f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd

Analysis

max time kernel
151s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Size

85KB
MD5

83c57ec61d77a6fa49eaffe366bd1092
SHA1

b9758bbd40a650427067d43c2587f14d3cca0058
SHA256

f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd
SHA512

d6dcbe8571da5a9736813cd80d65fbe4757449256f1302d63f995ca6f5a33fb6f26a99e08bfe0b5131e42dd94308e1659191e7956a046d718d884fe8e9b060e2
SSDEEP

768:Nh5sxVPFXfgaDjof4ZgHqLNhldu8pGTUTY26TsGrn5wFbUzMsPzB5aPXwekfpb:NHsxFJfgaDjofVKn1pGwTJOlw1UrYwlb

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cute.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cute.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 35 IoCs

pid	Process
940	Tiwi.exe
1492	IExplorer.exe
1948	winlogon.exe
432	imoet.exe
1624	cute.exe
292	Tiwi.exe
1964	Tiwi.exe
812	Tiwi.exe
1032	IExplorer.exe
1292	IExplorer.exe
1520	Tiwi.exe
1008	IExplorer.exe
1612	Tiwi.exe
1468	winlogon.exe
1000	IExplorer.exe
1916	winlogon.exe
1724	IExplorer.exe
324	winlogon.exe
896	winlogon.exe
1308	imoet.exe
592	imoet.exe
880	imoet.exe
824	winlogon.exe
1112	cute.exe
1504	imoet.exe
1516	Tiwi.exe
1552	cute.exe
1028	cute.exe
1992	cute.exe
892	IExplorer.exe
1776	imoet.exe
1520	cute.exe
1692	winlogon.exe
1608	imoet.exe
1224	cute.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000012322-58.dat	upx
behavioral1/memory/1980-62-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0008000000012337-64.dat	upx
behavioral1/memory/1980-65-0x0000000002600000-0x0000000002633000-memory.dmp	upx
behavioral1/memory/940-66-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0008000000012337-67.dat	upx
behavioral1/files/0x0008000000012337-69.dat	upx
behavioral1/files/0x000700000001267a-73.dat	upx
behavioral1/files/0x000700000001267a-74.dat	upx
behavioral1/files/0x000700000001267a-76.dat	upx
behavioral1/files/0x00070000000126a2-80.dat	upx
behavioral1/files/0x00070000000126a2-81.dat	upx
behavioral1/files/0x00070000000126a2-83.dat	upx
behavioral1/files/0x00070000000126c9-88.dat	upx
behavioral1/files/0x00070000000126c9-87.dat	upx
behavioral1/files/0x00070000000126c9-90.dat	upx
behavioral1/files/0x00070000000126a2-97.dat	upx
behavioral1/files/0x00070000000126c9-96.dat	upx
behavioral1/files/0x000700000001267a-95.dat	upx
behavioral1/files/0x0008000000012337-106.dat	upx
behavioral1/files/0x0008000000012322-104.dat	upx
behavioral1/files/0x000800000001234c-103.dat	upx
behavioral1/files/0x000800000001232f-102.dat	upx
behavioral1/files/0x000800000001232b-101.dat	upx
behavioral1/files/0x0008000000012326-100.dat	upx
behavioral1/files/0x0008000000012322-99.dat	upx
behavioral1/files/0x00070000000126f1-98.dat	upx
behavioral1/files/0x0008000000012322-111.dat	upx
behavioral1/files/0x000800000001234c-117.dat	upx
behavioral1/files/0x000800000001232f-116.dat	upx
behavioral1/files/0x000800000001232b-115.dat	upx
behavioral1/files/0x0008000000012326-114.dat	upx
behavioral1/files/0x00070000000126f1-113.dat	upx
behavioral1/files/0x0008000000012322-122.dat	upx
behavioral1/files/0x0008000000012337-127.dat	upx
behavioral1/files/0x0008000000012337-126.dat	upx
behavioral1/files/0x000800000001234c-135.dat	upx
behavioral1/files/0x000800000001232f-134.dat	upx
behavioral1/files/0x000800000001232b-133.dat	upx
behavioral1/files/0x0008000000012326-132.dat	upx
behavioral1/files/0x0008000000012337-131.dat	upx
behavioral1/files/0x0008000000012337-129.dat	upx
behavioral1/files/0x0008000000012337-140.dat	upx
behavioral1/memory/292-139-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x00070000000126f1-130.dat	upx
behavioral1/files/0x0008000000012337-143.dat	upx
behavioral1/files/0x0008000000012322-144.dat	upx
behavioral1/files/0x000800000001234c-149.dat	upx
behavioral1/files/0x000800000001232f-148.dat	upx
behavioral1/files/0x000800000001232b-147.dat	upx
behavioral1/files/0x0008000000012326-146.dat	upx
behavioral1/files/0x00070000000126f1-145.dat	upx
behavioral1/files/0x0008000000012337-156.dat	upx
behavioral1/memory/1964-155-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0008000000012337-153.dat	upx
behavioral1/files/0x0008000000012337-152.dat	upx
behavioral1/files/0x0008000000012322-160.dat	upx
behavioral1/memory/812-166-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x000700000001267a-172.dat	upx
behavioral1/memory/1292-170-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1492-168-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0008000000012326-174.dat	upx
behavioral1/files/0x00070000000126f1-173.dat	upx
behavioral1/memory/1948-171-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Loads dropped DLL 53 IoCs

pid	Process
1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
940	Tiwi.exe
940	Tiwi.exe
1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
1492	IExplorer.exe
1492	IExplorer.exe
1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
1948	winlogon.exe
1948	winlogon.exe
1492	IExplorer.exe
1492	IExplorer.exe
432	imoet.exe
432	imoet.exe
940	Tiwi.exe
940	Tiwi.exe
1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
1948	winlogon.exe
1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
940	Tiwi.exe
940	Tiwi.exe
1492	IExplorer.exe
1492	IExplorer.exe
432	imoet.exe
432	imoet.exe
1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
1948	winlogon.exe
1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
1948	winlogon.exe
1492	IExplorer.exe
1492	IExplorer.exe
1948	winlogon.exe
1948	winlogon.exe
940	Tiwi.exe
940	Tiwi.exe
1624	cute.exe
1624	cute.exe
432	imoet.exe
432	imoet.exe
432	imoet.exe
1624	cute.exe
1624	cute.exe
1624	cute.exe
1624	cute.exe
1624	cute.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	cute.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\G:	IExplorer.exe
File opened (read-only)	\??\P:	imoet.exe
File opened (read-only)	\??\S:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\N:	IExplorer.exe
File opened (read-only)	\??\P:	IExplorer.exe
File opened (read-only)	\??\X:	IExplorer.exe
File opened (read-only)	\??\S:	winlogon.exe
File opened (read-only)	\??\G:	cute.exe
File opened (read-only)	\??\L:	cute.exe
File opened (read-only)	\??\M:	cute.exe
File opened (read-only)	\??\H:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\R:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\T:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\N:	cute.exe
File opened (read-only)	\??\S:	Tiwi.exe
File opened (read-only)	\??\I:	cute.exe
File opened (read-only)	\??\T:	cute.exe
File opened (read-only)	\??\H:	IExplorer.exe
File opened (read-only)	\??\X:	winlogon.exe
File opened (read-only)	\??\B:	Tiwi.exe
File opened (read-only)	\??\X:	Tiwi.exe
File opened (read-only)	\??\U:	winlogon.exe
File opened (read-only)	\??\O:	cute.exe
File opened (read-only)	\??\R:	cute.exe
File opened (read-only)	\??\H:	Tiwi.exe
File opened (read-only)	\??\M:	imoet.exe
File opened (read-only)	\??\O:	imoet.exe
File opened (read-only)	\??\P:	cute.exe
File opened (read-only)	\??\L:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\P:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\K:	Tiwi.exe
File opened (read-only)	\??\O:	Tiwi.exe
File opened (read-only)	\??\I:	winlogon.exe
File opened (read-only)	\??\Y:	winlogon.exe
File opened (read-only)	\??\B:	imoet.exe
File opened (read-only)	\??\F:	imoet.exe
File opened (read-only)	\??\U:	cute.exe
File opened (read-only)	\??\K:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\W:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\E:	IExplorer.exe
File opened (read-only)	\??\R:	IExplorer.exe
File opened (read-only)	\??\V:	IExplorer.exe
File opened (read-only)	\??\Z:	Tiwi.exe
File opened (read-only)	\??\J:	winlogon.exe
File opened (read-only)	\??\F:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\Y:	Tiwi.exe
File opened (read-only)	\??\L:	winlogon.exe
File opened (read-only)	\??\T:	winlogon.exe
File opened (read-only)	\??\Q:	IExplorer.exe
File opened (read-only)	\??\Y:	IExplorer.exe
File opened (read-only)	\??\G:	Tiwi.exe
File opened (read-only)	\??\T:	Tiwi.exe
File opened (read-only)	\??\F:	winlogon.exe
File opened (read-only)	\??\K:	winlogon.exe
File opened (read-only)	\??\W:	imoet.exe
File opened (read-only)	\??\Y:	imoet.exe
File opened (read-only)	\??\Z:	IExplorer.exe
File opened (read-only)	\??\Q:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\U:	IExplorer.exe
File opened (read-only)	\??\E:	Tiwi.exe
File opened (read-only)	\??\Z:	imoet.exe
File opened (read-only)	\??\E:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\K:	IExplorer.exe

Modifies WinLogon 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	imoet.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened for modification	C:\autorun.inf	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe

Drops file in System32 directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	imoet.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	cute.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	cute.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	Tiwi.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	winlogon.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	imoet.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\shell.exe	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File created	C:\Windows\SysWOW64\tiwi.scr	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	cute.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\tiwi.exe	imoet.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	Tiwi.exe
File created	C:\Windows\tiwi.exe	Tiwi.exe
File created	C:\Windows\tiwi.exe	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	winlogon.exe
File opened for modification	C:\Windows\tiwi.exe	cute.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	imoet.exe
File created	C:\Windows\tiwi.exe	cute.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File created	C:\Windows\tiwi.exe	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	IExplorer.exe
File created	C:\Windows\tiwi.exe	winlogon.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 54 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Tiwi"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Tiwi"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\SwapMouseButtons = "1"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Tiwi"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Tiwi"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\SwapMouseButtons = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Tiwi"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Tiwi"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Tiwi"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\SwapMouseButtons = "1"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Tiwi"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\SwapMouseButtons = "1"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Tiwi"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\SwapMouseButtons = "1"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Tiwi"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\SwapMouseButtons = "1"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Tiwi"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\	cute.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	winlogon.exe

Modifies Internet Explorer start page 1 TTPs 6 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	cute.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
1948	winlogon.exe
940	Tiwi.exe
432	imoet.exe
1492	IExplorer.exe
1624	cute.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
940	Tiwi.exe
1492	IExplorer.exe
1948	winlogon.exe
432	imoet.exe
1624	cute.exe
292	Tiwi.exe
1964	Tiwi.exe
812	Tiwi.exe
1032	IExplorer.exe
1292	IExplorer.exe
1520	Tiwi.exe
1008	IExplorer.exe
1612	Tiwi.exe
1468	winlogon.exe
1000	IExplorer.exe
1916	winlogon.exe
324	winlogon.exe
1724	IExplorer.exe
896	winlogon.exe
1308	imoet.exe
880	imoet.exe
592	imoet.exe
1504	imoet.exe
824	winlogon.exe
1516	Tiwi.exe
1112	cute.exe
1552	cute.exe
1028	cute.exe
1992	cute.exe
892	IExplorer.exe
1776	imoet.exe
1520	cute.exe
1692	winlogon.exe
1608	imoet.exe
1224	cute.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 940	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	28
PID 1980 wrote to memory of 940	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	28
PID 1980 wrote to memory of 940	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	28
PID 1980 wrote to memory of 940	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	28
PID 1980 wrote to memory of 1492	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	29
PID 1980 wrote to memory of 1492	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	29
PID 1980 wrote to memory of 1492	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	29
PID 1980 wrote to memory of 1492	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	29
PID 1980 wrote to memory of 1948	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	30
PID 1980 wrote to memory of 1948	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	30
PID 1980 wrote to memory of 1948	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	30
PID 1980 wrote to memory of 1948	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	30
PID 1980 wrote to memory of 432	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	31
PID 1980 wrote to memory of 432	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	31
PID 1980 wrote to memory of 432	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	31
PID 1980 wrote to memory of 432	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	31
PID 1980 wrote to memory of 1624	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	32
PID 1980 wrote to memory of 1624	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	32
PID 1980 wrote to memory of 1624	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	32
PID 1980 wrote to memory of 1624	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	32
PID 1980 wrote to memory of 292	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	33
PID 1980 wrote to memory of 292	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	33
PID 1980 wrote to memory of 292	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	33
PID 1980 wrote to memory of 292	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	33
PID 940 wrote to memory of 1964	940	Tiwi.exe	34
PID 940 wrote to memory of 1964	940	Tiwi.exe	34
PID 940 wrote to memory of 1964	940	Tiwi.exe	34
PID 940 wrote to memory of 1964	940	Tiwi.exe	34
PID 1492 wrote to memory of 812	1492	IExplorer.exe	35
PID 1492 wrote to memory of 812	1492	IExplorer.exe	35
PID 1492 wrote to memory of 812	1492	IExplorer.exe	35
PID 1492 wrote to memory of 812	1492	IExplorer.exe	35
PID 940 wrote to memory of 1032	940	Tiwi.exe	36
PID 940 wrote to memory of 1032	940	Tiwi.exe	36
PID 940 wrote to memory of 1032	940	Tiwi.exe	36
PID 940 wrote to memory of 1032	940	Tiwi.exe	36
PID 1948 wrote to memory of 1520	1948	winlogon.exe	37
PID 1948 wrote to memory of 1520	1948	winlogon.exe	37
PID 1948 wrote to memory of 1520	1948	winlogon.exe	37
PID 1948 wrote to memory of 1520	1948	winlogon.exe	37
PID 1980 wrote to memory of 1292	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	38
PID 1980 wrote to memory of 1292	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	38
PID 1980 wrote to memory of 1292	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	38
PID 1980 wrote to memory of 1292	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	38
PID 1492 wrote to memory of 1008	1492	IExplorer.exe	40
PID 1492 wrote to memory of 1008	1492	IExplorer.exe	40
PID 1492 wrote to memory of 1008	1492	IExplorer.exe	40
PID 1492 wrote to memory of 1008	1492	IExplorer.exe	40
PID 432 wrote to memory of 1612	432	imoet.exe	39
PID 432 wrote to memory of 1612	432	imoet.exe	39
PID 432 wrote to memory of 1612	432	imoet.exe	39
PID 432 wrote to memory of 1612	432	imoet.exe	39
PID 1980 wrote to memory of 1468	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	41
PID 1980 wrote to memory of 1468	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	41
PID 1980 wrote to memory of 1468	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	41
PID 1980 wrote to memory of 1468	1980	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	41
PID 1948 wrote to memory of 1000	1948	winlogon.exe	43
PID 1948 wrote to memory of 1000	1948	winlogon.exe	43
PID 1948 wrote to memory of 1000	1948	winlogon.exe	43
PID 1948 wrote to memory of 1000	1948	winlogon.exe	43
PID 1492 wrote to memory of 1916	1492	IExplorer.exe	42
PID 1492 wrote to memory of 1916	1492	IExplorer.exe	42
PID 1492 wrote to memory of 1916	1492	IExplorer.exe	42
PID 1492 wrote to memory of 1916	1492	IExplorer.exe	42

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
"C:\Users\Admin\AppData\Local\Temp\f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1980
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:940
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1964
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1032
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:324
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:592
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1992
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1492
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:812
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1008
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1916
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:880
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1552
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1948
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1520
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1000
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:896
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1504
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1028
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:432
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1612
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1724
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:824
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1776
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1520
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1624
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1516
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:892
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1692
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1608
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1224
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:292
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:1292
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1468
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1308
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
cb320bd0917b186729e68d4e11e0c3b5

SHA1
5a45d81eaec763304471fafd511c4f7452bd47ba

SHA256
fb72e2f869a433af22fc00656c2056b7223168d05e8596c644ca39bcdd76b8ad

SHA512
e3892da82c9a3b176c1e642817eac8163b4bc3f7a95755ba132cd435e68d7a341ff7db6fd3acf761949ca18b6971875a64ee3d0ac09e67c85d33218a9b7f97e3

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
45bca62dcd0b0a2df26c811809e821f9

SHA1
a7038e5cbe38ef379f08f5f077218df79045bd1e

SHA256
fb80ee8fccd9e4de0129ff94312e68571a238b4b1ea107e1c1e778a456e23a22

SHA512
3a2cfbddb16aff62b9da8fd45e256f792539bfb25da483ebbb3b248bcb0517ace11e3d720bd9718b71c41a722ca57246c396a405ee4cb5ca0b8159917f049fc1

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
ee53e26e3e7a7142cbc219e5ba20cacc

SHA1
b45111a2a008e680f09349ebfad6e8ece9a4f5ea

SHA256
8ab9efe7c476393a30f7d65ec8c5b2b0f4c39ae47e8e445a87b71d62d361c790

SHA512
ef514179c2012483065346fcba50b0354bcb37422c49c091dce0ab16c3801ed80b513bc129f3c09340d32d2c8c09c1d63d4fd2575648f07c77c9869ccc0b16c4

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
cb320bd0917b186729e68d4e11e0c3b5

SHA1
5a45d81eaec763304471fafd511c4f7452bd47ba

SHA256
fb72e2f869a433af22fc00656c2056b7223168d05e8596c644ca39bcdd76b8ad

SHA512
e3892da82c9a3b176c1e642817eac8163b4bc3f7a95755ba132cd435e68d7a341ff7db6fd3acf761949ca18b6971875a64ee3d0ac09e67c85d33218a9b7f97e3

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
45bca62dcd0b0a2df26c811809e821f9

SHA1
a7038e5cbe38ef379f08f5f077218df79045bd1e

SHA256
fb80ee8fccd9e4de0129ff94312e68571a238b4b1ea107e1c1e778a456e23a22

SHA512
3a2cfbddb16aff62b9da8fd45e256f792539bfb25da483ebbb3b248bcb0517ace11e3d720bd9718b71c41a722ca57246c396a405ee4cb5ca0b8159917f049fc1

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
f822a189b7054401c00d21362df693b0

SHA1
a475fb205e47a81de6de22463bb32ee2e62ba035

SHA256
edbfaf3f28497c63a1a916ab4e9d1c3278e8d05852cdad9cb9862a7875a0c80e

SHA512
3309ad4986bac797dbe03a73cbb487a768ba1d29df1a217ca6a550e8c682c4aee81bc7c504085aec83cfdc6a9206fcd52313b0756ed432453fd6d309bcedb631

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
5646d558dd09c87b0e99faf64c1a6e47

SHA1
0341ecc2e9490f5ffed23584473753dee97ac58e

SHA256
64f88cb7dbdc1fe0432a2c83768464f0a75a59a02d30d84545f3ec55a72224f3

SHA512
7b0fbe671ea283d79e42757dec16d70658802cd834d2059988d415bb21ae26af43e7e0c853073b64ee1141de23591988e11b72aab20dcdeb9fde1fae576e675a

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
c906f640cdb2458162b80f926042cd7d

SHA1
32719ca88675b8683c981793933ea7de630c1037

SHA256
22f2b4825929d5ddd410c52923b366b69446746ec255bfe51d8d01bbbaeb1dd8

SHA512
176c749993c66488e4a2296aa0075201d025a31ab39d156592383c499985606e6cee9ae48902fe2a6ee4b891e7cdbc1e79e4b38c54799d3c682f095d454e91a0

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
100d91227f211aac32283ca8b12b8af8

SHA1
86c5326df7431dd6eb20ccef3bf99bac94748848

SHA256
abe76935d56c24c66cbd552d9a81b06244547619c570157465332bb4df5db9d6

SHA512
3005c21a22bbf3f572c9d864ffc0e80f5ac1954a624798a2159cf11ed9fa0ab73c5ef879f2eeddcdfea829e7a06b21bf8b4d3a8b20ddfb72333598bcded0a978

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
5677d3c0d053a18e31fc181ea73d60c3

SHA1
b39e67507f79b1c44e7fa003bd48c7616fb0a2c9

SHA256
1af44257559fa3ae0e9069fe6b4085e968d7bf4d8410c229675bb35a638fe570

SHA512
5897852b53ae7c287e44197adea0620fa81cd8b6bfd8cab9fb05b508265203298264af38dc66d060f2cb9afed172d2d6bdf6d8a2885685c940cfa22012b7bd30

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
ee53e26e3e7a7142cbc219e5ba20cacc

SHA1
b45111a2a008e680f09349ebfad6e8ece9a4f5ea

SHA256
8ab9efe7c476393a30f7d65ec8c5b2b0f4c39ae47e8e445a87b71d62d361c790

SHA512
ef514179c2012483065346fcba50b0354bcb37422c49c091dce0ab16c3801ed80b513bc129f3c09340d32d2c8c09c1d63d4fd2575648f07c77c9869ccc0b16c4

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
ee53e26e3e7a7142cbc219e5ba20cacc

SHA1
b45111a2a008e680f09349ebfad6e8ece9a4f5ea

SHA256
8ab9efe7c476393a30f7d65ec8c5b2b0f4c39ae47e8e445a87b71d62d361c790

SHA512
ef514179c2012483065346fcba50b0354bcb37422c49c091dce0ab16c3801ed80b513bc129f3c09340d32d2c8c09c1d63d4fd2575648f07c77c9869ccc0b16c4

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
45bca62dcd0b0a2df26c811809e821f9

SHA1
a7038e5cbe38ef379f08f5f077218df79045bd1e

SHA256
fb80ee8fccd9e4de0129ff94312e68571a238b4b1ea107e1c1e778a456e23a22

SHA512
3a2cfbddb16aff62b9da8fd45e256f792539bfb25da483ebbb3b248bcb0517ace11e3d720bd9718b71c41a722ca57246c396a405ee4cb5ca0b8159917f049fc1

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
8be20f4f7b72ad8f4a19a59e3aeb224b

SHA1
de47b7afaeaba59f0125fc882471897cc8c39fa7

SHA256
73c89135619b1b73f12f0ab3813623cef4f4bef95d63452b5210192ffc282b82

SHA512
192155b7860ab603e163582eb1d1e9096acfabaac2d3ff15aab95f0efeb8da1302247ea31b5005e57f4604810dccffd6cf7d88deb0d1d5b7f3dd209c5709ed19

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe

Filesize
85KB

MD5
ee53e26e3e7a7142cbc219e5ba20cacc

SHA1
b45111a2a008e680f09349ebfad6e8ece9a4f5ea

SHA256
8ab9efe7c476393a30f7d65ec8c5b2b0f4c39ae47e8e445a87b71d62d361c790

SHA512
ef514179c2012483065346fcba50b0354bcb37422c49c091dce0ab16c3801ed80b513bc129f3c09340d32d2c8c09c1d63d4fd2575648f07c77c9869ccc0b16c4

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
8be20f4f7b72ad8f4a19a59e3aeb224b

SHA1
de47b7afaeaba59f0125fc882471897cc8c39fa7

SHA256
73c89135619b1b73f12f0ab3813623cef4f4bef95d63452b5210192ffc282b82

SHA512
192155b7860ab603e163582eb1d1e9096acfabaac2d3ff15aab95f0efeb8da1302247ea31b5005e57f4604810dccffd6cf7d88deb0d1d5b7f3dd209c5709ed19

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
e7a2dfa9c14d6041cf2ee4e4a18d116a

SHA1
7a8f5be321691a1a25475c419c9e12042352daca

SHA256
b25b51e9ec3869894e653e055248de8503bd94e25a3193c4e9b54526d53c46ad

SHA512
6cc6b3edf7d2b04f2f0c86aa7cb7af485a7a0ad6362083915d8ecbbe5c07d4554b382f87d3345cd5c296ea69e4f4a5d393a55c0c1ca3a013f764ed6972de664a

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
ee53e26e3e7a7142cbc219e5ba20cacc

SHA1
b45111a2a008e680f09349ebfad6e8ece9a4f5ea

SHA256
8ab9efe7c476393a30f7d65ec8c5b2b0f4c39ae47e8e445a87b71d62d361c790

SHA512
ef514179c2012483065346fcba50b0354bcb37422c49c091dce0ab16c3801ed80b513bc129f3c09340d32d2c8c09c1d63d4fd2575648f07c77c9869ccc0b16c4

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
45bca62dcd0b0a2df26c811809e821f9

SHA1
a7038e5cbe38ef379f08f5f077218df79045bd1e

SHA256
fb80ee8fccd9e4de0129ff94312e68571a238b4b1ea107e1c1e778a456e23a22

SHA512
3a2cfbddb16aff62b9da8fd45e256f792539bfb25da483ebbb3b248bcb0517ace11e3d720bd9718b71c41a722ca57246c396a405ee4cb5ca0b8159917f049fc1

Download Submit
C:\Windows\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
5677d3c0d053a18e31fc181ea73d60c3

SHA1
b39e67507f79b1c44e7fa003bd48c7616fb0a2c9

SHA256
1af44257559fa3ae0e9069fe6b4085e968d7bf4d8410c229675bb35a638fe570

SHA512
5897852b53ae7c287e44197adea0620fa81cd8b6bfd8cab9fb05b508265203298264af38dc66d060f2cb9afed172d2d6bdf6d8a2885685c940cfa22012b7bd30

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
5677d3c0d053a18e31fc181ea73d60c3

SHA1
b39e67507f79b1c44e7fa003bd48c7616fb0a2c9

SHA256
1af44257559fa3ae0e9069fe6b4085e968d7bf4d8410c229675bb35a638fe570

SHA512
5897852b53ae7c287e44197adea0620fa81cd8b6bfd8cab9fb05b508265203298264af38dc66d060f2cb9afed172d2d6bdf6d8a2885685c940cfa22012b7bd30

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
5677d3c0d053a18e31fc181ea73d60c3

SHA1
b39e67507f79b1c44e7fa003bd48c7616fb0a2c9

SHA256
1af44257559fa3ae0e9069fe6b4085e968d7bf4d8410c229675bb35a638fe570

SHA512
5897852b53ae7c287e44197adea0620fa81cd8b6bfd8cab9fb05b508265203298264af38dc66d060f2cb9afed172d2d6bdf6d8a2885685c940cfa22012b7bd30

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
5677d3c0d053a18e31fc181ea73d60c3

SHA1
b39e67507f79b1c44e7fa003bd48c7616fb0a2c9

SHA256
1af44257559fa3ae0e9069fe6b4085e968d7bf4d8410c229675bb35a638fe570

SHA512
5897852b53ae7c287e44197adea0620fa81cd8b6bfd8cab9fb05b508265203298264af38dc66d060f2cb9afed172d2d6bdf6d8a2885685c940cfa22012b7bd30

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
5677d3c0d053a18e31fc181ea73d60c3

SHA1
b39e67507f79b1c44e7fa003bd48c7616fb0a2c9

SHA256
1af44257559fa3ae0e9069fe6b4085e968d7bf4d8410c229675bb35a638fe570

SHA512
5897852b53ae7c287e44197adea0620fa81cd8b6bfd8cab9fb05b508265203298264af38dc66d060f2cb9afed172d2d6bdf6d8a2885685c940cfa22012b7bd30

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
8be20f4f7b72ad8f4a19a59e3aeb224b

SHA1
de47b7afaeaba59f0125fc882471897cc8c39fa7

SHA256
73c89135619b1b73f12f0ab3813623cef4f4bef95d63452b5210192ffc282b82

SHA512
192155b7860ab603e163582eb1d1e9096acfabaac2d3ff15aab95f0efeb8da1302247ea31b5005e57f4604810dccffd6cf7d88deb0d1d5b7f3dd209c5709ed19

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
dc8c83976a46188afaa01625f58eb6d0

SHA1
4e6143ccf2e3accaeb7dd9d104fcaa8ab68271db

SHA256
b291da5b95cba40b903293c51283a6b6429cd0840f3d3c2d1ffb40a6727c7eaa

SHA512
0f7afb33840a583bd9a2678a85c556e7b27cd0fa3a2275fc4bcaff92c173c90e11fb187c30dc1ab27f34d1e91b8a6ccaaa60ec3b3ddc38b735978e0386baaaa5

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
ee53e26e3e7a7142cbc219e5ba20cacc

SHA1
b45111a2a008e680f09349ebfad6e8ece9a4f5ea

SHA256
8ab9efe7c476393a30f7d65ec8c5b2b0f4c39ae47e8e445a87b71d62d361c790

SHA512
ef514179c2012483065346fcba50b0354bcb37422c49c091dce0ab16c3801ed80b513bc129f3c09340d32d2c8c09c1d63d4fd2575648f07c77c9869ccc0b16c4

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
45bca62dcd0b0a2df26c811809e821f9

SHA1
a7038e5cbe38ef379f08f5f077218df79045bd1e

SHA256
fb80ee8fccd9e4de0129ff94312e68571a238b4b1ea107e1c1e778a456e23a22

SHA512
3a2cfbddb16aff62b9da8fd45e256f792539bfb25da483ebbb3b248bcb0517ace11e3d720bd9718b71c41a722ca57246c396a405ee4cb5ca0b8159917f049fc1

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
8be20f4f7b72ad8f4a19a59e3aeb224b

SHA1
de47b7afaeaba59f0125fc882471897cc8c39fa7

SHA256
73c89135619b1b73f12f0ab3813623cef4f4bef95d63452b5210192ffc282b82

SHA512
192155b7860ab603e163582eb1d1e9096acfabaac2d3ff15aab95f0efeb8da1302247ea31b5005e57f4604810dccffd6cf7d88deb0d1d5b7f3dd209c5709ed19

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
e7efe4bceaa7af67e2b332e1ae4a4c4f

SHA1
08da82dc33472d1ea858a746d285ceaeeb9c6baf

SHA256
8f43aee8ce9e7d5aef77483e2a47dfee8ed66cf7025c3b73ecf37895e4ebf57c

SHA512
8889c57f6c3ca42b72a556e6c8d5d9ba5598ebfac0172be86c11047e53f1ed8b9207380d1499f8634aa67c2af8c54f062ed9f824822c02f0a27187d3e06573a9

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
ee53e26e3e7a7142cbc219e5ba20cacc

SHA1
b45111a2a008e680f09349ebfad6e8ece9a4f5ea

SHA256
8ab9efe7c476393a30f7d65ec8c5b2b0f4c39ae47e8e445a87b71d62d361c790

SHA512
ef514179c2012483065346fcba50b0354bcb37422c49c091dce0ab16c3801ed80b513bc129f3c09340d32d2c8c09c1d63d4fd2575648f07c77c9869ccc0b16c4

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
45bca62dcd0b0a2df26c811809e821f9

SHA1
a7038e5cbe38ef379f08f5f077218df79045bd1e

SHA256
fb80ee8fccd9e4de0129ff94312e68571a238b4b1ea107e1c1e778a456e23a22

SHA512
3a2cfbddb16aff62b9da8fd45e256f792539bfb25da483ebbb3b248bcb0517ace11e3d720bd9718b71c41a722ca57246c396a405ee4cb5ca0b8159917f049fc1

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
8be20f4f7b72ad8f4a19a59e3aeb224b

SHA1
de47b7afaeaba59f0125fc882471897cc8c39fa7

SHA256
73c89135619b1b73f12f0ab3813623cef4f4bef95d63452b5210192ffc282b82

SHA512
192155b7860ab603e163582eb1d1e9096acfabaac2d3ff15aab95f0efeb8da1302247ea31b5005e57f4604810dccffd6cf7d88deb0d1d5b7f3dd209c5709ed19

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
8be20f4f7b72ad8f4a19a59e3aeb224b

SHA1
de47b7afaeaba59f0125fc882471897cc8c39fa7

SHA256
73c89135619b1b73f12f0ab3813623cef4f4bef95d63452b5210192ffc282b82

SHA512
192155b7860ab603e163582eb1d1e9096acfabaac2d3ff15aab95f0efeb8da1302247ea31b5005e57f4604810dccffd6cf7d88deb0d1d5b7f3dd209c5709ed19

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
8be20f4f7b72ad8f4a19a59e3aeb224b

SHA1
de47b7afaeaba59f0125fc882471897cc8c39fa7

SHA256
73c89135619b1b73f12f0ab3813623cef4f4bef95d63452b5210192ffc282b82

SHA512
192155b7860ab603e163582eb1d1e9096acfabaac2d3ff15aab95f0efeb8da1302247ea31b5005e57f4604810dccffd6cf7d88deb0d1d5b7f3dd209c5709ed19

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
8be20f4f7b72ad8f4a19a59e3aeb224b

SHA1
de47b7afaeaba59f0125fc882471897cc8c39fa7

SHA256
73c89135619b1b73f12f0ab3813623cef4f4bef95d63452b5210192ffc282b82

SHA512
192155b7860ab603e163582eb1d1e9096acfabaac2d3ff15aab95f0efeb8da1302247ea31b5005e57f4604810dccffd6cf7d88deb0d1d5b7f3dd209c5709ed19

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
8be20f4f7b72ad8f4a19a59e3aeb224b

SHA1
de47b7afaeaba59f0125fc882471897cc8c39fa7

SHA256
73c89135619b1b73f12f0ab3813623cef4f4bef95d63452b5210192ffc282b82

SHA512
192155b7860ab603e163582eb1d1e9096acfabaac2d3ff15aab95f0efeb8da1302247ea31b5005e57f4604810dccffd6cf7d88deb0d1d5b7f3dd209c5709ed19

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
8be20f4f7b72ad8f4a19a59e3aeb224b

SHA1
de47b7afaeaba59f0125fc882471897cc8c39fa7

SHA256
73c89135619b1b73f12f0ab3813623cef4f4bef95d63452b5210192ffc282b82

SHA512
192155b7860ab603e163582eb1d1e9096acfabaac2d3ff15aab95f0efeb8da1302247ea31b5005e57f4604810dccffd6cf7d88deb0d1d5b7f3dd209c5709ed19

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
8be20f4f7b72ad8f4a19a59e3aeb224b

SHA1
de47b7afaeaba59f0125fc882471897cc8c39fa7

SHA256
73c89135619b1b73f12f0ab3813623cef4f4bef95d63452b5210192ffc282b82

SHA512
192155b7860ab603e163582eb1d1e9096acfabaac2d3ff15aab95f0efeb8da1302247ea31b5005e57f4604810dccffd6cf7d88deb0d1d5b7f3dd209c5709ed19

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
8be20f4f7b72ad8f4a19a59e3aeb224b

SHA1
de47b7afaeaba59f0125fc882471897cc8c39fa7

SHA256
73c89135619b1b73f12f0ab3813623cef4f4bef95d63452b5210192ffc282b82

SHA512
192155b7860ab603e163582eb1d1e9096acfabaac2d3ff15aab95f0efeb8da1302247ea31b5005e57f4604810dccffd6cf7d88deb0d1d5b7f3dd209c5709ed19

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
8f82de28e8ce92dd8ac6d6a186beb523

SHA1
cb7b515c4980bfdf68c1e0ea752c77655a6d5847

SHA256
647d5c182f25f843fb1918b960b5e57a47d372f4ce9b70efdf3b66e4f84a6daa

SHA512
b8b504657a89afa24b757d4b13b2eeb493f1359fdcce9e3b51cc55ad7d342e0d38d96c0ff6b1b610d6a4a44ace28c61df7118a86bdcc53044014a29bb9f4392a

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
ee53e26e3e7a7142cbc219e5ba20cacc

SHA1
b45111a2a008e680f09349ebfad6e8ece9a4f5ea

SHA256
8ab9efe7c476393a30f7d65ec8c5b2b0f4c39ae47e8e445a87b71d62d361c790

SHA512
ef514179c2012483065346fcba50b0354bcb37422c49c091dce0ab16c3801ed80b513bc129f3c09340d32d2c8c09c1d63d4fd2575648f07c77c9869ccc0b16c4

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
45bca62dcd0b0a2df26c811809e821f9

SHA1
a7038e5cbe38ef379f08f5f077218df79045bd1e

SHA256
fb80ee8fccd9e4de0129ff94312e68571a238b4b1ea107e1c1e778a456e23a22

SHA512
3a2cfbddb16aff62b9da8fd45e256f792539bfb25da483ebbb3b248bcb0517ace11e3d720bd9718b71c41a722ca57246c396a405ee4cb5ca0b8159917f049fc1

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
cb320bd0917b186729e68d4e11e0c3b5

SHA1
5a45d81eaec763304471fafd511c4f7452bd47ba

SHA256
fb72e2f869a433af22fc00656c2056b7223168d05e8596c644ca39bcdd76b8ad

SHA512
e3892da82c9a3b176c1e642817eac8163b4bc3f7a95755ba132cd435e68d7a341ff7db6fd3acf761949ca18b6971875a64ee3d0ac09e67c85d33218a9b7f97e3

Download Submit
\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
cb320bd0917b186729e68d4e11e0c3b5

SHA1
5a45d81eaec763304471fafd511c4f7452bd47ba

SHA256
fb72e2f869a433af22fc00656c2056b7223168d05e8596c644ca39bcdd76b8ad

SHA512
e3892da82c9a3b176c1e642817eac8163b4bc3f7a95755ba132cd435e68d7a341ff7db6fd3acf761949ca18b6971875a64ee3d0ac09e67c85d33218a9b7f97e3

Download Submit
\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
cb320bd0917b186729e68d4e11e0c3b5

SHA1
5a45d81eaec763304471fafd511c4f7452bd47ba

SHA256
fb72e2f869a433af22fc00656c2056b7223168d05e8596c644ca39bcdd76b8ad

SHA512
e3892da82c9a3b176c1e642817eac8163b4bc3f7a95755ba132cd435e68d7a341ff7db6fd3acf761949ca18b6971875a64ee3d0ac09e67c85d33218a9b7f97e3

Download Submit
\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
45bca62dcd0b0a2df26c811809e821f9

SHA1
a7038e5cbe38ef379f08f5f077218df79045bd1e

SHA256
fb80ee8fccd9e4de0129ff94312e68571a238b4b1ea107e1c1e778a456e23a22

SHA512
3a2cfbddb16aff62b9da8fd45e256f792539bfb25da483ebbb3b248bcb0517ace11e3d720bd9718b71c41a722ca57246c396a405ee4cb5ca0b8159917f049fc1

Download Submit
\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
45bca62dcd0b0a2df26c811809e821f9

SHA1
a7038e5cbe38ef379f08f5f077218df79045bd1e

SHA256
fb80ee8fccd9e4de0129ff94312e68571a238b4b1ea107e1c1e778a456e23a22

SHA512
3a2cfbddb16aff62b9da8fd45e256f792539bfb25da483ebbb3b248bcb0517ace11e3d720bd9718b71c41a722ca57246c396a405ee4cb5ca0b8159917f049fc1

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
ee53e26e3e7a7142cbc219e5ba20cacc

SHA1
b45111a2a008e680f09349ebfad6e8ece9a4f5ea

SHA256
8ab9efe7c476393a30f7d65ec8c5b2b0f4c39ae47e8e445a87b71d62d361c790

SHA512
ef514179c2012483065346fcba50b0354bcb37422c49c091dce0ab16c3801ed80b513bc129f3c09340d32d2c8c09c1d63d4fd2575648f07c77c9869ccc0b16c4

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
ee53e26e3e7a7142cbc219e5ba20cacc

SHA1
b45111a2a008e680f09349ebfad6e8ece9a4f5ea

SHA256
8ab9efe7c476393a30f7d65ec8c5b2b0f4c39ae47e8e445a87b71d62d361c790

SHA512
ef514179c2012483065346fcba50b0354bcb37422c49c091dce0ab16c3801ed80b513bc129f3c09340d32d2c8c09c1d63d4fd2575648f07c77c9869ccc0b16c4

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
ee53e26e3e7a7142cbc219e5ba20cacc

SHA1
b45111a2a008e680f09349ebfad6e8ece9a4f5ea

SHA256
8ab9efe7c476393a30f7d65ec8c5b2b0f4c39ae47e8e445a87b71d62d361c790

SHA512
ef514179c2012483065346fcba50b0354bcb37422c49c091dce0ab16c3801ed80b513bc129f3c09340d32d2c8c09c1d63d4fd2575648f07c77c9869ccc0b16c4

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
5677d3c0d053a18e31fc181ea73d60c3

SHA1
b39e67507f79b1c44e7fa003bd48c7616fb0a2c9

SHA256
1af44257559fa3ae0e9069fe6b4085e968d7bf4d8410c229675bb35a638fe570

SHA512
5897852b53ae7c287e44197adea0620fa81cd8b6bfd8cab9fb05b508265203298264af38dc66d060f2cb9afed172d2d6bdf6d8a2885685c940cfa22012b7bd30

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
5677d3c0d053a18e31fc181ea73d60c3

SHA1
b39e67507f79b1c44e7fa003bd48c7616fb0a2c9

SHA256
1af44257559fa3ae0e9069fe6b4085e968d7bf4d8410c229675bb35a638fe570

SHA512
5897852b53ae7c287e44197adea0620fa81cd8b6bfd8cab9fb05b508265203298264af38dc66d060f2cb9afed172d2d6bdf6d8a2885685c940cfa22012b7bd30

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
5677d3c0d053a18e31fc181ea73d60c3

SHA1
b39e67507f79b1c44e7fa003bd48c7616fb0a2c9

SHA256
1af44257559fa3ae0e9069fe6b4085e968d7bf4d8410c229675bb35a638fe570

SHA512
5897852b53ae7c287e44197adea0620fa81cd8b6bfd8cab9fb05b508265203298264af38dc66d060f2cb9afed172d2d6bdf6d8a2885685c940cfa22012b7bd30

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
5677d3c0d053a18e31fc181ea73d60c3

SHA1
b39e67507f79b1c44e7fa003bd48c7616fb0a2c9

SHA256
1af44257559fa3ae0e9069fe6b4085e968d7bf4d8410c229675bb35a638fe570

SHA512
5897852b53ae7c287e44197adea0620fa81cd8b6bfd8cab9fb05b508265203298264af38dc66d060f2cb9afed172d2d6bdf6d8a2885685c940cfa22012b7bd30

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
5677d3c0d053a18e31fc181ea73d60c3

SHA1
b39e67507f79b1c44e7fa003bd48c7616fb0a2c9

SHA256
1af44257559fa3ae0e9069fe6b4085e968d7bf4d8410c229675bb35a638fe570

SHA512
5897852b53ae7c287e44197adea0620fa81cd8b6bfd8cab9fb05b508265203298264af38dc66d060f2cb9afed172d2d6bdf6d8a2885685c940cfa22012b7bd30

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
5677d3c0d053a18e31fc181ea73d60c3

SHA1
b39e67507f79b1c44e7fa003bd48c7616fb0a2c9

SHA256
1af44257559fa3ae0e9069fe6b4085e968d7bf4d8410c229675bb35a638fe570

SHA512
5897852b53ae7c287e44197adea0620fa81cd8b6bfd8cab9fb05b508265203298264af38dc66d060f2cb9afed172d2d6bdf6d8a2885685c940cfa22012b7bd30

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
5677d3c0d053a18e31fc181ea73d60c3

SHA1
b39e67507f79b1c44e7fa003bd48c7616fb0a2c9

SHA256
1af44257559fa3ae0e9069fe6b4085e968d7bf4d8410c229675bb35a638fe570

SHA512
5897852b53ae7c287e44197adea0620fa81cd8b6bfd8cab9fb05b508265203298264af38dc66d060f2cb9afed172d2d6bdf6d8a2885685c940cfa22012b7bd30

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
5677d3c0d053a18e31fc181ea73d60c3

SHA1
b39e67507f79b1c44e7fa003bd48c7616fb0a2c9

SHA256
1af44257559fa3ae0e9069fe6b4085e968d7bf4d8410c229675bb35a638fe570

SHA512
5897852b53ae7c287e44197adea0620fa81cd8b6bfd8cab9fb05b508265203298264af38dc66d060f2cb9afed172d2d6bdf6d8a2885685c940cfa22012b7bd30

Download Submit
memory/292-139-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/432-175-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/432-255-0x0000000002640000-0x0000000002673000-memory.dmp

Filesize
204KB

Download
memory/432-256-0x0000000002640000-0x0000000002673000-memory.dmp

Filesize
204KB

Download
memory/592-242-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/812-166-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/824-247-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/880-236-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/892-267-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/892-258-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/896-215-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/940-66-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/940-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1000-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1008-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1008-188-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1028-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1028-260-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1032-178-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1032-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1112-244-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1224-286-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1224-287-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1292-170-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1308-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1468-193-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1468-186-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1492-168-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1492-285-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1492-289-0x0000000002330000-0x0000000002363000-memory.dmp

Filesize
204KB

Download
memory/1492-290-0x0000000002330000-0x0000000002363000-memory.dmp

Filesize
204KB

Download
memory/1504-237-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1516-246-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1520-273-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1520-181-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1520-187-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1552-262-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1552-259-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1608-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1612-183-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1612-198-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1624-176-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1692-278-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1692-274-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1724-207-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1776-252-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1776-264-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1916-210-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1948-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1948-288-0x0000000002440000-0x0000000002473000-memory.dmp

Filesize
204KB

Download
memory/1948-171-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1948-291-0x0000000002440000-0x0000000002473000-memory.dmp

Filesize
204KB

Download
memory/1948-253-0x0000000002440000-0x0000000002473000-memory.dmp

Filesize
204KB

Download
memory/1964-155-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1980-62-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1980-251-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1980-63-0x0000000002600000-0x0000000002633000-memory.dmp

Filesize
204KB

Download
memory/1980-164-0x0000000002600000-0x0000000002633000-memory.dmp

Filesize
204KB

Download
memory/1980-56-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/1980-65-0x0000000002600000-0x0000000002633000-memory.dmp

Filesize
204KB

Download
memory/1992-265-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1992-261-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download