f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Size

85KB
MD5

83c57ec61d77a6fa49eaffe366bd1092
SHA1

b9758bbd40a650427067d43c2587f14d3cca0058
SHA256

f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd
SHA512

d6dcbe8571da5a9736813cd80d65fbe4757449256f1302d63f995ca6f5a33fb6f26a99e08bfe0b5131e42dd94308e1659191e7956a046d718d884fe8e9b060e2
SSDEEP

768:Nh5sxVPFXfgaDjof4ZgHqLNhldu8pGTUTY26TsGrn5wFbUzMsPzB5aPXwekfpb:NHsxFJfgaDjofVKn1pGwTJOlw1UrYwlb

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	imoet.exe

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Tiwi.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	imoet.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cute.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 35 IoCs

pid	Process
396	Tiwi.exe
3508	IExplorer.exe
1972	winlogon.exe
216	imoet.exe
1784	Tiwi.exe
1016	IExplorer.exe
932	winlogon.exe
516	imoet.exe
2216	Tiwi.exe
2860	Tiwi.exe
668	Tiwi.exe
2324	Tiwi.exe
4556	cute.exe
1408	IExplorer.exe
1144	IExplorer.exe
4900	IExplorer.exe
1552	IExplorer.exe
1444	winlogon.exe
60	winlogon.exe
5072	winlogon.exe
1352	imoet.exe
4420	winlogon.exe
1596	imoet.exe
2220	imoet.exe
4976	cute.exe
2160	imoet.exe
3740	cute.exe
1988	cute.exe
3904	cute.exe
4904	cute.exe
1704	Tiwi.exe
1844	IExplorer.exe
1560	winlogon.exe
2692	imoet.exe
4964	cute.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2468-134-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0001000000022de5-136.dat	upx
behavioral2/files/0x0001000000022de5-137.dat	upx
behavioral2/files/0x0001000000022dea-141.dat	upx
behavioral2/files/0x0001000000022dea-142.dat	upx
behavioral2/files/0x0001000000022dec-147.dat	upx
behavioral2/files/0x0001000000022dec-146.dat	upx
behavioral2/files/0x0001000000022ded-152.dat	upx
behavioral2/files/0x0001000000022ded-151.dat	upx
behavioral2/memory/396-155-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/3508-156-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/1972-158-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/216-159-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0001000000022de5-160.dat	upx
behavioral2/files/0x0001000000022dea-166.dat	upx
behavioral2/memory/1784-167-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0001000000022dee-170.dat	upx
behavioral2/files/0x0001000000022de7-173.dat	upx
behavioral2/files/0x0001000000022de8-174.dat	upx
behavioral2/files/0x0001000000022de6-172.dat	upx
behavioral2/files/0x0001000000022def-171.dat	upx
behavioral2/files/0x0001000000022deb-175.dat	upx
behavioral2/files/0x0001000000022dee-176.dat	upx
behavioral2/memory/1016-179-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0001000000022dec-178.dat	upx
behavioral2/files/0x0001000000022de8-185.dat	upx
behavioral2/files/0x0001000000022de7-183.dat	upx
behavioral2/files/0x0001000000022de6-182.dat	upx
behavioral2/files/0x0001000000022de6-186.dat	upx
behavioral2/files/0x0001000000022de8-188.dat	upx
behavioral2/files/0x0001000000022de7-187.dat	upx
behavioral2/files/0x0001000000022def-181.dat	upx
behavioral2/memory/932-189-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0001000000022deb-190.dat	upx
behavioral2/files/0x0001000000022ded-193.dat	upx
behavioral2/files/0x0001000000022dee-194.dat	upx
behavioral2/files/0x0001000000022de7-197.dat	upx
behavioral2/files/0x0001000000022de8-198.dat	upx
behavioral2/files/0x0001000000022de6-196.dat	upx
behavioral2/files/0x0001000000022de6-200.dat	upx
behavioral2/files/0x0001000000022de8-199.dat	upx
behavioral2/files/0x0001000000022def-195.dat	upx
behavioral2/files/0x0001000000022deb-201.dat	upx
behavioral2/files/0x0001000000022de5-204.dat	upx
behavioral2/files/0x0001000000022de7-205.dat	upx
behavioral2/files/0x0001000000022deb-207.dat	upx
behavioral2/files/0x0001000000022dee-209.dat	upx
behavioral2/files/0x0001000000022de6-211.dat	upx
behavioral2/files/0x0001000000022de7-212.dat	upx
behavioral2/files/0x0001000000022de8-213.dat	upx
behavioral2/files/0x0001000000022deb-214.dat	upx
behavioral2/files/0x0001000000022de8-215.dat	upx
behavioral2/files/0x0001000000022de6-216.dat	upx
behavioral2/files/0x0001000000022de7-217.dat	upx
behavioral2/files/0x0001000000022deb-218.dat	upx
behavioral2/files/0x0001000000022de5-221.dat	upx
behavioral2/files/0x0001000000022de6-224.dat	upx
behavioral2/files/0x0001000000022dee-223.dat	upx
behavioral2/files/0x0001000000022de7-226.dat	upx
behavioral2/files/0x0001000000022de8-227.dat	upx
behavioral2/files/0x0001000000022de6-225.dat	upx
behavioral2/files/0x0001000000022deb-230.dat	upx
behavioral2/memory/516-231-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0001000000022de5-232.dat	upx

Loads dropped DLL 6 IoCs

pid	Process
1784	Tiwi.exe
2324	Tiwi.exe
668	Tiwi.exe
2860	Tiwi.exe
2216	Tiwi.exe
1704	Tiwi.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	imoet.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\R:	winlogon.exe
File opened (read-only)	\??\T:	Tiwi.exe
File opened (read-only)	\??\P:	imoet.exe
File opened (read-only)	\??\R:	IExplorer.exe
File opened (read-only)	\??\Q:	Tiwi.exe
File opened (read-only)	\??\K:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\L:	winlogon.exe
File opened (read-only)	\??\P:	winlogon.exe
File opened (read-only)	\??\K:	cute.exe
File opened (read-only)	\??\Q:	cute.exe
File opened (read-only)	\??\P:	Tiwi.exe
File opened (read-only)	\??\B:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\H:	imoet.exe
File opened (read-only)	\??\J:	imoet.exe
File opened (read-only)	\??\B:	winlogon.exe
File opened (read-only)	\??\K:	IExplorer.exe
File opened (read-only)	\??\O:	Tiwi.exe
File opened (read-only)	\??\Y:	winlogon.exe
File opened (read-only)	\??\P:	IExplorer.exe
File opened (read-only)	\??\F:	cute.exe
File opened (read-only)	\??\H:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\T:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\K:	imoet.exe
File opened (read-only)	\??\Y:	imoet.exe
File opened (read-only)	\??\J:	winlogon.exe
File opened (read-only)	\??\F:	IExplorer.exe
File opened (read-only)	\??\E:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\O:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\F:	winlogon.exe
File opened (read-only)	\??\M:	imoet.exe
File opened (read-only)	\??\W:	IExplorer.exe
File opened (read-only)	\??\B:	Tiwi.exe
File opened (read-only)	\??\E:	winlogon.exe
File opened (read-only)	\??\G:	winlogon.exe
File opened (read-only)	\??\Q:	winlogon.exe
File opened (read-only)	\??\Z:	winlogon.exe
File opened (read-only)	\??\V:	Tiwi.exe
File opened (read-only)	\??\V:	cute.exe
File opened (read-only)	\??\I:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\S:	imoet.exe
File opened (read-only)	\??\X:	imoet.exe
File opened (read-only)	\??\Q:	IExplorer.exe
File opened (read-only)	\??\T:	IExplorer.exe
File opened (read-only)	\??\X:	IExplorer.exe
File opened (read-only)	\??\F:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\O:	imoet.exe
File opened (read-only)	\??\O:	IExplorer.exe
File opened (read-only)	\??\L:	Tiwi.exe
File opened (read-only)	\??\Y:	Tiwi.exe
File opened (read-only)	\??\W:	Tiwi.exe
File opened (read-only)	\??\Z:	Tiwi.exe
File opened (read-only)	\??\H:	IExplorer.exe
File opened (read-only)	\??\J:	cute.exe
File opened (read-only)	\??\Y:	cute.exe
File opened (read-only)	\??\L:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\M:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\R:	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened (read-only)	\??\W:	imoet.exe
File opened (read-only)	\??\U:	winlogon.exe
File opened (read-only)	\??\G:	IExplorer.exe
File opened (read-only)	\??\E:	cute.exe
File opened (read-only)	\??\M:	cute.exe
File opened (read-only)	\??\S:	cute.exe

Modifies WinLogon 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	winlogon.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened for modification	C:\autorun.inf	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe

Drops file in System32 directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	imoet.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	imoet.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	winlogon.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	cute.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\shell.exe	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	Tiwi.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	cute.exe
File created	C:\Windows\SysWOW64\tiwi.scr	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	winlogon.exe
File created	C:\Windows\tiwi.exe	imoet.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File created	C:\Windows\tiwi.exe	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
File created	C:\Windows\tiwi.exe	winlogon.exe
File opened for modification	C:\Windows\tiwi.exe	imoet.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	cute.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	IExplorer.exe
File created	C:\Windows\tiwi.exe	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	cute.exe
File opened for modification	C:\Windows\tiwi.exe	Tiwi.exe
File created	C:\Windows\tiwi.exe	Tiwi.exe

Modifies Control Panel 54 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Tiwi"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Tiwi"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Tiwi"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Tiwi"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\SwapMouseButtons = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\SwapMouseButtons = "1"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Tiwi"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\SwapMouseButtons = "1"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\SwapMouseButtons = "1"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Tiwi"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Tiwi"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\SwapMouseButtons = "1"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Tiwi"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\SwapMouseButtons = "1"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Mouse\	Tiwi.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	cute.exe

Modifies Internet Explorer start page 1 TTPs 6 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	imoet.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	cute.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
216	imoet.exe
396	Tiwi.exe
1972	winlogon.exe
3508	IExplorer.exe
4556	cute.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
396	Tiwi.exe
3508	IExplorer.exe
1972	winlogon.exe
216	imoet.exe
1784	Tiwi.exe
1016	IExplorer.exe
932	winlogon.exe
516	imoet.exe
668	Tiwi.exe
4556	cute.exe
2324	Tiwi.exe
2860	Tiwi.exe
2216	Tiwi.exe
1144	IExplorer.exe
1408	IExplorer.exe
4900	IExplorer.exe
1552	IExplorer.exe
1444	winlogon.exe
60	winlogon.exe
5072	winlogon.exe
4420	winlogon.exe
1352	imoet.exe
1596	imoet.exe
2220	imoet.exe
4976	cute.exe
2160	imoet.exe
3740	cute.exe
1988	cute.exe
3904	cute.exe
4904	cute.exe
1704	Tiwi.exe
1844	IExplorer.exe
1560	winlogon.exe
2692	imoet.exe
4964	cute.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 396	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	83
PID 2468 wrote to memory of 396	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	83
PID 2468 wrote to memory of 396	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	83
PID 2468 wrote to memory of 3508	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	84
PID 2468 wrote to memory of 3508	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	84
PID 2468 wrote to memory of 3508	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	84
PID 2468 wrote to memory of 1972	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	85
PID 2468 wrote to memory of 1972	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	85
PID 2468 wrote to memory of 1972	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	85
PID 2468 wrote to memory of 216	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	86
PID 2468 wrote to memory of 216	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	86
PID 2468 wrote to memory of 216	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	86
PID 2468 wrote to memory of 1784	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	87
PID 2468 wrote to memory of 1784	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	87
PID 2468 wrote to memory of 1784	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	87
PID 2468 wrote to memory of 1016	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	88
PID 2468 wrote to memory of 1016	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	88
PID 2468 wrote to memory of 1016	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	88
PID 2468 wrote to memory of 932	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	89
PID 2468 wrote to memory of 932	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	89
PID 2468 wrote to memory of 932	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	89
PID 2468 wrote to memory of 516	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	90
PID 2468 wrote to memory of 516	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	90
PID 2468 wrote to memory of 516	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	90
PID 396 wrote to memory of 2216	396	Tiwi.exe	91
PID 396 wrote to memory of 2216	396	Tiwi.exe	91
PID 396 wrote to memory of 2216	396	Tiwi.exe	91
PID 3508 wrote to memory of 2860	3508	IExplorer.exe	92
PID 3508 wrote to memory of 2860	3508	IExplorer.exe	92
PID 3508 wrote to memory of 2860	3508	IExplorer.exe	92
PID 1972 wrote to memory of 668	1972	winlogon.exe	93
PID 1972 wrote to memory of 668	1972	winlogon.exe	93
PID 1972 wrote to memory of 668	1972	winlogon.exe	93
PID 216 wrote to memory of 2324	216	imoet.exe	94
PID 216 wrote to memory of 2324	216	imoet.exe	94
PID 216 wrote to memory of 2324	216	imoet.exe	94
PID 2468 wrote to memory of 4556	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	95
PID 2468 wrote to memory of 4556	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	95
PID 2468 wrote to memory of 4556	2468	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe	95
PID 1972 wrote to memory of 1408	1972	winlogon.exe	96
PID 1972 wrote to memory of 1408	1972	winlogon.exe	96
PID 1972 wrote to memory of 1408	1972	winlogon.exe	96
PID 216 wrote to memory of 1144	216	imoet.exe	97
PID 216 wrote to memory of 1144	216	imoet.exe	97
PID 216 wrote to memory of 1144	216	imoet.exe	97
PID 3508 wrote to memory of 4900	3508	IExplorer.exe	98
PID 3508 wrote to memory of 4900	3508	IExplorer.exe	98
PID 3508 wrote to memory of 4900	3508	IExplorer.exe	98
PID 396 wrote to memory of 1552	396	Tiwi.exe	99
PID 396 wrote to memory of 1552	396	Tiwi.exe	99
PID 396 wrote to memory of 1552	396	Tiwi.exe	99
PID 216 wrote to memory of 1444	216	imoet.exe	100
PID 216 wrote to memory of 1444	216	imoet.exe	100
PID 216 wrote to memory of 1444	216	imoet.exe	100
PID 3508 wrote to memory of 60	3508	IExplorer.exe	102
PID 3508 wrote to memory of 60	3508	IExplorer.exe	102
PID 3508 wrote to memory of 60	3508	IExplorer.exe	102
PID 1972 wrote to memory of 5072	1972	winlogon.exe	101
PID 1972 wrote to memory of 5072	1972	winlogon.exe	101
PID 1972 wrote to memory of 5072	1972	winlogon.exe	101
PID 216 wrote to memory of 1352	216	imoet.exe	103
PID 216 wrote to memory of 1352	216	imoet.exe	103
PID 216 wrote to memory of 1352	216	imoet.exe	103
PID 396 wrote to memory of 4420	396	Tiwi.exe	104

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe
"C:\Users\Admin\AppData\Local\Temp\f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2468
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:396
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2216
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1552
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4420
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2160
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4904
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3508
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2860
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:4900
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:60
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2220
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3904
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1972
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:668
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1408
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5072
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1596
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1988
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:216
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2324
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1144
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1444
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1352
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3740
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1784
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:1016
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:932
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:516
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:4556
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1704
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1844
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1560
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2692
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4964
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
44fcd2db5ad74f09ec82a3e69f7b2af6

SHA1
3b255588570a320eab55f0621176dcb6855103fb

SHA256
7bf8f81470600b653b4f6dcf30237bc88d358f1b62a77366f58b889af0b9d106

SHA512
09c25e5cc15a9593c97b8cfdabf5ce05ddb01e7ac8988f1324c5600e7cff5bd3b474be60f02046378fcefe23445941b18af5d89a853dc855161bfa667244cea4

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
44fcd2db5ad74f09ec82a3e69f7b2af6

SHA1
3b255588570a320eab55f0621176dcb6855103fb

SHA256
7bf8f81470600b653b4f6dcf30237bc88d358f1b62a77366f58b889af0b9d106

SHA512
09c25e5cc15a9593c97b8cfdabf5ce05ddb01e7ac8988f1324c5600e7cff5bd3b474be60f02046378fcefe23445941b18af5d89a853dc855161bfa667244cea4

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
197e6883ad1085b17ed205bc1be33ad5

SHA1
b1c6b2561d409ff27b53e3e887f7023b183c5a06

SHA256
7d2ecc2d3c6dc9ed95ed5fe0eb0c7ec52c2719492c240a447046f38ab75ebd0d

SHA512
fd907a802d9b01bfc12aa3a9f41a7a973ca8b5d15b619982af25cd57fa51d4f6417bd298739b013455f1b760d5544deebc305b8a2d18835985ccf1e3d7abae37

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
197e6883ad1085b17ed205bc1be33ad5

SHA1
b1c6b2561d409ff27b53e3e887f7023b183c5a06

SHA256
7d2ecc2d3c6dc9ed95ed5fe0eb0c7ec52c2719492c240a447046f38ab75ebd0d

SHA512
fd907a802d9b01bfc12aa3a9f41a7a973ca8b5d15b619982af25cd57fa51d4f6417bd298739b013455f1b760d5544deebc305b8a2d18835985ccf1e3d7abae37

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
fb4b560f971317fa3f2629d739c9af89

SHA1
1481695f3bd526262681a022ec367018872bfa59

SHA256
16e8220486aa1c5a5132f11562e213c9896265a71e5d8021eecdc471f764990f

SHA512
cfb72dd4d7e2fd3aafb37a95a5656ff6ab5785e5d70c1fa29035fb884b6f2f189ba2b8af19876c82a6611622540c79448cbe8f932310fafee8d695310906f8b7

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
60a163a0c246edef052d24ccff7b1b86

SHA1
3738a80635452f93fc9dd7aef32b875287c0082f

SHA256
e9d773aae004ee10c5020822f1c43666ae65413c310c4f8ae2c2357179b2fc57

SHA512
c2b9f85cc23ee88861175ed5dc6c497d4147966100759a9919381b601b31d094a0c9ac069a73641c79352c0d686eec359588f743b7f3fcf187bf7fb7c0f5cb26

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
11b5e97f5704a7578df5e469bba70a52

SHA1
e31ed6f89c2be33e3ab2d72d88cb338f59e0122c

SHA256
06e9ce22bd19aec0e2b43bdc0c942cdd3621d501dbd9c021b11b9526961173e7

SHA512
b7cf9167bb2ad87dba839e1a18181ae46ae75707079f158188a8de42ba5495010889dd2e959479f54ec06e5822d69a3f0641954cfed9f735d268670c10f44a73

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
11b5e97f5704a7578df5e469bba70a52

SHA1
e31ed6f89c2be33e3ab2d72d88cb338f59e0122c

SHA256
06e9ce22bd19aec0e2b43bdc0c942cdd3621d501dbd9c021b11b9526961173e7

SHA512
b7cf9167bb2ad87dba839e1a18181ae46ae75707079f158188a8de42ba5495010889dd2e959479f54ec06e5822d69a3f0641954cfed9f735d268670c10f44a73

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
b48a1b0ac30093a08e0cecb830a30924

SHA1
eb0cd00c23e490d7155a841eae7f742be4b02932

SHA256
81ef41bf32deef88fa498cf26f1034c06e344a1d160707fcf8720db1b6c61b7f

SHA512
ab9a6d8d074a6a77c48b36885f43ed8356d3b16efb51826862d169ea21385180875f4d46d9a46b8dbf3538bb60f3556054966d657cd3df06929244f82ae28506

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
44fcd2db5ad74f09ec82a3e69f7b2af6

SHA1
3b255588570a320eab55f0621176dcb6855103fb

SHA256
7bf8f81470600b653b4f6dcf30237bc88d358f1b62a77366f58b889af0b9d106

SHA512
09c25e5cc15a9593c97b8cfdabf5ce05ddb01e7ac8988f1324c5600e7cff5bd3b474be60f02046378fcefe23445941b18af5d89a853dc855161bfa667244cea4

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
8eb549a5a8ad0b934fd8d2835c11bc02

SHA1
bf96e09701030467defd889571bb8c4eba56e327

SHA256
2426b492de522fac90c7a3d79a22796480ebe9954c4352c273547020365bf890

SHA512
a5af1bcda6c9ec6c4d9202e9391f0108d6aece603be4dbe74b748d9821046a38daf29876d573e88cf628d2064f8730037740713f4f1555605d37ad347ae9bc66

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
e2a614285be64f32cf3c214feff361c8

SHA1
e2fec77fa39e30aa5724ecb393008a3cf92cf1d3

SHA256
3f0e6e40d5afb9cc25ed7c7da7e26f78df057670a80864296dcf5dc0fab3b229

SHA512
57376efaa28b498eb0084a0640df3ba4bc5b963102e09379009db952498fad07fd3a49aecc5d36beda0ccecced76b505e7f328929399c4920136af710c915af9

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
150653948e770965421443bc08bea311

SHA1
0dd653055fc0b86a3742b541182887fd66f9e574

SHA256
f6925d439918ce8495d5b7ae5f9341a067f6da26777f3bf1ee322fe9dee5c17e

SHA512
c55e11ddaf991ce7f58d905ff736f7cbed14a211508bc8e8bae5b2e4c8770ceff7af19ce03ece1219d7e4129bf71cfc3b5a872346dcd153b383f4c79b06a8501

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
9573c6ecf213aa44b5a10993301f0416

SHA1
dd698dd8c98b0a804855e45cdc2f1b6ba97b7875

SHA256
92f7921b422f06e391c643d61f57f00f01bd0ab473e290ed9ff0241a252a5417

SHA512
2e2db9a1085b8af659e08d609f401a9f1e83536513639cca1755f62c9d8f1beb32b4ebe829bf3d5ece8a5e707f91ef7dfa92806975a7e34224b7217280249112

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
83c57ec61d77a6fa49eaffe366bd1092

SHA1
b9758bbd40a650427067d43c2587f14d3cca0058

SHA256
f25f6e1ca5d04d2a79f44682dee48f1ce49f7449553f2dae933a3c1b46277efd

SHA512
d6dcbe8571da5a9736813cd80d65fbe4757449256f1302d63f995ca6f5a33fb6f26a99e08bfe0b5131e42dd94308e1659191e7956a046d718d884fe8e9b060e2

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
60a163a0c246edef052d24ccff7b1b86

SHA1
3738a80635452f93fc9dd7aef32b875287c0082f

SHA256
e9d773aae004ee10c5020822f1c43666ae65413c310c4f8ae2c2357179b2fc57

SHA512
c2b9f85cc23ee88861175ed5dc6c497d4147966100759a9919381b601b31d094a0c9ac069a73641c79352c0d686eec359588f743b7f3fcf187bf7fb7c0f5cb26

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
98c4f335408d35000c9839bce74a7a9c

SHA1
66d0d861dada375c0df56c6f80bb5903c2efbb3d

SHA256
ecdf9c27f017d945035ce7f2be69e0925898e722dd6fb09a181ed47287eac541

SHA512
85cab3bf009eb1ce369fc0080dac4af8ce4d11b87985d5851fcb2372209fa07451eff127d46d55bd77582e1582c9f48c96473bc3d900282d65ab19442ca91d5f

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe

Filesize
85KB

MD5
197e6883ad1085b17ed205bc1be33ad5

SHA1
b1c6b2561d409ff27b53e3e887f7023b183c5a06

SHA256
7d2ecc2d3c6dc9ed95ed5fe0eb0c7ec52c2719492c240a447046f38ab75ebd0d

SHA512
fd907a802d9b01bfc12aa3a9f41a7a973ca8b5d15b619982af25cd57fa51d4f6417bd298739b013455f1b760d5544deebc305b8a2d18835985ccf1e3d7abae37

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
60a163a0c246edef052d24ccff7b1b86

SHA1
3738a80635452f93fc9dd7aef32b875287c0082f

SHA256
e9d773aae004ee10c5020822f1c43666ae65413c310c4f8ae2c2357179b2fc57

SHA512
c2b9f85cc23ee88861175ed5dc6c497d4147966100759a9919381b601b31d094a0c9ac069a73641c79352c0d686eec359588f743b7f3fcf187bf7fb7c0f5cb26

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
98c4f335408d35000c9839bce74a7a9c

SHA1
66d0d861dada375c0df56c6f80bb5903c2efbb3d

SHA256
ecdf9c27f017d945035ce7f2be69e0925898e722dd6fb09a181ed47287eac541

SHA512
85cab3bf009eb1ce369fc0080dac4af8ce4d11b87985d5851fcb2372209fa07451eff127d46d55bd77582e1582c9f48c96473bc3d900282d65ab19442ca91d5f

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
197e6883ad1085b17ed205bc1be33ad5

SHA1
b1c6b2561d409ff27b53e3e887f7023b183c5a06

SHA256
7d2ecc2d3c6dc9ed95ed5fe0eb0c7ec52c2719492c240a447046f38ab75ebd0d

SHA512
fd907a802d9b01bfc12aa3a9f41a7a973ca8b5d15b619982af25cd57fa51d4f6417bd298739b013455f1b760d5544deebc305b8a2d18835985ccf1e3d7abae37

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
f0bee91bff72b5b13d805cb87f05ac59

SHA1
9f3cf39b5cda49957541084a02a3c48e94a9554d

SHA256
93901009657471acc7f874d1b8edaedf5108ebc135a586b86011c5c8053679eb

SHA512
1a9ace846a3ed5266862e707224ffcd90618c8254ae717608620d6608f582c829abe70bfe04cd09c501b5ca5d969475e6c55f78a5864d9447b75faa99bc364f4

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
44fcd2db5ad74f09ec82a3e69f7b2af6

SHA1
3b255588570a320eab55f0621176dcb6855103fb

SHA256
7bf8f81470600b653b4f6dcf30237bc88d358f1b62a77366f58b889af0b9d106

SHA512
09c25e5cc15a9593c97b8cfdabf5ce05ddb01e7ac8988f1324c5600e7cff5bd3b474be60f02046378fcefe23445941b18af5d89a853dc855161bfa667244cea4

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
44fcd2db5ad74f09ec82a3e69f7b2af6

SHA1
3b255588570a320eab55f0621176dcb6855103fb

SHA256
7bf8f81470600b653b4f6dcf30237bc88d358f1b62a77366f58b889af0b9d106

SHA512
09c25e5cc15a9593c97b8cfdabf5ce05ddb01e7ac8988f1324c5600e7cff5bd3b474be60f02046378fcefe23445941b18af5d89a853dc855161bfa667244cea4

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
97b933b43027ef8ae18627a7c8fef0ff

SHA1
ab5464b70e8536e37cb26e0d776d029449280c33

SHA256
708e226101f3e0d77d2eb04a5772249dfbdfba30506dfb49aaccf49fb674360b

SHA512
666590e8306744bb5313a34f64783f2d1efbe5eae62cfa0114d198864d7cb0143923ade2fc0c29ac0f0513282f0715ea415db81e064f47a6f42c140e975da386

Download Submit
C:\Windows\MSVBVM60.DLL

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
98c4f335408d35000c9839bce74a7a9c

SHA1
66d0d861dada375c0df56c6f80bb5903c2efbb3d

SHA256
ecdf9c27f017d945035ce7f2be69e0925898e722dd6fb09a181ed47287eac541

SHA512
85cab3bf009eb1ce369fc0080dac4af8ce4d11b87985d5851fcb2372209fa07451eff127d46d55bd77582e1582c9f48c96473bc3d900282d65ab19442ca91d5f

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
98c4f335408d35000c9839bce74a7a9c

SHA1
66d0d861dada375c0df56c6f80bb5903c2efbb3d

SHA256
ecdf9c27f017d945035ce7f2be69e0925898e722dd6fb09a181ed47287eac541

SHA512
85cab3bf009eb1ce369fc0080dac4af8ce4d11b87985d5851fcb2372209fa07451eff127d46d55bd77582e1582c9f48c96473bc3d900282d65ab19442ca91d5f

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
98c4f335408d35000c9839bce74a7a9c

SHA1
66d0d861dada375c0df56c6f80bb5903c2efbb3d

SHA256
ecdf9c27f017d945035ce7f2be69e0925898e722dd6fb09a181ed47287eac541

SHA512
85cab3bf009eb1ce369fc0080dac4af8ce4d11b87985d5851fcb2372209fa07451eff127d46d55bd77582e1582c9f48c96473bc3d900282d65ab19442ca91d5f

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
60a163a0c246edef052d24ccff7b1b86

SHA1
3738a80635452f93fc9dd7aef32b875287c0082f

SHA256
e9d773aae004ee10c5020822f1c43666ae65413c310c4f8ae2c2357179b2fc57

SHA512
c2b9f85cc23ee88861175ed5dc6c497d4147966100759a9919381b601b31d094a0c9ac069a73641c79352c0d686eec359588f743b7f3fcf187bf7fb7c0f5cb26

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
98c4f335408d35000c9839bce74a7a9c

SHA1
66d0d861dada375c0df56c6f80bb5903c2efbb3d

SHA256
ecdf9c27f017d945035ce7f2be69e0925898e722dd6fb09a181ed47287eac541

SHA512
85cab3bf009eb1ce369fc0080dac4af8ce4d11b87985d5851fcb2372209fa07451eff127d46d55bd77582e1582c9f48c96473bc3d900282d65ab19442ca91d5f

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
5470eae947f898cb3cfc62e38fceed8b

SHA1
6f0fbfdb8bb6356f8a449c6d598f0da5259ca3c8

SHA256
131015c55f8949a3cd5c2c2c76ddcd420dd3747d3309cf6d69aa3f9f0120e7ab

SHA512
c1300e52b280f444072d12db6dd91aa0ef6d94d48f6d6b77fc43e6d4fef5437d5334391c3f6448d41bde2aa64ad78313d006139078d7b0258736477c5f8a72b4

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
197e6883ad1085b17ed205bc1be33ad5

SHA1
b1c6b2561d409ff27b53e3e887f7023b183c5a06

SHA256
7d2ecc2d3c6dc9ed95ed5fe0eb0c7ec52c2719492c240a447046f38ab75ebd0d

SHA512
fd907a802d9b01bfc12aa3a9f41a7a973ca8b5d15b619982af25cd57fa51d4f6417bd298739b013455f1b760d5544deebc305b8a2d18835985ccf1e3d7abae37

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
a4c7f089e6036470a51bc3ff79f8101f

SHA1
e8a57fedd2a263439fd1fe02a116ea129e78cc5b

SHA256
fd30893dca3ed43f630fe4b23a4c2cf4bfa2cc95be0f7f66ce6ee6dc13e5566c

SHA512
0a911cff972af5e00a4a06afe21c9e89083c1c50699940da62624ed66c2def44e503c55183a2369fa7d0c918ab42131d9cad0565421ff92b4996fff5e8e6ba85

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
a4c7f089e6036470a51bc3ff79f8101f

SHA1
e8a57fedd2a263439fd1fe02a116ea129e78cc5b

SHA256
fd30893dca3ed43f630fe4b23a4c2cf4bfa2cc95be0f7f66ce6ee6dc13e5566c

SHA512
0a911cff972af5e00a4a06afe21c9e89083c1c50699940da62624ed66c2def44e503c55183a2369fa7d0c918ab42131d9cad0565421ff92b4996fff5e8e6ba85

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
3bab110161b643471c41173f5d25e41c

SHA1
154c2b21c1a2e41ce8be166f197cd4541a682344

SHA256
15494724816c5a95495626db44d21e95c1d71c91d44c194fe3b55356e81ac091

SHA512
985c98f2fcb935e2c5a5e649677e4e229c234d3f7bdc5a2cbc9565c840408a07e8654b92159ebb9f7c429ed182b1f4408777ae596eec72669c094e4403dd09a8

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
acacba16e312e7d4bdcbd67a38e90e1e

SHA1
cc22f99644da0efe6e508fa74bacbce934dc59ee

SHA256
fd15e2b7edbb8107053aad54493be1d602c9ed2316fbf5d8df223dc54dacf1c3

SHA512
a4f1ccd06070fe4cc6aff7799b65a5202ec526a40bde6d60ece4b681580866c91a0ed735c4916ad948b58120dd559adb5458c29859adb3058f2ab19a1ef6aa38

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
60a163a0c246edef052d24ccff7b1b86

SHA1
3738a80635452f93fc9dd7aef32b875287c0082f

SHA256
e9d773aae004ee10c5020822f1c43666ae65413c310c4f8ae2c2357179b2fc57

SHA512
c2b9f85cc23ee88861175ed5dc6c497d4147966100759a9919381b601b31d094a0c9ac069a73641c79352c0d686eec359588f743b7f3fcf187bf7fb7c0f5cb26

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
98c4f335408d35000c9839bce74a7a9c

SHA1
66d0d861dada375c0df56c6f80bb5903c2efbb3d

SHA256
ecdf9c27f017d945035ce7f2be69e0925898e722dd6fb09a181ed47287eac541

SHA512
85cab3bf009eb1ce369fc0080dac4af8ce4d11b87985d5851fcb2372209fa07451eff127d46d55bd77582e1582c9f48c96473bc3d900282d65ab19442ca91d5f

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
fb431ec40f33f71bc555e70d8748308b

SHA1
72c85537e7b93913ba583fab26585670a4a19fd9

SHA256
33d6d1d06386177ecde503349c9707dadcb1d8f11f664a0f3a923ab8af69ebca

SHA512
e32e00006ebb34c7cbbdfeed3778b856a7ffdb7fb4ff4509743db6bb8a5b41054acc863a85e6124cf59176cf4e7e7e63eae1eb91eb9ac148030a2936253ec792

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
197e6883ad1085b17ed205bc1be33ad5

SHA1
b1c6b2561d409ff27b53e3e887f7023b183c5a06

SHA256
7d2ecc2d3c6dc9ed95ed5fe0eb0c7ec52c2719492c240a447046f38ab75ebd0d

SHA512
fd907a802d9b01bfc12aa3a9f41a7a973ca8b5d15b619982af25cd57fa51d4f6417bd298739b013455f1b760d5544deebc305b8a2d18835985ccf1e3d7abae37

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
197e6883ad1085b17ed205bc1be33ad5

SHA1
b1c6b2561d409ff27b53e3e887f7023b183c5a06

SHA256
7d2ecc2d3c6dc9ed95ed5fe0eb0c7ec52c2719492c240a447046f38ab75ebd0d

SHA512
fd907a802d9b01bfc12aa3a9f41a7a973ca8b5d15b619982af25cd57fa51d4f6417bd298739b013455f1b760d5544deebc305b8a2d18835985ccf1e3d7abae37

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
44fcd2db5ad74f09ec82a3e69f7b2af6

SHA1
3b255588570a320eab55f0621176dcb6855103fb

SHA256
7bf8f81470600b653b4f6dcf30237bc88d358f1b62a77366f58b889af0b9d106

SHA512
09c25e5cc15a9593c97b8cfdabf5ce05ddb01e7ac8988f1324c5600e7cff5bd3b474be60f02046378fcefe23445941b18af5d89a853dc855161bfa667244cea4

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
44fcd2db5ad74f09ec82a3e69f7b2af6

SHA1
3b255588570a320eab55f0621176dcb6855103fb

SHA256
7bf8f81470600b653b4f6dcf30237bc88d358f1b62a77366f58b889af0b9d106

SHA512
09c25e5cc15a9593c97b8cfdabf5ce05ddb01e7ac8988f1324c5600e7cff5bd3b474be60f02046378fcefe23445941b18af5d89a853dc855161bfa667244cea4

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
468eae9510c4af0b1fda90b2c056c2e0

SHA1
0f5d29fc8efef1616098d9fb4b4099ed208bb102

SHA256
790a19a9a3c1af4ce9fb4446163acbc38aea2570ace48f97d48d201c96db8345

SHA512
af21fce50dec63abb93c6aa7bcb176bc65b56d746f3c383e13ccf58d8ada494d97321dd5fc467bf554902a5d680d773270414cf0553078cdb2d276a96c52260b

Download Submit
C:\Windows\Tiwi.exe

Filesize
85KB

MD5
60a163a0c246edef052d24ccff7b1b86

SHA1
3738a80635452f93fc9dd7aef32b875287c0082f

SHA256
e9d773aae004ee10c5020822f1c43666ae65413c310c4f8ae2c2357179b2fc57

SHA512
c2b9f85cc23ee88861175ed5dc6c497d4147966100759a9919381b601b31d094a0c9ac069a73641c79352c0d686eec359588f743b7f3fcf187bf7fb7c0f5cb26

Download Submit
C:\Windows\msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
60a163a0c246edef052d24ccff7b1b86

SHA1
3738a80635452f93fc9dd7aef32b875287c0082f

SHA256
e9d773aae004ee10c5020822f1c43666ae65413c310c4f8ae2c2357179b2fc57

SHA512
c2b9f85cc23ee88861175ed5dc6c497d4147966100759a9919381b601b31d094a0c9ac069a73641c79352c0d686eec359588f743b7f3fcf187bf7fb7c0f5cb26

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
60a163a0c246edef052d24ccff7b1b86

SHA1
3738a80635452f93fc9dd7aef32b875287c0082f

SHA256
e9d773aae004ee10c5020822f1c43666ae65413c310c4f8ae2c2357179b2fc57

SHA512
c2b9f85cc23ee88861175ed5dc6c497d4147966100759a9919381b601b31d094a0c9ac069a73641c79352c0d686eec359588f743b7f3fcf187bf7fb7c0f5cb26

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
60a163a0c246edef052d24ccff7b1b86

SHA1
3738a80635452f93fc9dd7aef32b875287c0082f

SHA256
e9d773aae004ee10c5020822f1c43666ae65413c310c4f8ae2c2357179b2fc57

SHA512
c2b9f85cc23ee88861175ed5dc6c497d4147966100759a9919381b601b31d094a0c9ac069a73641c79352c0d686eec359588f743b7f3fcf187bf7fb7c0f5cb26

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
60a163a0c246edef052d24ccff7b1b86

SHA1
3738a80635452f93fc9dd7aef32b875287c0082f

SHA256
e9d773aae004ee10c5020822f1c43666ae65413c310c4f8ae2c2357179b2fc57

SHA512
c2b9f85cc23ee88861175ed5dc6c497d4147966100759a9919381b601b31d094a0c9ac069a73641c79352c0d686eec359588f743b7f3fcf187bf7fb7c0f5cb26

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
60a163a0c246edef052d24ccff7b1b86

SHA1
3738a80635452f93fc9dd7aef32b875287c0082f

SHA256
e9d773aae004ee10c5020822f1c43666ae65413c310c4f8ae2c2357179b2fc57

SHA512
c2b9f85cc23ee88861175ed5dc6c497d4147966100759a9919381b601b31d094a0c9ac069a73641c79352c0d686eec359588f743b7f3fcf187bf7fb7c0f5cb26

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
60a163a0c246edef052d24ccff7b1b86

SHA1
3738a80635452f93fc9dd7aef32b875287c0082f

SHA256
e9d773aae004ee10c5020822f1c43666ae65413c310c4f8ae2c2357179b2fc57

SHA512
c2b9f85cc23ee88861175ed5dc6c497d4147966100759a9919381b601b31d094a0c9ac069a73641c79352c0d686eec359588f743b7f3fcf187bf7fb7c0f5cb26

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
98c4f335408d35000c9839bce74a7a9c

SHA1
66d0d861dada375c0df56c6f80bb5903c2efbb3d

SHA256
ecdf9c27f017d945035ce7f2be69e0925898e722dd6fb09a181ed47287eac541

SHA512
85cab3bf009eb1ce369fc0080dac4af8ce4d11b87985d5851fcb2372209fa07451eff127d46d55bd77582e1582c9f48c96473bc3d900282d65ab19442ca91d5f

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
72f1a33fe7da302b9ddfe2a148e5f820

SHA1
bb22b69343166bd2f592e56e94875b8b9247fd76

SHA256
7a00b4c21f49d5f1ae673f2d362dfff76f7f3a5d28eea58ecade00298da31d8d

SHA512
655466f9bb5ec94aca7f7588e7bf2737913e94c757b5f24baf954df29579ec201b41040e2bd5c2dd0e6e8b66613e892546aff8fd1611437b43439d2d78ed1218

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
197e6883ad1085b17ed205bc1be33ad5

SHA1
b1c6b2561d409ff27b53e3e887f7023b183c5a06

SHA256
7d2ecc2d3c6dc9ed95ed5fe0eb0c7ec52c2719492c240a447046f38ab75ebd0d

SHA512
fd907a802d9b01bfc12aa3a9f41a7a973ca8b5d15b619982af25cd57fa51d4f6417bd298739b013455f1b760d5544deebc305b8a2d18835985ccf1e3d7abae37

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
197e6883ad1085b17ed205bc1be33ad5

SHA1
b1c6b2561d409ff27b53e3e887f7023b183c5a06

SHA256
7d2ecc2d3c6dc9ed95ed5fe0eb0c7ec52c2719492c240a447046f38ab75ebd0d

SHA512
fd907a802d9b01bfc12aa3a9f41a7a973ca8b5d15b619982af25cd57fa51d4f6417bd298739b013455f1b760d5544deebc305b8a2d18835985ccf1e3d7abae37

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
81000461babd6739af423eccd0f927d2

SHA1
f709c6ed762c42ed991e3f3a6e93c661d7477ab3

SHA256
57416f8229c0796e9dbab85c15959a88a5d64fa19f1749faa8ec25d1edc82917

SHA512
f4a7ead885d8426636c21ca894f5c3784f9fb2e29f14ed4eb625f4f555ed4cc9534d66423d4435bf24cef7af4d629312470982d902c1eb40926d9d0a9d80f3af

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
44fcd2db5ad74f09ec82a3e69f7b2af6

SHA1
3b255588570a320eab55f0621176dcb6855103fb

SHA256
7bf8f81470600b653b4f6dcf30237bc88d358f1b62a77366f58b889af0b9d106

SHA512
09c25e5cc15a9593c97b8cfdabf5ce05ddb01e7ac8988f1324c5600e7cff5bd3b474be60f02046378fcefe23445941b18af5d89a853dc855161bfa667244cea4

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
f60b0678e811eda2f71bc9f4b313cd23

SHA1
600c3e847f9b4f56d1459fb63ad61b3278a7891b

SHA256
3554dbe6f901bc0ae65501b706c01f2d041da64bcbf9e4811ebe380766ed86aa

SHA512
2d271eb62bde47003dd12b8c1beb8333aedd309a16510268483c9d0367e1cea1351484bd8acac8dc4a60b666c07546b2df13f19e2bffab93d98ac24e9bdf3c1f

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
f60b0678e811eda2f71bc9f4b313cd23

SHA1
600c3e847f9b4f56d1459fb63ad61b3278a7891b

SHA256
3554dbe6f901bc0ae65501b706c01f2d041da64bcbf9e4811ebe380766ed86aa

SHA512
2d271eb62bde47003dd12b8c1beb8333aedd309a16510268483c9d0367e1cea1351484bd8acac8dc4a60b666c07546b2df13f19e2bffab93d98ac24e9bdf3c1f

Download Submit
memory/60-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/216-159-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/216-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/396-155-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/396-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/516-237-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/516-231-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/668-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/932-189-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-179-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1144-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1352-294-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1408-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1444-273-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1552-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1560-333-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1596-295-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1704-325-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1784-167-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1844-328-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1972-158-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1972-344-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1988-314-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2160-312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2216-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2216-233-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2220-298-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2324-251-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2468-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2468-134-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2692-336-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2860-254-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3508-156-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3508-343-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3740-313-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4420-292-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4556-261-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4556-345-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4900-266-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4904-320-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4964-340-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4976-309-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5072-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download