6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971

Analysis

max time kernel
151s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Size

85KB
MD5

a039294b6e71db573859902b915b9976
SHA1

ce7f0f77d960412040c75f614f1df24e7be1afb3
SHA256

6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971
SHA512

bea65f7ece72e94cabfe4ea07340a7a85ceeaa5ebfb9a71c8a98b1dba1acaa19ff2c760baa849102cb85657690ca327ff6657da28dcd44d9a8594fba9afd67e3
SSDEEP

768:Nh5sxVPFXfgaDjof4ZgHqLNhldu8pGTUTY26TsGrn5wFbUzMsPzB5cXwekfp:NHsxFJfgaDjofVKn1pGwTJOlw1UrAwl

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	cute.exe

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Tiwi.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cute.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	imoet.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 35 IoCs

pid	Process
3264	Tiwi.exe
788	IExplorer.exe
2700	winlogon.exe
2164	Tiwi.exe
1592	IExplorer.exe
3724	winlogon.exe
2720	imoet.exe
1884	Tiwi.exe
544	Tiwi.exe
2836	cute.exe
4192	IExplorer.exe
3964	IExplorer.exe
3144	winlogon.exe
3388	winlogon.exe
1460	imoet.exe
3544	imoet.exe
3856	cute.exe
4948	cute.exe
5080	imoet.exe
4668	Tiwi.exe
1360	cute.exe
5064	IExplorer.exe
1104	winlogon.exe
3176	imoet.exe
4432	Tiwi.exe
796	cute.exe
1476	IExplorer.exe
4356	Tiwi.exe
1672	winlogon.exe
4808	IExplorer.exe
912	imoet.exe
3404	winlogon.exe
4540	cute.exe
4412	imoet.exe
1148	cute.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5044-134-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0002000000022df0-136.dat	upx
behavioral2/files/0x0002000000022df0-137.dat	upx
behavioral2/files/0x0002000000022df4-142.dat	upx
behavioral2/files/0x0002000000022df4-141.dat	upx
behavioral2/files/0x0003000000022df6-146.dat	upx
behavioral2/files/0x0003000000022df6-147.dat	upx
behavioral2/files/0x0002000000022df0-151.dat	upx
behavioral2/memory/3264-156-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/788-157-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/2700-159-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/2164-160-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0002000000022df4-161.dat	upx
behavioral2/memory/1592-164-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0003000000022df6-166.dat	upx
behavioral2/files/0x0002000000022df8-169.dat	upx
behavioral2/memory/3724-170-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0002000000022df7-171.dat	upx
behavioral2/files/0x0002000000022df3-177.dat	upx
behavioral2/files/0x0002000000022df2-176.dat	upx
behavioral2/files/0x0002000000022df1-175.dat	upx
behavioral2/files/0x0002000000022df3-180.dat	upx
behavioral2/files/0x0002000000022df2-179.dat	upx
behavioral2/files/0x0002000000022df1-178.dat	upx
behavioral2/files/0x0002000000022df7-174.dat	upx
behavioral2/files/0x0002000000022dfa-173.dat	upx
behavioral2/files/0x0002000000022df5-181.dat	upx
behavioral2/files/0x0002000000022df8-182.dat	upx
behavioral2/files/0x0002000000022dfa-183.dat	upx
behavioral2/files/0x0002000000022df1-184.dat	upx
behavioral2/files/0x0002000000022df2-185.dat	upx
behavioral2/files/0x0002000000022df3-186.dat	upx
behavioral2/files/0x0002000000022df5-187.dat	upx
behavioral2/files/0x0002000000022df5-188.dat	upx
behavioral2/files/0x0002000000022df8-194.dat	upx
behavioral2/files/0x0002000000022df8-195.dat	upx
behavioral2/files/0x0002000000022df8-193.dat	upx
behavioral2/files/0x0002000000022df2-199.dat	upx
behavioral2/files/0x0002000000022df5-200.dat	upx
behavioral2/files/0x0002000000022df0-203.dat	upx
behavioral2/files/0x0002000000022df1-198.dat	upx
behavioral2/files/0x0002000000022df3-197.dat	upx
behavioral2/files/0x0002000000022dfa-196.dat	upx
behavioral2/files/0x0002000000022df5-208.dat	upx
behavioral2/files/0x0002000000022df1-207.dat	upx
behavioral2/files/0x0002000000022df3-206.dat	upx
behavioral2/files/0x0002000000022df8-217.dat	upx
behavioral2/files/0x0002000000022df0-213.dat	upx
behavioral2/files/0x0002000000022df8-216.dat	upx
behavioral2/memory/1884-220-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0002000000022df4-219.dat	upx
behavioral2/memory/544-227-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/2836-228-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4192-229-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/2720-224-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0002000000022df4-230.dat	upx
behavioral2/memory/4192-234-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/3964-236-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0003000000022df6-237.dat	upx
behavioral2/memory/3144-244-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0003000000022df6-242.dat	upx
behavioral2/files/0x0002000000022df7-247.dat	upx
behavioral2/memory/3388-248-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0002000000022df1-252.dat	upx

Loads dropped DLL 6 IoCs

pid	Process
2164	Tiwi.exe
1884	Tiwi.exe
544	Tiwi.exe
4668	Tiwi.exe
4432	Tiwi.exe
4356	Tiwi.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	winlogon.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened (read-only)	\??\Z:	Tiwi.exe
File opened (read-only)	\??\Y:	Tiwi.exe
File opened (read-only)	\??\I:	imoet.exe
File opened (read-only)	\??\R:	imoet.exe
File opened (read-only)	\??\Y:	imoet.exe
File opened (read-only)	\??\X:	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened (read-only)	\??\S:	IExplorer.exe
File opened (read-only)	\??\X:	winlogon.exe
File opened (read-only)	\??\G:	imoet.exe
File opened (read-only)	\??\T:	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened (read-only)	\??\G:	IExplorer.exe
File opened (read-only)	\??\Q:	imoet.exe
File opened (read-only)	\??\W:	imoet.exe
File opened (read-only)	\??\Z:	imoet.exe
File opened (read-only)	\??\B:	cute.exe
File opened (read-only)	\??\Q:	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened (read-only)	\??\Y:	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened (read-only)	\??\T:	IExplorer.exe
File opened (read-only)	\??\H:	winlogon.exe
File opened (read-only)	\??\F:	cute.exe
File opened (read-only)	\??\W:	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened (read-only)	\??\B:	IExplorer.exe
File opened (read-only)	\??\S:	imoet.exe
File opened (read-only)	\??\Q:	winlogon.exe
File opened (read-only)	\??\W:	winlogon.exe
File opened (read-only)	\??\L:	imoet.exe
File opened (read-only)	\??\K:	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened (read-only)	\??\Z:	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened (read-only)	\??\J:	IExplorer.exe
File opened (read-only)	\??\N:	winlogon.exe
File opened (read-only)	\??\W:	Tiwi.exe
File opened (read-only)	\??\F:	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened (read-only)	\??\M:	IExplorer.exe
File opened (read-only)	\??\L:	Tiwi.exe
File opened (read-only)	\??\M:	Tiwi.exe
File opened (read-only)	\??\K:	IExplorer.exe
File opened (read-only)	\??\K:	winlogon.exe
File opened (read-only)	\??\T:	imoet.exe
File opened (read-only)	\??\R:	IExplorer.exe
File opened (read-only)	\??\V:	IExplorer.exe
File opened (read-only)	\??\Z:	IExplorer.exe
File opened (read-only)	\??\E:	Tiwi.exe
File opened (read-only)	\??\O:	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened (read-only)	\??\L:	winlogon.exe
File opened (read-only)	\??\S:	winlogon.exe
File opened (read-only)	\??\U:	imoet.exe
File opened (read-only)	\??\L:	IExplorer.exe
File opened (read-only)	\??\O:	IExplorer.exe
File opened (read-only)	\??\I:	Tiwi.exe
File opened (read-only)	\??\P:	Tiwi.exe
File opened (read-only)	\??\U:	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened (read-only)	\??\Q:	IExplorer.exe
File opened (read-only)	\??\T:	winlogon.exe
File opened (read-only)	\??\Y:	winlogon.exe
File opened (read-only)	\??\E:	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened (read-only)	\??\N:	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened (read-only)	\??\K:	Tiwi.exe
File opened (read-only)	\??\I:	winlogon.exe
File opened (read-only)	\??\J:	imoet.exe
File opened (read-only)	\??\K:	cute.exe
File opened (read-only)	\??\S:	cute.exe
File opened (read-only)	\??\M:	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened (read-only)	\??\V:	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe

Modifies WinLogon 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	cute.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened for modification	C:\autorun.inf	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe

Drops file in System32 directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	imoet.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	winlogon.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	imoet.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\tiwi.scr	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\shell.exe	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	cute.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	Tiwi.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	cute.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	cute.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	Tiwi.exe
File opened for modification	C:\Windows\tiwi.exe	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	cute.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	Tiwi.exe
File opened for modification	C:\Windows\tiwi.exe	winlogon.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
File created	C:\Windows\tiwi.exe	winlogon.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	imoet.exe
File created	C:\Windows\tiwi.exe	imoet.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe

Modifies Control Panel 54 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Tiwi"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\SwapMouseButtons = "1"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Tiwi"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Tiwi"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Tiwi"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\SwapMouseButtons = "1"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\SwapMouseButtons = "1"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Tiwi"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\SwapMouseButtons = "1"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Tiwi"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\SwapMouseButtons = "1"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Tiwi"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\SwapMouseButtons = "1"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Tiwi"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Tiwi"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	IExplorer.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	cute.exe

Modifies Internet Explorer start page 1 TTPs 6 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	cute.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
3264	Tiwi.exe
2720	imoet.exe
2700	winlogon.exe
788	IExplorer.exe
2836	cute.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
3264	Tiwi.exe
788	IExplorer.exe
2700	winlogon.exe
2164	Tiwi.exe
1592	IExplorer.exe
3724	winlogon.exe
2720	imoet.exe
1884	Tiwi.exe
544	Tiwi.exe
2836	cute.exe
4192	IExplorer.exe
3964	IExplorer.exe
3144	winlogon.exe
3388	winlogon.exe
1460	imoet.exe
3544	imoet.exe
3856	cute.exe
4948	cute.exe
5080	imoet.exe
4668	Tiwi.exe
1360	cute.exe
5064	IExplorer.exe
1104	winlogon.exe
3176	imoet.exe
4432	Tiwi.exe
796	cute.exe
1476	IExplorer.exe
4356	Tiwi.exe
1672	winlogon.exe
4808	IExplorer.exe
912	imoet.exe
3404	winlogon.exe
4540	cute.exe
4412	imoet.exe
1148	cute.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 3264	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	83
PID 5044 wrote to memory of 3264	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	83
PID 5044 wrote to memory of 3264	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	83
PID 5044 wrote to memory of 788	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	84
PID 5044 wrote to memory of 788	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	84
PID 5044 wrote to memory of 788	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	84
PID 5044 wrote to memory of 2700	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	85
PID 5044 wrote to memory of 2700	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	85
PID 5044 wrote to memory of 2700	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	85
PID 5044 wrote to memory of 2164	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	86
PID 5044 wrote to memory of 2164	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	86
PID 5044 wrote to memory of 2164	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	86
PID 5044 wrote to memory of 1592	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	87
PID 5044 wrote to memory of 1592	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	87
PID 5044 wrote to memory of 1592	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	87
PID 5044 wrote to memory of 3724	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	88
PID 5044 wrote to memory of 3724	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	88
PID 5044 wrote to memory of 3724	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	88
PID 5044 wrote to memory of 2720	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	89
PID 5044 wrote to memory of 2720	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	89
PID 5044 wrote to memory of 2720	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	89
PID 788 wrote to memory of 1884	788	IExplorer.exe	90
PID 788 wrote to memory of 1884	788	IExplorer.exe	90
PID 788 wrote to memory of 1884	788	IExplorer.exe	90
PID 3264 wrote to memory of 544	3264	Tiwi.exe	92
PID 3264 wrote to memory of 544	3264	Tiwi.exe	92
PID 3264 wrote to memory of 544	3264	Tiwi.exe	92
PID 5044 wrote to memory of 2836	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	91
PID 5044 wrote to memory of 2836	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	91
PID 5044 wrote to memory of 2836	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	91
PID 788 wrote to memory of 4192	788	IExplorer.exe	93
PID 788 wrote to memory of 4192	788	IExplorer.exe	93
PID 788 wrote to memory of 4192	788	IExplorer.exe	93
PID 3264 wrote to memory of 3964	3264	Tiwi.exe	94
PID 3264 wrote to memory of 3964	3264	Tiwi.exe	94
PID 3264 wrote to memory of 3964	3264	Tiwi.exe	94
PID 788 wrote to memory of 3144	788	IExplorer.exe	95
PID 788 wrote to memory of 3144	788	IExplorer.exe	95
PID 788 wrote to memory of 3144	788	IExplorer.exe	95
PID 3264 wrote to memory of 3388	3264	Tiwi.exe	96
PID 3264 wrote to memory of 3388	3264	Tiwi.exe	96
PID 3264 wrote to memory of 3388	3264	Tiwi.exe	96
PID 788 wrote to memory of 1460	788	IExplorer.exe	97
PID 788 wrote to memory of 1460	788	IExplorer.exe	97
PID 788 wrote to memory of 1460	788	IExplorer.exe	97
PID 3264 wrote to memory of 3544	3264	Tiwi.exe	98
PID 3264 wrote to memory of 3544	3264	Tiwi.exe	98
PID 3264 wrote to memory of 3544	3264	Tiwi.exe	98
PID 788 wrote to memory of 3856	788	IExplorer.exe	99
PID 788 wrote to memory of 3856	788	IExplorer.exe	99
PID 788 wrote to memory of 3856	788	IExplorer.exe	99
PID 3264 wrote to memory of 4948	3264	Tiwi.exe	100
PID 3264 wrote to memory of 4948	3264	Tiwi.exe	100
PID 3264 wrote to memory of 4948	3264	Tiwi.exe	100
PID 5044 wrote to memory of 5080	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	101
PID 5044 wrote to memory of 5080	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	101
PID 5044 wrote to memory of 5080	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	101
PID 2700 wrote to memory of 4668	2700	winlogon.exe	102
PID 2700 wrote to memory of 4668	2700	winlogon.exe	102
PID 2700 wrote to memory of 4668	2700	winlogon.exe	102
PID 5044 wrote to memory of 1360	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	104
PID 5044 wrote to memory of 1360	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	104
PID 5044 wrote to memory of 1360	5044	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe	104
PID 2700 wrote to memory of 5064	2700	winlogon.exe	103

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe
"C:\Users\Admin\AppData\Local\Temp\6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5044
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3264
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:544
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:3964
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3388
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3544
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4948
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:788
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1884
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:4192
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3144
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1460
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3856
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2700
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4668
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:5064
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1104
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3176
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:796
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2164
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:1592
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3724
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:2720
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4432
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1476
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1672
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:912
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4540
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:2836
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4356
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:4808
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3404
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4412
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1148
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5080
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Tiwi.exe

Filesize
85KB

MD5
dafc4531a97781d9339225c7a7b85000

SHA1
6c20b56f145c417018e25805d3c319cfe4e6db3b

SHA256
bd57a7fe0ae34aa972001b74224bc79fbd97249dee151e40270608a6641408bc

SHA512
760f4532346b092c2cc1152b199a95945aac681e65cb4898a4ec96780d9ff31f827e11d6584562179a00af6b02ad2a16cf4fcec19793fd72df5d8c72dbb8f924

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
0f8a73f75fb71eacd7245767c0207287

SHA1
2a427aeac0a773383be3fa18db23aec4e681f515

SHA256
677af1c1ed5429cdfd68af53fcdb96a2e9f7cd7d2293bad8d3bd7eb806128125

SHA512
b3926125f94f257663d3355b4779d778860613ee3c4343ac57664bfdcd6e2edcb56bb29508525a1074b3e41c71496ee57eac27148af8fa54b162ce45f4c997da

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
0f8a73f75fb71eacd7245767c0207287

SHA1
2a427aeac0a773383be3fa18db23aec4e681f515

SHA256
677af1c1ed5429cdfd68af53fcdb96a2e9f7cd7d2293bad8d3bd7eb806128125

SHA512
b3926125f94f257663d3355b4779d778860613ee3c4343ac57664bfdcd6e2edcb56bb29508525a1074b3e41c71496ee57eac27148af8fa54b162ce45f4c997da

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
0f8a73f75fb71eacd7245767c0207287

SHA1
2a427aeac0a773383be3fa18db23aec4e681f515

SHA256
677af1c1ed5429cdfd68af53fcdb96a2e9f7cd7d2293bad8d3bd7eb806128125

SHA512
b3926125f94f257663d3355b4779d778860613ee3c4343ac57664bfdcd6e2edcb56bb29508525a1074b3e41c71496ee57eac27148af8fa54b162ce45f4c997da

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
dafc4531a97781d9339225c7a7b85000

SHA1
6c20b56f145c417018e25805d3c319cfe4e6db3b

SHA256
bd57a7fe0ae34aa972001b74224bc79fbd97249dee151e40270608a6641408bc

SHA512
760f4532346b092c2cc1152b199a95945aac681e65cb4898a4ec96780d9ff31f827e11d6584562179a00af6b02ad2a16cf4fcec19793fd72df5d8c72dbb8f924

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
dafc4531a97781d9339225c7a7b85000

SHA1
6c20b56f145c417018e25805d3c319cfe4e6db3b

SHA256
bd57a7fe0ae34aa972001b74224bc79fbd97249dee151e40270608a6641408bc

SHA512
760f4532346b092c2cc1152b199a95945aac681e65cb4898a4ec96780d9ff31f827e11d6584562179a00af6b02ad2a16cf4fcec19793fd72df5d8c72dbb8f924

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
dafc4531a97781d9339225c7a7b85000

SHA1
6c20b56f145c417018e25805d3c319cfe4e6db3b

SHA256
bd57a7fe0ae34aa972001b74224bc79fbd97249dee151e40270608a6641408bc

SHA512
760f4532346b092c2cc1152b199a95945aac681e65cb4898a4ec96780d9ff31f827e11d6584562179a00af6b02ad2a16cf4fcec19793fd72df5d8c72dbb8f924

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
0f8a73f75fb71eacd7245767c0207287

SHA1
2a427aeac0a773383be3fa18db23aec4e681f515

SHA256
677af1c1ed5429cdfd68af53fcdb96a2e9f7cd7d2293bad8d3bd7eb806128125

SHA512
b3926125f94f257663d3355b4779d778860613ee3c4343ac57664bfdcd6e2edcb56bb29508525a1074b3e41c71496ee57eac27148af8fa54b162ce45f4c997da

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
0f8a73f75fb71eacd7245767c0207287

SHA1
2a427aeac0a773383be3fa18db23aec4e681f515

SHA256
677af1c1ed5429cdfd68af53fcdb96a2e9f7cd7d2293bad8d3bd7eb806128125

SHA512
b3926125f94f257663d3355b4779d778860613ee3c4343ac57664bfdcd6e2edcb56bb29508525a1074b3e41c71496ee57eac27148af8fa54b162ce45f4c997da

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
0f8a73f75fb71eacd7245767c0207287

SHA1
2a427aeac0a773383be3fa18db23aec4e681f515

SHA256
677af1c1ed5429cdfd68af53fcdb96a2e9f7cd7d2293bad8d3bd7eb806128125

SHA512
b3926125f94f257663d3355b4779d778860613ee3c4343ac57664bfdcd6e2edcb56bb29508525a1074b3e41c71496ee57eac27148af8fa54b162ce45f4c997da

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
0f8a73f75fb71eacd7245767c0207287

SHA1
2a427aeac0a773383be3fa18db23aec4e681f515

SHA256
677af1c1ed5429cdfd68af53fcdb96a2e9f7cd7d2293bad8d3bd7eb806128125

SHA512
b3926125f94f257663d3355b4779d778860613ee3c4343ac57664bfdcd6e2edcb56bb29508525a1074b3e41c71496ee57eac27148af8fa54b162ce45f4c997da

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
6c2ae1e6d78bddee4420409a833e4e0f

SHA1
77619f2c7a5d031efbb567b173018aa407ee2892

SHA256
4aeb598f97e5efcf717eb4e8db0bcd611bdbd77537a9aaa65c14bde2a599d89d

SHA512
676527b237f62e14759a7d5857e45cf040397d041bf2131c97ddfb0c34062faf82255da95f9511784da90d8864cdfba1d625bd807cfd16bc679b8788cbd5dea3

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
02936a68c13aedea25a16d73d89a3723

SHA1
929004b6e8299c983e1d7f524c8ffae04b46630d

SHA256
4bcca60915f1a1c00e9cab8c39428edd7f9e0402e837d371c1c67db563b5448b

SHA512
102cbd1f9da73841402980d9606608f4a7ac0a45d974477a135a4e39992aa3038226d455f4def20e040159eb343261203a2a602f2851109453c4a103d882d369

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
ff2f2d84a3a255c651172bef86028de0

SHA1
9f3fde25378d60fdffc3069745580106cd6d00bd

SHA256
d7276268e1bf449d46d4531bd9181adec02f923f3d6610d79cb9afd3421b611c

SHA512
0a2e9aaf757accfc28203209e0b75347201d10ebc2f8a6542b1752409d15d020d3bd606b71ab1715ef64a53050953d9cd769bd7de8ce35e48f13eff308dd8cc8

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
ff2f2d84a3a255c651172bef86028de0

SHA1
9f3fde25378d60fdffc3069745580106cd6d00bd

SHA256
d7276268e1bf449d46d4531bd9181adec02f923f3d6610d79cb9afd3421b611c

SHA512
0a2e9aaf757accfc28203209e0b75347201d10ebc2f8a6542b1752409d15d020d3bd606b71ab1715ef64a53050953d9cd769bd7de8ce35e48f13eff308dd8cc8

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
ff2f2d84a3a255c651172bef86028de0

SHA1
9f3fde25378d60fdffc3069745580106cd6d00bd

SHA256
d7276268e1bf449d46d4531bd9181adec02f923f3d6610d79cb9afd3421b611c

SHA512
0a2e9aaf757accfc28203209e0b75347201d10ebc2f8a6542b1752409d15d020d3bd606b71ab1715ef64a53050953d9cd769bd7de8ce35e48f13eff308dd8cc8

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
0f8a73f75fb71eacd7245767c0207287

SHA1
2a427aeac0a773383be3fa18db23aec4e681f515

SHA256
677af1c1ed5429cdfd68af53fcdb96a2e9f7cd7d2293bad8d3bd7eb806128125

SHA512
b3926125f94f257663d3355b4779d778860613ee3c4343ac57664bfdcd6e2edcb56bb29508525a1074b3e41c71496ee57eac27148af8fa54b162ce45f4c997da

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
dafc4531a97781d9339225c7a7b85000

SHA1
6c20b56f145c417018e25805d3c319cfe4e6db3b

SHA256
bd57a7fe0ae34aa972001b74224bc79fbd97249dee151e40270608a6641408bc

SHA512
760f4532346b092c2cc1152b199a95945aac681e65cb4898a4ec96780d9ff31f827e11d6584562179a00af6b02ad2a16cf4fcec19793fd72df5d8c72dbb8f924

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
4d4055ec3bd4df16aba991840ecc06e0

SHA1
be07a2410448ff64a0a52bb05c8fe8380cb025c3

SHA256
e1ca723ea21161a54310670acdff39ceebd8fe1a7b509807a7317cb5be6fa237

SHA512
1ef29e13309b536aead4d0a8e9c7a2f435074c340e30576f17fec578dcdef010b4a4f7095fe2aefe5fce5d01ba15c7323c652842ffcc45148e89eb5874b470d5

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
4d4055ec3bd4df16aba991840ecc06e0

SHA1
be07a2410448ff64a0a52bb05c8fe8380cb025c3

SHA256
e1ca723ea21161a54310670acdff39ceebd8fe1a7b509807a7317cb5be6fa237

SHA512
1ef29e13309b536aead4d0a8e9c7a2f435074c340e30576f17fec578dcdef010b4a4f7095fe2aefe5fce5d01ba15c7323c652842ffcc45148e89eb5874b470d5

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
818e3c0c6cfe05e0a7b86d655f3fcd2d

SHA1
7c0fcd569965f5eaef72f2e99d6b78b05ca8f29b

SHA256
66af7a0dbb4ff231e590dbbadf430d5306241ea0b604993828bf1565ce891bcf

SHA512
986d6ad73b3c9ec2f40204a61de557ee2fb8032d01182a0356df20221ef8da15a53fc6ddf049fc90f81f811cab1dec95510a12b1bc86ede269d81919d76b1019

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
a039294b6e71db573859902b915b9976

SHA1
ce7f0f77d960412040c75f614f1df24e7be1afb3

SHA256
6d9a51b5736fe8198abf170e11b9ff1a02058c9eda9b3b10c47fe574b73c1971

SHA512
bea65f7ece72e94cabfe4ea07340a7a85ceeaa5ebfb9a71c8a98b1dba1acaa19ff2c760baa849102cb85657690ca327ff6657da28dcd44d9a8594fba9afd67e3

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
02936a68c13aedea25a16d73d89a3723

SHA1
929004b6e8299c983e1d7f524c8ffae04b46630d

SHA256
4bcca60915f1a1c00e9cab8c39428edd7f9e0402e837d371c1c67db563b5448b

SHA512
102cbd1f9da73841402980d9606608f4a7ac0a45d974477a135a4e39992aa3038226d455f4def20e040159eb343261203a2a602f2851109453c4a103d882d369

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
02936a68c13aedea25a16d73d89a3723

SHA1
929004b6e8299c983e1d7f524c8ffae04b46630d

SHA256
4bcca60915f1a1c00e9cab8c39428edd7f9e0402e837d371c1c67db563b5448b

SHA512
102cbd1f9da73841402980d9606608f4a7ac0a45d974477a135a4e39992aa3038226d455f4def20e040159eb343261203a2a602f2851109453c4a103d882d369

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe

Filesize
85KB

MD5
0f8a73f75fb71eacd7245767c0207287

SHA1
2a427aeac0a773383be3fa18db23aec4e681f515

SHA256
677af1c1ed5429cdfd68af53fcdb96a2e9f7cd7d2293bad8d3bd7eb806128125

SHA512
b3926125f94f257663d3355b4779d778860613ee3c4343ac57664bfdcd6e2edcb56bb29508525a1074b3e41c71496ee57eac27148af8fa54b162ce45f4c997da

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
02936a68c13aedea25a16d73d89a3723

SHA1
929004b6e8299c983e1d7f524c8ffae04b46630d

SHA256
4bcca60915f1a1c00e9cab8c39428edd7f9e0402e837d371c1c67db563b5448b

SHA512
102cbd1f9da73841402980d9606608f4a7ac0a45d974477a135a4e39992aa3038226d455f4def20e040159eb343261203a2a602f2851109453c4a103d882d369

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
4e85def07fa9710be7752210c06497bb

SHA1
ecc68592121e45ae38f81ce63ccde4f09a92fbb1

SHA256
8ad2417a535b7435b04395f0e2c54fbf0615e2833162fa910b15d1ac02bc5f22

SHA512
8254631d06dbfd2a186202f7589e46a19be6677497932519a88ed2a3ed53000491a0298ecf6a96de68ac28f0d5d46d6cf6e0dfaa1562cda68e4f84de5234d5b2

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
4e85def07fa9710be7752210c06497bb

SHA1
ecc68592121e45ae38f81ce63ccde4f09a92fbb1

SHA256
8ad2417a535b7435b04395f0e2c54fbf0615e2833162fa910b15d1ac02bc5f22

SHA512
8254631d06dbfd2a186202f7589e46a19be6677497932519a88ed2a3ed53000491a0298ecf6a96de68ac28f0d5d46d6cf6e0dfaa1562cda68e4f84de5234d5b2

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
4e85def07fa9710be7752210c06497bb

SHA1
ecc68592121e45ae38f81ce63ccde4f09a92fbb1

SHA256
8ad2417a535b7435b04395f0e2c54fbf0615e2833162fa910b15d1ac02bc5f22

SHA512
8254631d06dbfd2a186202f7589e46a19be6677497932519a88ed2a3ed53000491a0298ecf6a96de68ac28f0d5d46d6cf6e0dfaa1562cda68e4f84de5234d5b2

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
0f8a73f75fb71eacd7245767c0207287

SHA1
2a427aeac0a773383be3fa18db23aec4e681f515

SHA256
677af1c1ed5429cdfd68af53fcdb96a2e9f7cd7d2293bad8d3bd7eb806128125

SHA512
b3926125f94f257663d3355b4779d778860613ee3c4343ac57664bfdcd6e2edcb56bb29508525a1074b3e41c71496ee57eac27148af8fa54b162ce45f4c997da

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
dafc4531a97781d9339225c7a7b85000

SHA1
6c20b56f145c417018e25805d3c319cfe4e6db3b

SHA256
bd57a7fe0ae34aa972001b74224bc79fbd97249dee151e40270608a6641408bc

SHA512
760f4532346b092c2cc1152b199a95945aac681e65cb4898a4ec96780d9ff31f827e11d6584562179a00af6b02ad2a16cf4fcec19793fd72df5d8c72dbb8f924

Download Submit
C:\Windows\MSVBVM60.DLL

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
292f13dd6ca6f252a2d9cfdb73590c33

SHA1
20e97a8d8cf2bd17a62e4d9e1fb595eaf1a6f646

SHA256
ac068350d3d282a491dabc1ff1ec0f3b3ccfb481f7a4f9109aabbe2184ecda4e

SHA512
ef42e017ea4f71f38286119d4415204c025404717456d8448a3157f7e95c05679324bf654ecc29f9f4e38d7646652e1b68352006777c35144a945f563e6d2fd0

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
292f13dd6ca6f252a2d9cfdb73590c33

SHA1
20e97a8d8cf2bd17a62e4d9e1fb595eaf1a6f646

SHA256
ac068350d3d282a491dabc1ff1ec0f3b3ccfb481f7a4f9109aabbe2184ecda4e

SHA512
ef42e017ea4f71f38286119d4415204c025404717456d8448a3157f7e95c05679324bf654ecc29f9f4e38d7646652e1b68352006777c35144a945f563e6d2fd0

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
292f13dd6ca6f252a2d9cfdb73590c33

SHA1
20e97a8d8cf2bd17a62e4d9e1fb595eaf1a6f646

SHA256
ac068350d3d282a491dabc1ff1ec0f3b3ccfb481f7a4f9109aabbe2184ecda4e

SHA512
ef42e017ea4f71f38286119d4415204c025404717456d8448a3157f7e95c05679324bf654ecc29f9f4e38d7646652e1b68352006777c35144a945f563e6d2fd0

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
292f13dd6ca6f252a2d9cfdb73590c33

SHA1
20e97a8d8cf2bd17a62e4d9e1fb595eaf1a6f646

SHA256
ac068350d3d282a491dabc1ff1ec0f3b3ccfb481f7a4f9109aabbe2184ecda4e

SHA512
ef42e017ea4f71f38286119d4415204c025404717456d8448a3157f7e95c05679324bf654ecc29f9f4e38d7646652e1b68352006777c35144a945f563e6d2fd0

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
292f13dd6ca6f252a2d9cfdb73590c33

SHA1
20e97a8d8cf2bd17a62e4d9e1fb595eaf1a6f646

SHA256
ac068350d3d282a491dabc1ff1ec0f3b3ccfb481f7a4f9109aabbe2184ecda4e

SHA512
ef42e017ea4f71f38286119d4415204c025404717456d8448a3157f7e95c05679324bf654ecc29f9f4e38d7646652e1b68352006777c35144a945f563e6d2fd0

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
02936a68c13aedea25a16d73d89a3723

SHA1
929004b6e8299c983e1d7f524c8ffae04b46630d

SHA256
4bcca60915f1a1c00e9cab8c39428edd7f9e0402e837d371c1c67db563b5448b

SHA512
102cbd1f9da73841402980d9606608f4a7ac0a45d974477a135a4e39992aa3038226d455f4def20e040159eb343261203a2a602f2851109453c4a103d882d369

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
292f13dd6ca6f252a2d9cfdb73590c33

SHA1
20e97a8d8cf2bd17a62e4d9e1fb595eaf1a6f646

SHA256
ac068350d3d282a491dabc1ff1ec0f3b3ccfb481f7a4f9109aabbe2184ecda4e

SHA512
ef42e017ea4f71f38286119d4415204c025404717456d8448a3157f7e95c05679324bf654ecc29f9f4e38d7646652e1b68352006777c35144a945f563e6d2fd0

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
004dad9b284a391e375280a80164249d

SHA1
a01f9f89e6ddd4331f47a400cdbe434116a88863

SHA256
eb660e12ea0d363e17bd963b356cf4caafdc854434e3156b06672901a19ba994

SHA512
cfddafe01aad9d83a63a4daec8f16e27341d7f17f37807dcc7659d8f5004dfe72d7132f11053d9e24bb32078ef28a61ffa43ab6ec833e2b3d18ccd3ea326f668

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
0f8a73f75fb71eacd7245767c0207287

SHA1
2a427aeac0a773383be3fa18db23aec4e681f515

SHA256
677af1c1ed5429cdfd68af53fcdb96a2e9f7cd7d2293bad8d3bd7eb806128125

SHA512
b3926125f94f257663d3355b4779d778860613ee3c4343ac57664bfdcd6e2edcb56bb29508525a1074b3e41c71496ee57eac27148af8fa54b162ce45f4c997da

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
dafc4531a97781d9339225c7a7b85000

SHA1
6c20b56f145c417018e25805d3c319cfe4e6db3b

SHA256
bd57a7fe0ae34aa972001b74224bc79fbd97249dee151e40270608a6641408bc

SHA512
760f4532346b092c2cc1152b199a95945aac681e65cb4898a4ec96780d9ff31f827e11d6584562179a00af6b02ad2a16cf4fcec19793fd72df5d8c72dbb8f924

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
02936a68c13aedea25a16d73d89a3723

SHA1
929004b6e8299c983e1d7f524c8ffae04b46630d

SHA256
4bcca60915f1a1c00e9cab8c39428edd7f9e0402e837d371c1c67db563b5448b

SHA512
102cbd1f9da73841402980d9606608f4a7ac0a45d974477a135a4e39992aa3038226d455f4def20e040159eb343261203a2a602f2851109453c4a103d882d369

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
292f13dd6ca6f252a2d9cfdb73590c33

SHA1
20e97a8d8cf2bd17a62e4d9e1fb595eaf1a6f646

SHA256
ac068350d3d282a491dabc1ff1ec0f3b3ccfb481f7a4f9109aabbe2184ecda4e

SHA512
ef42e017ea4f71f38286119d4415204c025404717456d8448a3157f7e95c05679324bf654ecc29f9f4e38d7646652e1b68352006777c35144a945f563e6d2fd0

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
b5b674ef06e3eecb5f0c39ef76c9350b

SHA1
0d0127e17aae5480a88d35afe3e217252857463e

SHA256
2bd0703fa3846aaf771a82f746e4ff257236d1334f1ea6dbbdb880c1eab4e183

SHA512
a909373760ddd79ad361ccabc706d6aedf92209506387f047d466be84b4b3a4c630e429d4e1bcba6442f512ead50af96687eec3f6643d23e5c9d1f7a2d366673

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
0f8a73f75fb71eacd7245767c0207287

SHA1
2a427aeac0a773383be3fa18db23aec4e681f515

SHA256
677af1c1ed5429cdfd68af53fcdb96a2e9f7cd7d2293bad8d3bd7eb806128125

SHA512
b3926125f94f257663d3355b4779d778860613ee3c4343ac57664bfdcd6e2edcb56bb29508525a1074b3e41c71496ee57eac27148af8fa54b162ce45f4c997da

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
0f8a73f75fb71eacd7245767c0207287

SHA1
2a427aeac0a773383be3fa18db23aec4e681f515

SHA256
677af1c1ed5429cdfd68af53fcdb96a2e9f7cd7d2293bad8d3bd7eb806128125

SHA512
b3926125f94f257663d3355b4779d778860613ee3c4343ac57664bfdcd6e2edcb56bb29508525a1074b3e41c71496ee57eac27148af8fa54b162ce45f4c997da

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
dafc4531a97781d9339225c7a7b85000

SHA1
6c20b56f145c417018e25805d3c319cfe4e6db3b

SHA256
bd57a7fe0ae34aa972001b74224bc79fbd97249dee151e40270608a6641408bc

SHA512
760f4532346b092c2cc1152b199a95945aac681e65cb4898a4ec96780d9ff31f827e11d6584562179a00af6b02ad2a16cf4fcec19793fd72df5d8c72dbb8f924

Download Submit
C:\Windows\Tiwi.exe

Filesize
85KB

MD5
02936a68c13aedea25a16d73d89a3723

SHA1
929004b6e8299c983e1d7f524c8ffae04b46630d

SHA256
4bcca60915f1a1c00e9cab8c39428edd7f9e0402e837d371c1c67db563b5448b

SHA512
102cbd1f9da73841402980d9606608f4a7ac0a45d974477a135a4e39992aa3038226d455f4def20e040159eb343261203a2a602f2851109453c4a103d882d369

Download Submit
C:\Windows\msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
02936a68c13aedea25a16d73d89a3723

SHA1
929004b6e8299c983e1d7f524c8ffae04b46630d

SHA256
4bcca60915f1a1c00e9cab8c39428edd7f9e0402e837d371c1c67db563b5448b

SHA512
102cbd1f9da73841402980d9606608f4a7ac0a45d974477a135a4e39992aa3038226d455f4def20e040159eb343261203a2a602f2851109453c4a103d882d369

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
02936a68c13aedea25a16d73d89a3723

SHA1
929004b6e8299c983e1d7f524c8ffae04b46630d

SHA256
4bcca60915f1a1c00e9cab8c39428edd7f9e0402e837d371c1c67db563b5448b

SHA512
102cbd1f9da73841402980d9606608f4a7ac0a45d974477a135a4e39992aa3038226d455f4def20e040159eb343261203a2a602f2851109453c4a103d882d369

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
02936a68c13aedea25a16d73d89a3723

SHA1
929004b6e8299c983e1d7f524c8ffae04b46630d

SHA256
4bcca60915f1a1c00e9cab8c39428edd7f9e0402e837d371c1c67db563b5448b

SHA512
102cbd1f9da73841402980d9606608f4a7ac0a45d974477a135a4e39992aa3038226d455f4def20e040159eb343261203a2a602f2851109453c4a103d882d369

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
02936a68c13aedea25a16d73d89a3723

SHA1
929004b6e8299c983e1d7f524c8ffae04b46630d

SHA256
4bcca60915f1a1c00e9cab8c39428edd7f9e0402e837d371c1c67db563b5448b

SHA512
102cbd1f9da73841402980d9606608f4a7ac0a45d974477a135a4e39992aa3038226d455f4def20e040159eb343261203a2a602f2851109453c4a103d882d369

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
02936a68c13aedea25a16d73d89a3723

SHA1
929004b6e8299c983e1d7f524c8ffae04b46630d

SHA256
4bcca60915f1a1c00e9cab8c39428edd7f9e0402e837d371c1c67db563b5448b

SHA512
102cbd1f9da73841402980d9606608f4a7ac0a45d974477a135a4e39992aa3038226d455f4def20e040159eb343261203a2a602f2851109453c4a103d882d369

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
292f13dd6ca6f252a2d9cfdb73590c33

SHA1
20e97a8d8cf2bd17a62e4d9e1fb595eaf1a6f646

SHA256
ac068350d3d282a491dabc1ff1ec0f3b3ccfb481f7a4f9109aabbe2184ecda4e

SHA512
ef42e017ea4f71f38286119d4415204c025404717456d8448a3157f7e95c05679324bf654ecc29f9f4e38d7646652e1b68352006777c35144a945f563e6d2fd0

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
fa0e4b255883acadfd1276044de6c446

SHA1
9336810e8132709f2c639e7ac91420e8ad044236

SHA256
4ea2392a9051e6b0abf5dbb1727c60baa14d65f2d8de050cb4e5b4bc9bbb8ca1

SHA512
3c41c7357bf2143de0decde79aa978e3423c02e592cf1276db9ae3b468873750cb8d9712becad94457b6ff7d45f569e93f135215ae458899f6877ca55d1d4cf5

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
0f8a73f75fb71eacd7245767c0207287

SHA1
2a427aeac0a773383be3fa18db23aec4e681f515

SHA256
677af1c1ed5429cdfd68af53fcdb96a2e9f7cd7d2293bad8d3bd7eb806128125

SHA512
b3926125f94f257663d3355b4779d778860613ee3c4343ac57664bfdcd6e2edcb56bb29508525a1074b3e41c71496ee57eac27148af8fa54b162ce45f4c997da

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
0f8a73f75fb71eacd7245767c0207287

SHA1
2a427aeac0a773383be3fa18db23aec4e681f515

SHA256
677af1c1ed5429cdfd68af53fcdb96a2e9f7cd7d2293bad8d3bd7eb806128125

SHA512
b3926125f94f257663d3355b4779d778860613ee3c4343ac57664bfdcd6e2edcb56bb29508525a1074b3e41c71496ee57eac27148af8fa54b162ce45f4c997da

Download Submit
memory/544-227-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/788-157-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/788-344-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/796-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/796-309-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/912-328-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1104-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1148-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1360-287-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1460-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1476-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1592-164-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1672-319-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1884-220-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2164-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2700-159-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2700-345-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2720-346-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2720-224-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2836-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2836-228-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3144-244-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3176-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3264-156-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3264-343-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3388-248-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3404-331-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3544-264-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3724-170-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3856-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3856-262-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3964-236-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4192-229-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4192-234-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4356-318-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4412-339-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4432-303-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4540-336-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4668-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4808-325-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4948-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5044-134-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5044-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5064-289-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5080-278-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download