79a23eb9f5a67119cc15584642937fa2d83e18

  • SHA256

    b283a03560d69a54742c2b78e27727f91a13e4c4c26b4054b7020cacfa0900b8

  • SHA512

    3d9f81030dad3bbfc79c10a2610cc73c964719693ea492eb71d4ef04b7d52d1b83569e1b69356a1107708af55044576dcf61098833ea875a95ad90e3ab04a6b4

  • SSDEEP

    768:VNuG777/+V36n9PcXYvn8KR1I3NznRAQZlh4VkpX179r+R5GOwekff:V8w2VS9Eovn8KRgWmhZpX1Qvwj

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables cmd.exe use via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 53 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 18 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 40 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 54 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of SetWindowsHookEx 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\b283a03560d69a54742c2b78e27727f91a13e4c4c26b4054b7020cacfa0900b8.exe
    "C:\Users\Admin\AppData\Local\Temp\b283a03560d69a54742c2b78e27727f91a13e4c4c26b4054b7020cacfa0900b8.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Disables cmd.exe use via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3020
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2612
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2952
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2444
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2344
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2288
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2812
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:784
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:296
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:536
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:372
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2772
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2640
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1740
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2168
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2432
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Disables RegEdit via registry modification
        • Disables cmd.exe use via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:1860
        • C:\Windows\Tiwi.exe
          C:\Windows\Tiwi.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1676
        • C:\Windows\SysWOW64\IExplorer.exe
          C:\Windows\system32\IExplorer.exe
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1804
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1724
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1980
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:592
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3056
      • C:\Windows\Tiwi.exe
        C:\Windows\Tiwi.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:860
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1728
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1844
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3024
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2856
    • C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1652
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1052
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2816
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1996
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2096
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2760
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2780
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    c12211931123dc86c7e580f915e9c3a9

    SHA1

    654cc5038247bb672a5ccb7f87ec91be36c3d1d6

    SHA256

    ade20c8a8b0ae23079bc1601ea1d2d45e59ae34020901ee6dbf9a983d595df7a

    SHA512

    3d4d3c0670d36a727eac5790a79c34868d4a9565b15feaca895fe6cce0cb7cc0d8cd5b146f63d73ce264d51d4c0b10c9146ce80c6133faf88a0b43ce0d8de328

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    56KB

    MD5

    feac2c1c90719dcb36877f60f6486fd9

    SHA1

    5c943df1466ec49f0182ed4aa2682a944e9d6511

    SHA256

    c21b91d21ddda7908b1fbfb9b9583e56f3820000b281e124611e5ca303f3576c

    SHA512

    c323fb05b6b020ad813bbcc63bd0db5acc5d62d57f7a385bd3bbbfd8c52a59fec0fb154a0bbb9b00f38424cb7633a585ef5765af98d589867bc1f8d49a42db5d

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    Filesize

    56KB

    MD5

    c694fc6c9b902db284cfd8534169c59e

    SHA1

    5dc084b4d018f53b889797a811f6900b8f7f9e1e

    SHA256

    0faaa12fde6835e14dddbb8a5b624d1cc6a5ab7bab70ac09bb8a9437bbf1a1e3

    SHA512

    6dee99cda6c6d53941faae5fe17196870db229e00eb78f4e3146229ec9a6d1ddca9ae799e29375d604b841f88df4a7dcebe64cb318f29766ffc14db40b75ded9

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    56KB

    MD5

    58e10c281de1c4530d3f92b9f50739f3

    SHA1

    ce5d73a53143c9520c1719ba50822987728e8ce4

    SHA256

    23299859f3d8833176d4c4dc4b8fbc163f88fb03f14b9811d0a96b2b88d52227

    SHA512

    6b2d496ee469cab884863684eee6579db87c60c32ffd81cd63e59b439699914846e7b8be68ce82fbd6dfc5cd86e76374f6ea21c489ba351f86067afbe58ece2a

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    Filesize

    56KB

    MD5

    8e38567cb18592631c6c9232d59da58c

    SHA1

    3abd378639ff19cebf58e5ff3620be030e8b4420

    SHA256

    e129fb3e6abb8ac8b1850ea97bebdb957177af3365fd99c21ddb2485560c5077

    SHA512

    6dbe6a1e55961f9cee8ab3439bf1dda58ff2c3f3dafe9f48f02fc95d5b6326576b7d054b84f255173a296dbae62d4f3fbdb21b35235f9733b73c701668f95199

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    0bdb59a8166ad09713cb359f6aebeb92

    SHA1

    e39ce13583f80070c051a8d4aa8994a8ce390bba

    SHA256

    855c5974a0f351ed5d013e762fe8b8871316455bdbd4b872456d4232b6262906

    SHA512

    67aec60841753f2fa4c9e5b5ca9b58976a6e1cad009ee8fce26f93885f44a72ecce5629866b77f3d10b99da20064b8b65b9a15fb3949aad406fc469592b9181f

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe
    Filesize

    45KB

    MD5

    a29b95e1a7673ad758f2793e8bb2cd47

    SHA1

    8e81840c840d7cf244bf7cfd39a4593771ce9556

    SHA256

    d137f7cec9a83d1b667962d332d8706b503c706e911e384e1ff50ad69113e735

    SHA512

    01b1f4f5b46c583eac7e6a3c45d16532393f1bb496f2afb045f53bbf6a1392944491f1a4a596aaf5fae5545039b692fb9a69a875a026ede318739138982c84b7

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    56KB

    MD5

    777ed30b703cc8abeb3c4231bdb6d9c9

    SHA1

    08061b57dc3122fc2ee1633f0be4fbdbdc44cbda

    SHA256

    ddaef05a711b120f41e6b963ca2a70409d05f952c4c5450b940d13ab5ed0e17f

    SHA512

    f0295088d4965c46c43328907852cad28308e1a830ae9f3f09964eeccc27c18b66840fa03b04dab1a39d22cc99900bb326c93c9a1a7f4307ef0038775c8f5819

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    Filesize

    56KB

    MD5

    4482f69dbd262a217fb9e78ca77f824a

    SHA1

    d93be51c2fecf63358a76513192fb194e296d55f

    SHA256

    ceeff24ce2ce489cad5b50020654af3571dc9fc09f7a51f26913dd905dd6bd5f

    SHA512

    f50ea3710789ce307d93aff116ff1edca6159e6008dd6258f989bb8d99abf7a75995ac8ab4bc6cb39cde1e02b6ec4cb7e58f685960cd65f42b1ad3c40caf5c6c

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    56KB

    MD5

    6d16161d14c7e314fd37f6e875a75ca7

    SHA1

    452dc7d652f553e583fc302aaf2f65cf80122ea9

    SHA256

    dbaa599bd5f42cbcbfadd29174107cb44968e9f9dbcae26d03258f3cc0995b78

    SHA512

    7ad8f3613a51beb979b15c211bbeb6b0d8d3dcac30de898d0c56acc4cd798940951b2c47789cede8b147919048ee3a7c4306ab82ef69c755accbc89e1246b892

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    56KB

    MD5

    ff987f51c48808a96e888cde8bfa1bfb

    SHA1

    2ffe1fc9fb3663e60e4f5f2086b09594f7ef85ee

    SHA256

    6ac8f56cd9d242294b5ccf382f30cea11c2d8803b562226a0fb277c61f68b253

    SHA512

    b3d6df00d166cadf0a8823490b01455bfb3bcc798ebe4f564bcc88783fb6822bb3a518249285249f60d783c41f6a16a845a6e09345e830653f7c2e7d4c6b80e5

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\IExplorer.exe
    Filesize

    56KB

    MD5

    2aee59ec684aaf81fd2a6d489f315b0f

    SHA1

    9fd6945f747287e92def8a20ecfc0ce12e94d3de

    SHA256

    669d3aa4620a21e9860460a76ae5df005d61d29001abcccce3106915cc87e285

    SHA512

    1380db469ca21c249da194247d562ba1d865c81531b72a9ced80f5a86b4328b815c502ccfad405da50f3f9af24726d80bbb5a69534ca62a1da640f3b4092d464

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    56KB

    MD5

    2f62227bf8c12b650861e9f159e9cbaa

    SHA1

    ee35afa291145f15effa471aa78804149104d946

    SHA256

    d8bad07dce2d4cf31d2b84f7372c922910a822ac3d991deb023f966a3b2715a0

    SHA512

    914af745da80b276c67e2c5c06f1de4137a10eb50b365a1671f690e74972a534c7bed55b205618b88a16300781fdf38b7cc8c9149b451b094298934f65180536

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    56KB

    MD5

    c71c4f1ada77624e0df3e2265d6deae0

    SHA1

    3519a32e3c3018707316dba9b2a46a020110a65a

    SHA256

    45ac9165a04f4f842b97b26e2dab6ee5d270d12aea444d63ef3f8fc6f7492e7e

    SHA512

    d506acd67de52ca5e83dd21a13e4ea3a4b92bf780a60729f70039f2dd4162a3f088168aa72b40046da87492c38cdd2a3528f972ef8ce468c2590c9cbcb881b27

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    56KB

    MD5

    01fce7d77edd9cb87d7eda278c91f36c

    SHA1

    2f79a23eb9f5a67119cc15584642937fa2d83e18

    SHA256

    b283a03560d69a54742c2b78e27727f91a13e4c4c26b4054b7020cacfa0900b8

    SHA512

    3d9f81030dad3bbfc79c10a2610cc73c964719693ea492eb71d4ef04b7d52d1b83569e1b69356a1107708af55044576dcf61098833ea875a95ad90e3ab04a6b4

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    56KB

    MD5

    4fcb1c26b404a45ed6cfb189f48fea50

    SHA1

    663391e4aecb4f83df3c9b603422bbeec4f9980c

    SHA256

    05e15902d74646ce81d4d47003f0d145ac76df9dd96d046d6bc5b0ab16193fb3

    SHA512

    7efef694e7d015d7d1a0c70ccb79664b40417485b713e439c031ded84cfe02fe40d68452e52477a6e6d4357aedeea8b7eb2f34de7f386a9c40195c717dcc5c32

    Download Submit

  • C:\Windows\SysWOW64\tiwi.scr
    Filesize

    56KB

    MD5

    ecac598af3e64d66837e97a339bdd71d

    SHA1

    cd38bdce399c778b6aab4c096d43605ceb990fa7

    SHA256

    a252584a300b11d17cd49391205b4862cf0a8404fa6cc3a0beaaf1827f876e25

    SHA512

    3d467a99feb7f8a8c9a8ccce9f69349811edf7d62003c71abb5851713815c83bdb751e758519ca235bfd5c897eada6b67e4a5edf1395a0894e49941c6c3f9071

    Download Submit

  • C:\Windows\tiwi.exe
    Filesize

    56KB

    MD5

    b0b95e8ce22d4e86638921457c903cc1

    SHA1

    b9bb7daa3d2e53a0d14b3415946b254f77813293

    SHA256

    ee600a3170880201638b606f2025fc38eb3d520da08b0a9dba8cc061b6dfde62

    SHA512

    d7264f5ecc5f7138842ddf00651827a430c7a7d2247b7ae7a3f02a9a17625b38de1cac590e5519abab63481598be6bb1157bce9d52ac74331771db6de7adfa48

    Download Submit

  • C:\present.txt
    Filesize

    729B

    MD5

    8e3c734e8dd87d639fb51500d42694b5

    SHA1

    f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

    SHA256

    574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

    SHA512

    06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

    Download Submit

  • C:\tiwi.exe
    Filesize

    56KB

    MD5

    17395eed72bb773668282932c535a48e

    SHA1

    bcf6bf75fade96f66d9b4ca7d2fc8067eb1a58d8

    SHA256

    a1637cde34beb80fcb9bd9ca11e44d28468ae9a33f152b5241d1fa3cfb55a4d2

    SHA512

    9492df22af0ca7092eed3e088be729cfb8b5225510d0cee46e026a13329271b5d6c8689b6e2150cf8d102ea8b685f4d498089437add5aaa630b15113f894142a

    Download Submit

  • C:\tiwi.exe
    Filesize

    56KB

    MD5

    39806a75949aba07dc297719a5f11674

    SHA1

    ccc652458878d44892aed5c3c748fb90932caae7

    SHA256

    8b31ba11ca86aecbda5782868d5737beb8201235ca031fd925955e318863edcf

    SHA512

    aa62b9d0550d35d75c7cd8f16b5e534ee7eeb4d00e77d32a2c217c637429fde6d8cd69fad26bce310aab933054a214b3623f43f02a09b2d00879b4d52b4a2155

    Download Submit

  • F:\autorun.inf
    Filesize

    39B

    MD5

    415c421ba7ae46e77bdee3a681ecc156

    SHA1

    b0db5782b7688716d6fc83f7e650ffe1143201b7

    SHA256

    e6e9c5ea41aaf8b2145701f94289458ef5c8467f8c8a2954caddf8513adcf26e

    SHA512

    dbafe82d3fe0f9cda3fa9131271636381e548da5cc58cd01dd68d50e3795ff9d857143f30db9cd2a0530c06ce1adef4de9a61289e0014843ac7fefcbd31a8f62

    Download Submit

  • memory/860-297-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1052-282-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1052-228-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1652-221-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1652-220-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1652-166-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/1676-422-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1676-421-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1676-423-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1740-426-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2096-332-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2096-333-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2288-414-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2432-442-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2444-281-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2444-276-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2612-275-0x00000000037A0000-0x0000000003D9F000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2612-100-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2612-331-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2772-413-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2952-225-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2952-229-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/2952-213-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3020-273-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3020-165-0x00000000036E0000-0x0000000003CDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3020-111-0x00000000036E0000-0x0000000003CDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3020-222-0x00000000036E0000-0x0000000003CDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3020-110-0x00000000036E0000-0x0000000003CDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3020-99-0x00000000036E0000-0x0000000003CDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3020-98-0x00000000036E0000-0x0000000003CDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3020-219-0x00000000036E0000-0x0000000003CDF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3020-430-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3020-0-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3056-112-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3056-392-0x00000000003E0000-0x00000000009DF000-memory.dmp

    Filesize

    6.0MB

    Download