572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203

Analysis

max time kernel
154s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Size

85KB
MD5

a2f8a7a0b20b07a68d2dea5489bc7e60
SHA1

66d151a2dd306d06eac2c456de34e10a0eb95b9e
SHA256

572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203
SHA512

c3d5aec23ddd244cd959f5a2f6b281b2e51ff5a0675c06b66bc6e1b787ec9884f4bf85b7f14fa4610e1552b952644d844fbfed4ded379c693a17905daf17ac96
SSDEEP

768:Nh5sxVPFXfgaDjof4ZgHqLNhldu8pGTUTY26TsGrn5wFbUzMsPzB5a2Xwekfp:NHsxFJfgaDjofVKn1pGwTJOlw1Urlwl

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	imoet.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Tiwi.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 35 IoCs

pid	Process
1156	Tiwi.exe
1772	Tiwi.exe
1980	IExplorer.exe
984	IExplorer.exe
568	winlogon.exe
1096	winlogon.exe
1768	Tiwi.exe
1192	imoet.exe
1656	Tiwi.exe
336	imoet.exe
1060	IExplorer.exe
912	cute.exe
1760	IExplorer.exe
1628	cute.exe
892	winlogon.exe
1800	Tiwi.exe
1688	Tiwi.exe
112	IExplorer.exe
1496	imoet.exe
1792	winlogon.exe
1492	Tiwi.exe
1744	IExplorer.exe
1672	imoet.exe
1380	IExplorer.exe
1080	winlogon.exe
1756	cute.exe
624	winlogon.exe
1856	imoet.exe
580	winlogon.exe
360	cute.exe
820	imoet.exe
1048	cute.exe
1600	imoet.exe
432	cute.exe
956	cute.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2036-54-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0007000000012732-59.dat	upx
behavioral1/files/0x00070000000132c1-63.dat	upx
behavioral1/memory/2036-64-0x00000000025C0000-0x00000000025F3000-memory.dmp	upx
behavioral1/memory/1156-65-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0007000000013382-66.dat	upx
behavioral1/files/0x0007000000012752-71.dat	upx
behavioral1/files/0x0007000000012732-70.dat	upx
behavioral1/files/0x0007000000013445-69.dat	upx
behavioral1/files/0x00070000000133a7-68.dat	upx
behavioral1/files/0x00070000000133ab-67.dat	upx
behavioral1/files/0x000700000001311d-72.dat	upx
behavioral1/files/0x00070000000131a9-73.dat	upx
behavioral1/files/0x00070000000132ee-74.dat	upx
behavioral1/files/0x00070000000132c1-75.dat	upx
behavioral1/files/0x0007000000012732-79.dat	upx
behavioral1/files/0x00070000000132c1-82.dat	upx
behavioral1/memory/1772-83-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x00070000000132c1-84.dat	upx
behavioral1/files/0x00070000000132c1-86.dat	upx
behavioral1/files/0x00070000000132c1-88.dat	upx
behavioral1/files/0x00070000000132c1-89.dat	upx
behavioral1/memory/1980-96-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/984-97-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0007000000013382-101.dat	upx
behavioral1/files/0x0007000000013382-100.dat	upx
behavioral1/memory/984-102-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0007000000013382-103.dat	upx
behavioral1/files/0x0007000000013382-104.dat	upx
behavioral1/files/0x0007000000013382-106.dat	upx
behavioral1/files/0x00070000000133ab-109.dat	upx
behavioral1/files/0x00070000000131a9-117.dat	upx
behavioral1/files/0x000700000001311d-116.dat	upx
behavioral1/files/0x0007000000012752-115.dat	upx
behavioral1/files/0x0007000000013382-112.dat	upx
behavioral1/files/0x00070000000132ee-120.dat	upx
behavioral1/files/0x0007000000013445-111.dat	upx
behavioral1/files/0x00070000000133a7-110.dat	upx
behavioral1/files/0x0007000000013382-108.dat	upx
behavioral1/files/0x0007000000012732-124.dat	upx
behavioral1/memory/568-126-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1096-127-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1768-128-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x00070000000133a7-130.dat	upx
behavioral1/files/0x00070000000133a7-131.dat	upx
behavioral1/files/0x00070000000133a7-132.dat	upx
behavioral1/files/0x00070000000133a7-134.dat	upx
behavioral1/files/0x00070000000133ab-139.dat	upx
behavioral1/files/0x000700000001311d-142.dat	upx
behavioral1/files/0x0007000000013445-140.dat	upx
behavioral1/files/0x00070000000131a9-143.dat	upx
behavioral1/files/0x00070000000132ee-144.dat	upx
behavioral1/memory/1096-148-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x00070000000133a7-157.dat	upx
behavioral1/files/0x00070000000132c1-158.dat	upx
behavioral1/files/0x00070000000132c1-155.dat	upx
behavioral1/files/0x00070000000132c1-154.dat	upx
behavioral1/files/0x00070000000133a7-151.dat	upx
behavioral1/files/0x0007000000012732-149.dat	upx
behavioral1/files/0x00070000000133a7-150.dat	upx
behavioral1/memory/1768-160-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1656-166-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1192-168-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/336-169-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Loads dropped DLL 53 IoCs

pid	Process
2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
1156	Tiwi.exe
1156	Tiwi.exe
2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
1156	Tiwi.exe
2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
1156	Tiwi.exe
2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
1156	Tiwi.exe
1156	Tiwi.exe
2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
1980	IExplorer.exe
1980	IExplorer.exe
1156	Tiwi.exe
1156	Tiwi.exe
568	winlogon.exe
2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
568	winlogon.exe
1980	IExplorer.exe
1980	IExplorer.exe
1192	imoet.exe
1192	imoet.exe
1980	IExplorer.exe
1980	IExplorer.exe
568	winlogon.exe
912	cute.exe
912	cute.exe
568	winlogon.exe
568	winlogon.exe
1192	imoet.exe
1192	imoet.exe
2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
1980	IExplorer.exe
1980	IExplorer.exe
912	cute.exe
912	cute.exe
1192	imoet.exe
2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
568	winlogon.exe
568	winlogon.exe
2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
1192	imoet.exe
1192	imoet.exe
912	cute.exe
912	cute.exe
2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
912	cute.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	imoet.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	cute.exe
File opened (read-only)	\??\S:	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
File opened (read-only)	\??\J:	winlogon.exe
File opened (read-only)	\??\K:	imoet.exe
File opened (read-only)	\??\I:	cute.exe
File opened (read-only)	\??\R:	Tiwi.exe
File opened (read-only)	\??\Q:	IExplorer.exe
File opened (read-only)	\??\E:	winlogon.exe
File opened (read-only)	\??\P:	imoet.exe
File opened (read-only)	\??\M:	cute.exe
File opened (read-only)	\??\Z:	cute.exe
File opened (read-only)	\??\Q:	Tiwi.exe
File opened (read-only)	\??\S:	Tiwi.exe
File opened (read-only)	\??\X:	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
File opened (read-only)	\??\G:	imoet.exe
File opened (read-only)	\??\F:	Tiwi.exe
File opened (read-only)	\??\B:	winlogon.exe
File opened (read-only)	\??\U:	winlogon.exe
File opened (read-only)	\??\K:	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
File opened (read-only)	\??\K:	IExplorer.exe
File opened (read-only)	\??\L:	IExplorer.exe
File opened (read-only)	\??\V:	cute.exe
File opened (read-only)	\??\Y:	Tiwi.exe
File opened (read-only)	\??\S:	imoet.exe
File opened (read-only)	\??\T:	imoet.exe
File opened (read-only)	\??\X:	winlogon.exe
File opened (read-only)	\??\T:	Tiwi.exe
File opened (read-only)	\??\I:	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
File opened (read-only)	\??\V:	IExplorer.exe
File opened (read-only)	\??\W:	imoet.exe
File opened (read-only)	\??\H:	cute.exe
File opened (read-only)	\??\N:	cute.exe
File opened (read-only)	\??\O:	IExplorer.exe
File opened (read-only)	\??\Q:	winlogon.exe
File opened (read-only)	\??\J:	imoet.exe
File opened (read-only)	\??\U:	imoet.exe
File opened (read-only)	\??\M:	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
File opened (read-only)	\??\Q:	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
File opened (read-only)	\??\I:	IExplorer.exe
File opened (read-only)	\??\Y:	IExplorer.exe
File opened (read-only)	\??\P:	cute.exe
File opened (read-only)	\??\T:	cute.exe
File opened (read-only)	\??\I:	Tiwi.exe
File opened (read-only)	\??\V:	Tiwi.exe
File opened (read-only)	\??\M:	winlogon.exe
File opened (read-only)	\??\O:	Tiwi.exe
File opened (read-only)	\??\E:	imoet.exe
File opened (read-only)	\??\Q:	cute.exe
File opened (read-only)	\??\F:	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
File opened (read-only)	\??\N:	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
File opened (read-only)	\??\Z:	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
File opened (read-only)	\??\B:	cute.exe
File opened (read-only)	\??\M:	IExplorer.exe
File opened (read-only)	\??\T:	winlogon.exe
File opened (read-only)	\??\H:	imoet.exe
File opened (read-only)	\??\I:	imoet.exe
File opened (read-only)	\??\G:	cute.exe
File opened (read-only)	\??\N:	winlogon.exe
File opened (read-only)	\??\P:	winlogon.exe
File opened (read-only)	\??\B:	imoet.exe
File opened (read-only)	\??\O:	winlogon.exe
File opened (read-only)	\??\Y:	cute.exe
File opened (read-only)	\??\K:	Tiwi.exe
File opened (read-only)	\??\L:	Tiwi.exe

Modifies WinLogon 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	cute.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	Tiwi.exe
File created	C:\autorun.inf	Tiwi.exe

Drops file in System32 directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	cute.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	cute.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	Tiwi.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	imoet.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	imoet.exe
File created	C:\Windows\SysWOW64\shell.exe	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
File created	C:\Windows\SysWOW64\tiwi.scr	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\tiwi.exe	cute.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	Tiwi.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	IExplorer.exe
File created	C:\Windows\tiwi.exe	winlogon.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	winlogon.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	cute.exe
File opened for modification	C:\Windows\tiwi.exe	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
File opened for modification	C:\Windows\tiwi.exe	Tiwi.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	imoet.exe
File created	C:\Windows\tiwi.exe	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	imoet.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 54 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\s2359 = "Tiwi"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Mouse\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\s2359 = "Tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Mouse\SwapMouseButtons = "1"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\s2359 = "Tiwi"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\s1159 = "Tiwi"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\s2359 = "Tiwi"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Mouse\	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Mouse\SwapMouseButtons = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Mouse\	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\s1159 = "Tiwi"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Mouse\SwapMouseButtons = "1"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\s1159 = "Tiwi"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Mouse\SwapMouseButtons = "1"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\s1159 = "Tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\s1159 = "Tiwi"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Mouse\	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Mouse\	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\s1159 = "Tiwi"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Mouse\SwapMouseButtons = "1"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Mouse\	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Mouse\SwapMouseButtons = "1"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\s2359 = "Tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\International\s2359 = "Tiwi"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	winlogon.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe

Modifies Internet Explorer start page 1 TTPs 6 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	cute.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
1156	Tiwi.exe
568	winlogon.exe
1192	imoet.exe
1980	IExplorer.exe
912	cute.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
1156	Tiwi.exe
1772	Tiwi.exe
1980	IExplorer.exe
984	IExplorer.exe
568	winlogon.exe
1096	winlogon.exe
1192	imoet.exe
1768	Tiwi.exe
1656	Tiwi.exe
1060	IExplorer.exe
336	imoet.exe
912	cute.exe
892	winlogon.exe
1760	IExplorer.exe
1628	cute.exe
1800	Tiwi.exe
1688	Tiwi.exe
112	IExplorer.exe
1496	imoet.exe
1792	winlogon.exe
1492	Tiwi.exe
1744	IExplorer.exe
1080	winlogon.exe
1672	imoet.exe
1380	IExplorer.exe
1756	cute.exe
624	winlogon.exe
1856	imoet.exe
580	winlogon.exe
360	cute.exe
820	imoet.exe
1048	cute.exe
1600	imoet.exe
432	cute.exe
956	cute.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1156	2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe	26
PID 2036 wrote to memory of 1156	2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe	26
PID 2036 wrote to memory of 1156	2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe	26
PID 2036 wrote to memory of 1156	2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe	26
PID 1156 wrote to memory of 1772	1156	Tiwi.exe	28
PID 1156 wrote to memory of 1772	1156	Tiwi.exe	28
PID 1156 wrote to memory of 1772	1156	Tiwi.exe	28
PID 1156 wrote to memory of 1772	1156	Tiwi.exe	28
PID 1156 wrote to memory of 1980	1156	Tiwi.exe	29
PID 1156 wrote to memory of 1980	1156	Tiwi.exe	29
PID 1156 wrote to memory of 1980	1156	Tiwi.exe	29
PID 1156 wrote to memory of 1980	1156	Tiwi.exe	29
PID 2036 wrote to memory of 984	2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe	27
PID 2036 wrote to memory of 984	2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe	27
PID 2036 wrote to memory of 984	2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe	27
PID 2036 wrote to memory of 984	2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe	27
PID 1156 wrote to memory of 568	1156	Tiwi.exe	30
PID 1156 wrote to memory of 568	1156	Tiwi.exe	30
PID 1156 wrote to memory of 568	1156	Tiwi.exe	30
PID 1156 wrote to memory of 568	1156	Tiwi.exe	30
PID 2036 wrote to memory of 1096	2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe	31
PID 2036 wrote to memory of 1096	2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe	31
PID 2036 wrote to memory of 1096	2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe	31
PID 2036 wrote to memory of 1096	2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe	31
PID 1980 wrote to memory of 1768	1980	IExplorer.exe	32
PID 1980 wrote to memory of 1768	1980	IExplorer.exe	32
PID 1980 wrote to memory of 1768	1980	IExplorer.exe	32
PID 1980 wrote to memory of 1768	1980	IExplorer.exe	32
PID 1156 wrote to memory of 1192	1156	Tiwi.exe	33
PID 1156 wrote to memory of 1192	1156	Tiwi.exe	33
PID 1156 wrote to memory of 1192	1156	Tiwi.exe	33
PID 1156 wrote to memory of 1192	1156	Tiwi.exe	33
PID 568 wrote to memory of 1656	568	winlogon.exe	36
PID 568 wrote to memory of 1656	568	winlogon.exe	36
PID 568 wrote to memory of 1656	568	winlogon.exe	36
PID 568 wrote to memory of 1656	568	winlogon.exe	36
PID 2036 wrote to memory of 336	2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe	34
PID 2036 wrote to memory of 336	2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe	34
PID 2036 wrote to memory of 336	2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe	34
PID 2036 wrote to memory of 336	2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe	34
PID 1980 wrote to memory of 1060	1980	IExplorer.exe	35
PID 1980 wrote to memory of 1060	1980	IExplorer.exe	35
PID 1980 wrote to memory of 1060	1980	IExplorer.exe	35
PID 1980 wrote to memory of 1060	1980	IExplorer.exe	35
PID 1156 wrote to memory of 912	1156	Tiwi.exe	37
PID 1156 wrote to memory of 912	1156	Tiwi.exe	37
PID 1156 wrote to memory of 912	1156	Tiwi.exe	37
PID 1156 wrote to memory of 912	1156	Tiwi.exe	37
PID 2036 wrote to memory of 1628	2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe	38
PID 2036 wrote to memory of 1628	2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe	38
PID 2036 wrote to memory of 1628	2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe	38
PID 2036 wrote to memory of 1628	2036	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe	38
PID 568 wrote to memory of 1760	568	winlogon.exe	40
PID 568 wrote to memory of 1760	568	winlogon.exe	40
PID 568 wrote to memory of 1760	568	winlogon.exe	40
PID 568 wrote to memory of 1760	568	winlogon.exe	40
PID 1980 wrote to memory of 892	1980	IExplorer.exe	39
PID 1980 wrote to memory of 892	1980	IExplorer.exe	39
PID 1980 wrote to memory of 892	1980	IExplorer.exe	39
PID 1980 wrote to memory of 892	1980	IExplorer.exe	39
PID 1192 wrote to memory of 1800	1192	imoet.exe	41
PID 1192 wrote to memory of 1800	1192	imoet.exe	41
PID 1192 wrote to memory of 1800	1192	imoet.exe	41
PID 1192 wrote to memory of 1800	1192	imoet.exe	41

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	imoet.exe

C:\Users\Admin\AppData\Local\Temp\572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe
"C:\Users\Admin\AppData\Local\Temp\572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2036
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1156
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1772
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies system executable filetype association
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Disables RegEdit via registry modification
    - Disables cmd.exe use via registry modification
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - Modifies WinLogon
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1980
  - - C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1768
  - - C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:1060
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:892
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1496
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1756
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Modifies system executable filetype association
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Disables RegEdit via registry modification
    - Disables cmd.exe use via registry modification
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - Modifies WinLogon
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:568
  - - C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1656
  - - C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:1760
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1792
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1672
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:360
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Modifies system executable filetype association
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Disables RegEdit via registry modification
    - Disables cmd.exe use via registry modification
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - Modifies WinLogon
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:1192
  - - C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1800
  - - C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:112
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1080
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1856
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1048
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Modifies system executable filetype association
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Disables RegEdit via registry modification
    - Disables cmd.exe use via registry modification
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - Modifies WinLogon
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:912
  - - C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1688
  - - C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:1744
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:624
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1600
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:956
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:984
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1096
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:336
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1628
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1492
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:1380
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:580
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:820
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
1087837b19e25afc7b4678a9ea0f3218

SHA1
e060b144ef496ce45ede993a0a2b609d29f4b39c

SHA256
9d323cb4702588873121c369bdbded8110c3391b5c0728c0152099d9d1616443

SHA512
b3f8bd270af04792ca6c20f55021d4488102cc11afef2757f752a772fbdeb777016d56ea46159f384bf77de3f603137cd74489e1800f8982d582f8b7469aa65f

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
351d668d477bc251d3ec0009a4703c37

SHA1
23f7022bc796dceddb6d2f383e958746b13afa05

SHA256
df63e787dd527ec9399aba7cba88ae22c2c5bb66b2a7ef9c093d35179b3141dc

SHA512
c2c8276bd42c00eb83cf5251ed50c4c75e6610e04828d74e1a8f65ea79172e734f138857d57ebb8e18c920f4bcf7efa0c6c9c4fd74528d62c2271e8fd42e63ad

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
351d668d477bc251d3ec0009a4703c37

SHA1
23f7022bc796dceddb6d2f383e958746b13afa05

SHA256
df63e787dd527ec9399aba7cba88ae22c2c5bb66b2a7ef9c093d35179b3141dc

SHA512
c2c8276bd42c00eb83cf5251ed50c4c75e6610e04828d74e1a8f65ea79172e734f138857d57ebb8e18c920f4bcf7efa0c6c9c4fd74528d62c2271e8fd42e63ad

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
311571fd5935cb4e7a1b2fb8891f9c5d

SHA1
a19af272de99d7e7069a77e141be42cb249b7349

SHA256
65793f31ef50232a2e162df5f3dee416abf73d47cb7daee7ff9c47964953bbe0

SHA512
97f3ed94a3e501f841842115fbbbef807d9d4ef689bdbb5f3218e07b37cb7e27ed9ad5cf2ca2336e1edd2de9fc11faa2d15b34421d5aa0b15473fcd685744ad6

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
311571fd5935cb4e7a1b2fb8891f9c5d

SHA1
a19af272de99d7e7069a77e141be42cb249b7349

SHA256
65793f31ef50232a2e162df5f3dee416abf73d47cb7daee7ff9c47964953bbe0

SHA512
97f3ed94a3e501f841842115fbbbef807d9d4ef689bdbb5f3218e07b37cb7e27ed9ad5cf2ca2336e1edd2de9fc11faa2d15b34421d5aa0b15473fcd685744ad6

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
d0668dee69a95703c69d9e09b8ce534f

SHA1
af83760c9702095eef9ca00b3c1c3cc6b04af6d9

SHA256
c21c59a0319ecad81d7ced4d78fcd3fc10f08f7eda95d9397d069d1c320cb813

SHA512
aa639c123635d3462d9bc4b008fb9c615f28133d7b5358565be15c01120da2dc78f0d52e5b5a4aa3c1e843ccfe0708319d7bfa05008d3588702282822f61287e

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
319e2971f51b2cc25f27f965283b25ad

SHA1
b3a6446a541ff642cb33e8b51de2052233c66bf6

SHA256
1cfc6c9ff9e38add40429cb77cf13334f9b7daf9391c30ef2049a602d18b82d2

SHA512
ff176bd8bc0ac686dc06a8bac347557d8a06e31afa922f23454bb8abb954df731eb58463e79435ac91e636a9b259943156a07b4b9d0709f7d339043b8f70b96a

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
1087837b19e25afc7b4678a9ea0f3218

SHA1
e060b144ef496ce45ede993a0a2b609d29f4b39c

SHA256
9d323cb4702588873121c369bdbded8110c3391b5c0728c0152099d9d1616443

SHA512
b3f8bd270af04792ca6c20f55021d4488102cc11afef2757f752a772fbdeb777016d56ea46159f384bf77de3f603137cd74489e1800f8982d582f8b7469aa65f

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
ee94c178abbcbb26bceca5e49a52cb0c

SHA1
7841b9113d0db7e3a6a4a028b08c7a3437a85724

SHA256
2c9ba38b5adf74005c02b786b9f762113fc87a2a5f89d6c474b8d8f90d5a578c

SHA512
f576b6c1af325feed70eefbf357fc11519643e7b31f1ff5e0aad365f26b5337d39b7fb5709edd0c616193494907a8f39f24efd4f498d07913f2466338649e34d

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
d35be0e5ca15d506bcd01c42a7d2437a

SHA1
22847ef03f05d37fd45b19c003a6ce33859caf3d

SHA256
8fce87794dbe603d88c078fe15684e920b022e9a6345fed3e01eb58658ec045c

SHA512
5c04b449721cbad962b568320faa0d5e0f4bae792f1cd022e4347ad46b6eda15b5055a4202832465b26b0f02601dc234ebfa5bdf474a6b79d271d88906e4cb16

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
351d668d477bc251d3ec0009a4703c37

SHA1
23f7022bc796dceddb6d2f383e958746b13afa05

SHA256
df63e787dd527ec9399aba7cba88ae22c2c5bb66b2a7ef9c093d35179b3141dc

SHA512
c2c8276bd42c00eb83cf5251ed50c4c75e6610e04828d74e1a8f65ea79172e734f138857d57ebb8e18c920f4bcf7efa0c6c9c4fd74528d62c2271e8fd42e63ad

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
ad6295657635ecb40a65649873849ae6

SHA1
88fedc10fcfb95ffeee6f3faf58cb1deca1b8925

SHA256
d0a22ac1606030895e3d9452f421023671a6e9ce904e407e77cbc1d1b2916f4d

SHA512
63cc8799e6f0fca210f0cbaec65ce9a6ad61e56660bb8746a596e2bbe78bb8b3983c5cfd7a5b66d779e0bef148ab2510451d75fcbc09692d36e953bd1049f79b

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
6be578175b32039c13187ed2c77635b2

SHA1
ad064f40408422950b03c10eec6e20cdd1614b52

SHA256
5e366c697ceccf4a8a759fe161880edc3388f77aaad7faf94dcc55d1e20ab571

SHA512
e44a072a47cb3724453a59f65bb939436c5986c94a38bcecb579c06c71861b686bce0f0e3bd094faa96c72ceeb4a79806797cf88c339e7ae30d16810a236aa48

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
a95ba1410abf9f5f2315f36ab314e7fe

SHA1
dbd40982afa0767d5ff69bb4717853eb5f82b852

SHA256
4bce348b59891caa2a5a88801b3860dc47bfbc32558a7a0921721ad0b78b4464

SHA512
3d90e8f9088d956620adcbf73ede2558bd2e2518bbf82d63317ace73745cf332631f85f9457998a4b0301f474a309bdd0349343be6bec24115355e677371d7fb

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
6be578175b32039c13187ed2c77635b2

SHA1
ad064f40408422950b03c10eec6e20cdd1614b52

SHA256
5e366c697ceccf4a8a759fe161880edc3388f77aaad7faf94dcc55d1e20ab571

SHA512
e44a072a47cb3724453a59f65bb939436c5986c94a38bcecb579c06c71861b686bce0f0e3bd094faa96c72ceeb4a79806797cf88c339e7ae30d16810a236aa48

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
be2609ee078c276ec2d4c47a71e12b30

SHA1
20f5a3dba964bfd9121d999d9d256e91f4e21530

SHA256
8eb22c6568dc6a963c9832aefd4926170eda5ba0f9b9cbfb38711d6d30ee7d9f

SHA512
c523da9b24572f446e16f478dec61c5c76078666eaf37afd2a84da3066c5a08009e3525e10cdaa7bdccbb4a9eb94d947a768cc931522610add91b6669591c943

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
7605f54f4f5ad9838604d59db6f9f1ce

SHA1
4d4c4acacbc08db2941416e08fbb839263cc1a1c

SHA256
837daa1ce94ac5bcfb757ccfc2ab739d066db3d9958f13245b81c57f6d35a02c

SHA512
b676a7d8ab84d5bddefe70a4278abd2f956253f04994f0777c4129984989ad972c9957978fb6138d1ac7d06658ff0812ef203e1ae5da538082dd41af73e08f95

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
a2f8a7a0b20b07a68d2dea5489bc7e60

SHA1
66d151a2dd306d06eac2c456de34e10a0eb95b9e

SHA256
572d2474d141f43dd0f8767d6c515277e337fd016ce3bf4e62e9eccdf35e0203

SHA512
c3d5aec23ddd244cd959f5a2f6b281b2e51ff5a0675c06b66bc6e1b787ec9884f4bf85b7f14fa4610e1552b952644d844fbfed4ded379c693a17905daf17ac96

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe

Filesize
85KB

MD5
311571fd5935cb4e7a1b2fb8891f9c5d

SHA1
a19af272de99d7e7069a77e141be42cb249b7349

SHA256
65793f31ef50232a2e162df5f3dee416abf73d47cb7daee7ff9c47964953bbe0

SHA512
97f3ed94a3e501f841842115fbbbef807d9d4ef689bdbb5f3218e07b37cb7e27ed9ad5cf2ca2336e1edd2de9fc11faa2d15b34421d5aa0b15473fcd685744ad6

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe

Filesize
85KB

MD5
9dc48690fca665921c3394916c3af93d

SHA1
5f73ee3c59ff42edeb9d3e2ce55b28886c5c810e

SHA256
cafbecbed0a5fdb5fe7e508eca44a13b4902f723ad83eb8558f28e7ff7dd4a9e

SHA512
8d94c34f3e78fed14bd9449eac30ccf13c7231e67f8dcb6d830a6385a914cbffb13876cdc20d713e7b9dc08a8e9bfa7a043398f00729f1ad1cf3fb1aba2de9ec

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
7605f54f4f5ad9838604d59db6f9f1ce

SHA1
4d4c4acacbc08db2941416e08fbb839263cc1a1c

SHA256
837daa1ce94ac5bcfb757ccfc2ab739d066db3d9958f13245b81c57f6d35a02c

SHA512
b676a7d8ab84d5bddefe70a4278abd2f956253f04994f0777c4129984989ad972c9957978fb6138d1ac7d06658ff0812ef203e1ae5da538082dd41af73e08f95

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
311571fd5935cb4e7a1b2fb8891f9c5d

SHA1
a19af272de99d7e7069a77e141be42cb249b7349

SHA256
65793f31ef50232a2e162df5f3dee416abf73d47cb7daee7ff9c47964953bbe0

SHA512
97f3ed94a3e501f841842115fbbbef807d9d4ef689bdbb5f3218e07b37cb7e27ed9ad5cf2ca2336e1edd2de9fc11faa2d15b34421d5aa0b15473fcd685744ad6

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
be2609ee078c276ec2d4c47a71e12b30

SHA1
20f5a3dba964bfd9121d999d9d256e91f4e21530

SHA256
8eb22c6568dc6a963c9832aefd4926170eda5ba0f9b9cbfb38711d6d30ee7d9f

SHA512
c523da9b24572f446e16f478dec61c5c76078666eaf37afd2a84da3066c5a08009e3525e10cdaa7bdccbb4a9eb94d947a768cc931522610add91b6669591c943

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
7605f54f4f5ad9838604d59db6f9f1ce

SHA1
4d4c4acacbc08db2941416e08fbb839263cc1a1c

SHA256
837daa1ce94ac5bcfb757ccfc2ab739d066db3d9958f13245b81c57f6d35a02c

SHA512
b676a7d8ab84d5bddefe70a4278abd2f956253f04994f0777c4129984989ad972c9957978fb6138d1ac7d06658ff0812ef203e1ae5da538082dd41af73e08f95

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
7605f54f4f5ad9838604d59db6f9f1ce

SHA1
4d4c4acacbc08db2941416e08fbb839263cc1a1c

SHA256
837daa1ce94ac5bcfb757ccfc2ab739d066db3d9958f13245b81c57f6d35a02c

SHA512
b676a7d8ab84d5bddefe70a4278abd2f956253f04994f0777c4129984989ad972c9957978fb6138d1ac7d06658ff0812ef203e1ae5da538082dd41af73e08f95

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
7605f54f4f5ad9838604d59db6f9f1ce

SHA1
4d4c4acacbc08db2941416e08fbb839263cc1a1c

SHA256
837daa1ce94ac5bcfb757ccfc2ab739d066db3d9958f13245b81c57f6d35a02c

SHA512
b676a7d8ab84d5bddefe70a4278abd2f956253f04994f0777c4129984989ad972c9957978fb6138d1ac7d06658ff0812ef203e1ae5da538082dd41af73e08f95

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
7605f54f4f5ad9838604d59db6f9f1ce

SHA1
4d4c4acacbc08db2941416e08fbb839263cc1a1c

SHA256
837daa1ce94ac5bcfb757ccfc2ab739d066db3d9958f13245b81c57f6d35a02c

SHA512
b676a7d8ab84d5bddefe70a4278abd2f956253f04994f0777c4129984989ad972c9957978fb6138d1ac7d06658ff0812ef203e1ae5da538082dd41af73e08f95

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
7605f54f4f5ad9838604d59db6f9f1ce

SHA1
4d4c4acacbc08db2941416e08fbb839263cc1a1c

SHA256
837daa1ce94ac5bcfb757ccfc2ab739d066db3d9958f13245b81c57f6d35a02c

SHA512
b676a7d8ab84d5bddefe70a4278abd2f956253f04994f0777c4129984989ad972c9957978fb6138d1ac7d06658ff0812ef203e1ae5da538082dd41af73e08f95

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
bff8200d46813563d44bca1428dfddd7

SHA1
cd70405b8345effc5240e9134bcce2950adc0b73

SHA256
ee8345f43193f1711c9b19f5838e9fdc39ae6bcc0607129ace490d2e64ed031c

SHA512
f4d6119c37dd7bdfd6d45a866580d896f2aa0ff69712eaec0dfeaa35399a243bd123b41763c4eb9cbca3e2379f848dd5260e218affdc8c82f906add4471e2b26

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
be2609ee078c276ec2d4c47a71e12b30

SHA1
20f5a3dba964bfd9121d999d9d256e91f4e21530

SHA256
8eb22c6568dc6a963c9832aefd4926170eda5ba0f9b9cbfb38711d6d30ee7d9f

SHA512
c523da9b24572f446e16f478dec61c5c76078666eaf37afd2a84da3066c5a08009e3525e10cdaa7bdccbb4a9eb94d947a768cc931522610add91b6669591c943

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
7605f54f4f5ad9838604d59db6f9f1ce

SHA1
4d4c4acacbc08db2941416e08fbb839263cc1a1c

SHA256
837daa1ce94ac5bcfb757ccfc2ab739d066db3d9958f13245b81c57f6d35a02c

SHA512
b676a7d8ab84d5bddefe70a4278abd2f956253f04994f0777c4129984989ad972c9957978fb6138d1ac7d06658ff0812ef203e1ae5da538082dd41af73e08f95

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
18995dc3b3d4ac7f2df7ceec1a25199d

SHA1
06ec341d4f64bc5cd7a20080f541043afc0f8e26

SHA256
4aaf6bbb0e813ca13ada44aac6ee6d8c2744793c08078c4cb536bd6cb53f79aa

SHA512
c4cc8ab113892b825dc7421a1cb473a0659f22eed2f2af6da6bf32c6878de897d9675468480f31d21c21121f03149a802b0b342f7168a378b715f9de7f158c0c

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
be2609ee078c276ec2d4c47a71e12b30

SHA1
20f5a3dba964bfd9121d999d9d256e91f4e21530

SHA256
8eb22c6568dc6a963c9832aefd4926170eda5ba0f9b9cbfb38711d6d30ee7d9f

SHA512
c523da9b24572f446e16f478dec61c5c76078666eaf37afd2a84da3066c5a08009e3525e10cdaa7bdccbb4a9eb94d947a768cc931522610add91b6669591c943

Download Submit
C:\Windows\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
be2609ee078c276ec2d4c47a71e12b30

SHA1
20f5a3dba964bfd9121d999d9d256e91f4e21530

SHA256
8eb22c6568dc6a963c9832aefd4926170eda5ba0f9b9cbfb38711d6d30ee7d9f

SHA512
c523da9b24572f446e16f478dec61c5c76078666eaf37afd2a84da3066c5a08009e3525e10cdaa7bdccbb4a9eb94d947a768cc931522610add91b6669591c943

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
be2609ee078c276ec2d4c47a71e12b30

SHA1
20f5a3dba964bfd9121d999d9d256e91f4e21530

SHA256
8eb22c6568dc6a963c9832aefd4926170eda5ba0f9b9cbfb38711d6d30ee7d9f

SHA512
c523da9b24572f446e16f478dec61c5c76078666eaf37afd2a84da3066c5a08009e3525e10cdaa7bdccbb4a9eb94d947a768cc931522610add91b6669591c943

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
be2609ee078c276ec2d4c47a71e12b30

SHA1
20f5a3dba964bfd9121d999d9d256e91f4e21530

SHA256
8eb22c6568dc6a963c9832aefd4926170eda5ba0f9b9cbfb38711d6d30ee7d9f

SHA512
c523da9b24572f446e16f478dec61c5c76078666eaf37afd2a84da3066c5a08009e3525e10cdaa7bdccbb4a9eb94d947a768cc931522610add91b6669591c943

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
be2609ee078c276ec2d4c47a71e12b30

SHA1
20f5a3dba964bfd9121d999d9d256e91f4e21530

SHA256
8eb22c6568dc6a963c9832aefd4926170eda5ba0f9b9cbfb38711d6d30ee7d9f

SHA512
c523da9b24572f446e16f478dec61c5c76078666eaf37afd2a84da3066c5a08009e3525e10cdaa7bdccbb4a9eb94d947a768cc931522610add91b6669591c943

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
be2609ee078c276ec2d4c47a71e12b30

SHA1
20f5a3dba964bfd9121d999d9d256e91f4e21530

SHA256
8eb22c6568dc6a963c9832aefd4926170eda5ba0f9b9cbfb38711d6d30ee7d9f

SHA512
c523da9b24572f446e16f478dec61c5c76078666eaf37afd2a84da3066c5a08009e3525e10cdaa7bdccbb4a9eb94d947a768cc931522610add91b6669591c943

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
7605f54f4f5ad9838604d59db6f9f1ce

SHA1
4d4c4acacbc08db2941416e08fbb839263cc1a1c

SHA256
837daa1ce94ac5bcfb757ccfc2ab739d066db3d9958f13245b81c57f6d35a02c

SHA512
b676a7d8ab84d5bddefe70a4278abd2f956253f04994f0777c4129984989ad972c9957978fb6138d1ac7d06658ff0812ef203e1ae5da538082dd41af73e08f95

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
b0c23327c24bac774e345a647023fadb

SHA1
db7d8a45951faf875b504c7dfaccc701c9c2c982

SHA256
2234d503605ea0f6e06d0fc4c2b1488257a1fbb315fdcb119efbc9d0e050376d

SHA512
b42a75a048e7ff2c26caa4b76790aefb4df00a95167994b710505a9a942a83a365a486ea2289cf517c7027e5f19af898d7cb23fef720c0802f8bc1565ad761d2

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
be2609ee078c276ec2d4c47a71e12b30

SHA1
20f5a3dba964bfd9121d999d9d256e91f4e21530

SHA256
8eb22c6568dc6a963c9832aefd4926170eda5ba0f9b9cbfb38711d6d30ee7d9f

SHA512
c523da9b24572f446e16f478dec61c5c76078666eaf37afd2a84da3066c5a08009e3525e10cdaa7bdccbb4a9eb94d947a768cc931522610add91b6669591c943

Download Submit
\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
1087837b19e25afc7b4678a9ea0f3218

SHA1
e060b144ef496ce45ede993a0a2b609d29f4b39c

SHA256
9d323cb4702588873121c369bdbded8110c3391b5c0728c0152099d9d1616443

SHA512
b3f8bd270af04792ca6c20f55021d4488102cc11afef2757f752a772fbdeb777016d56ea46159f384bf77de3f603137cd74489e1800f8982d582f8b7469aa65f

Download Submit
\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
1087837b19e25afc7b4678a9ea0f3218

SHA1
e060b144ef496ce45ede993a0a2b609d29f4b39c

SHA256
9d323cb4702588873121c369bdbded8110c3391b5c0728c0152099d9d1616443

SHA512
b3f8bd270af04792ca6c20f55021d4488102cc11afef2757f752a772fbdeb777016d56ea46159f384bf77de3f603137cd74489e1800f8982d582f8b7469aa65f

Download Submit
\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
1087837b19e25afc7b4678a9ea0f3218

SHA1
e060b144ef496ce45ede993a0a2b609d29f4b39c

SHA256
9d323cb4702588873121c369bdbded8110c3391b5c0728c0152099d9d1616443

SHA512
b3f8bd270af04792ca6c20f55021d4488102cc11afef2757f752a772fbdeb777016d56ea46159f384bf77de3f603137cd74489e1800f8982d582f8b7469aa65f

Download Submit
\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
1087837b19e25afc7b4678a9ea0f3218

SHA1
e060b144ef496ce45ede993a0a2b609d29f4b39c

SHA256
9d323cb4702588873121c369bdbded8110c3391b5c0728c0152099d9d1616443

SHA512
b3f8bd270af04792ca6c20f55021d4488102cc11afef2757f752a772fbdeb777016d56ea46159f384bf77de3f603137cd74489e1800f8982d582f8b7469aa65f

Download Submit
\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
351d668d477bc251d3ec0009a4703c37

SHA1
23f7022bc796dceddb6d2f383e958746b13afa05

SHA256
df63e787dd527ec9399aba7cba88ae22c2c5bb66b2a7ef9c093d35179b3141dc

SHA512
c2c8276bd42c00eb83cf5251ed50c4c75e6610e04828d74e1a8f65ea79172e734f138857d57ebb8e18c920f4bcf7efa0c6c9c4fd74528d62c2271e8fd42e63ad

Download Submit
\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
351d668d477bc251d3ec0009a4703c37

SHA1
23f7022bc796dceddb6d2f383e958746b13afa05

SHA256
df63e787dd527ec9399aba7cba88ae22c2c5bb66b2a7ef9c093d35179b3141dc

SHA512
c2c8276bd42c00eb83cf5251ed50c4c75e6610e04828d74e1a8f65ea79172e734f138857d57ebb8e18c920f4bcf7efa0c6c9c4fd74528d62c2271e8fd42e63ad

Download Submit
\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
351d668d477bc251d3ec0009a4703c37

SHA1
23f7022bc796dceddb6d2f383e958746b13afa05

SHA256
df63e787dd527ec9399aba7cba88ae22c2c5bb66b2a7ef9c093d35179b3141dc

SHA512
c2c8276bd42c00eb83cf5251ed50c4c75e6610e04828d74e1a8f65ea79172e734f138857d57ebb8e18c920f4bcf7efa0c6c9c4fd74528d62c2271e8fd42e63ad

Download Submit
\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
351d668d477bc251d3ec0009a4703c37

SHA1
23f7022bc796dceddb6d2f383e958746b13afa05

SHA256
df63e787dd527ec9399aba7cba88ae22c2c5bb66b2a7ef9c093d35179b3141dc

SHA512
c2c8276bd42c00eb83cf5251ed50c4c75e6610e04828d74e1a8f65ea79172e734f138857d57ebb8e18c920f4bcf7efa0c6c9c4fd74528d62c2271e8fd42e63ad

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
311571fd5935cb4e7a1b2fb8891f9c5d

SHA1
a19af272de99d7e7069a77e141be42cb249b7349

SHA256
65793f31ef50232a2e162df5f3dee416abf73d47cb7daee7ff9c47964953bbe0

SHA512
97f3ed94a3e501f841842115fbbbef807d9d4ef689bdbb5f3218e07b37cb7e27ed9ad5cf2ca2336e1edd2de9fc11faa2d15b34421d5aa0b15473fcd685744ad6

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
311571fd5935cb4e7a1b2fb8891f9c5d

SHA1
a19af272de99d7e7069a77e141be42cb249b7349

SHA256
65793f31ef50232a2e162df5f3dee416abf73d47cb7daee7ff9c47964953bbe0

SHA512
97f3ed94a3e501f841842115fbbbef807d9d4ef689bdbb5f3218e07b37cb7e27ed9ad5cf2ca2336e1edd2de9fc11faa2d15b34421d5aa0b15473fcd685744ad6

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
311571fd5935cb4e7a1b2fb8891f9c5d

SHA1
a19af272de99d7e7069a77e141be42cb249b7349

SHA256
65793f31ef50232a2e162df5f3dee416abf73d47cb7daee7ff9c47964953bbe0

SHA512
97f3ed94a3e501f841842115fbbbef807d9d4ef689bdbb5f3218e07b37cb7e27ed9ad5cf2ca2336e1edd2de9fc11faa2d15b34421d5aa0b15473fcd685744ad6

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
311571fd5935cb4e7a1b2fb8891f9c5d

SHA1
a19af272de99d7e7069a77e141be42cb249b7349

SHA256
65793f31ef50232a2e162df5f3dee416abf73d47cb7daee7ff9c47964953bbe0

SHA512
97f3ed94a3e501f841842115fbbbef807d9d4ef689bdbb5f3218e07b37cb7e27ed9ad5cf2ca2336e1edd2de9fc11faa2d15b34421d5aa0b15473fcd685744ad6

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
7605f54f4f5ad9838604d59db6f9f1ce

SHA1
4d4c4acacbc08db2941416e08fbb839263cc1a1c

SHA256
837daa1ce94ac5bcfb757ccfc2ab739d066db3d9958f13245b81c57f6d35a02c

SHA512
b676a7d8ab84d5bddefe70a4278abd2f956253f04994f0777c4129984989ad972c9957978fb6138d1ac7d06658ff0812ef203e1ae5da538082dd41af73e08f95

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
7605f54f4f5ad9838604d59db6f9f1ce

SHA1
4d4c4acacbc08db2941416e08fbb839263cc1a1c

SHA256
837daa1ce94ac5bcfb757ccfc2ab739d066db3d9958f13245b81c57f6d35a02c

SHA512
b676a7d8ab84d5bddefe70a4278abd2f956253f04994f0777c4129984989ad972c9957978fb6138d1ac7d06658ff0812ef203e1ae5da538082dd41af73e08f95

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
7605f54f4f5ad9838604d59db6f9f1ce

SHA1
4d4c4acacbc08db2941416e08fbb839263cc1a1c

SHA256
837daa1ce94ac5bcfb757ccfc2ab739d066db3d9958f13245b81c57f6d35a02c

SHA512
b676a7d8ab84d5bddefe70a4278abd2f956253f04994f0777c4129984989ad972c9957978fb6138d1ac7d06658ff0812ef203e1ae5da538082dd41af73e08f95

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
7605f54f4f5ad9838604d59db6f9f1ce

SHA1
4d4c4acacbc08db2941416e08fbb839263cc1a1c

SHA256
837daa1ce94ac5bcfb757ccfc2ab739d066db3d9958f13245b81c57f6d35a02c

SHA512
b676a7d8ab84d5bddefe70a4278abd2f956253f04994f0777c4129984989ad972c9957978fb6138d1ac7d06658ff0812ef203e1ae5da538082dd41af73e08f95

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
7605f54f4f5ad9838604d59db6f9f1ce

SHA1
4d4c4acacbc08db2941416e08fbb839263cc1a1c

SHA256
837daa1ce94ac5bcfb757ccfc2ab739d066db3d9958f13245b81c57f6d35a02c

SHA512
b676a7d8ab84d5bddefe70a4278abd2f956253f04994f0777c4129984989ad972c9957978fb6138d1ac7d06658ff0812ef203e1ae5da538082dd41af73e08f95

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
7605f54f4f5ad9838604d59db6f9f1ce

SHA1
4d4c4acacbc08db2941416e08fbb839263cc1a1c

SHA256
837daa1ce94ac5bcfb757ccfc2ab739d066db3d9958f13245b81c57f6d35a02c

SHA512
b676a7d8ab84d5bddefe70a4278abd2f956253f04994f0777c4129984989ad972c9957978fb6138d1ac7d06658ff0812ef203e1ae5da538082dd41af73e08f95

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
7605f54f4f5ad9838604d59db6f9f1ce

SHA1
4d4c4acacbc08db2941416e08fbb839263cc1a1c

SHA256
837daa1ce94ac5bcfb757ccfc2ab739d066db3d9958f13245b81c57f6d35a02c

SHA512
b676a7d8ab84d5bddefe70a4278abd2f956253f04994f0777c4129984989ad972c9957978fb6138d1ac7d06658ff0812ef203e1ae5da538082dd41af73e08f95

Download Submit
memory/112-224-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/336-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/336-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/360-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/360-264-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/432-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/568-292-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/568-126-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/580-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/624-260-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/624-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/820-272-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/892-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/892-202-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/912-287-0x00000000026F0000-0x0000000002723000-memory.dmp

Filesize
204KB

Download
memory/912-199-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/956-286-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/984-102-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/984-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1048-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1060-187-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1060-170-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1080-246-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1096-127-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1096-148-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1156-167-0x0000000002780000-0x00000000027B3000-memory.dmp

Filesize
204KB

Download
memory/1156-95-0x0000000002780000-0x00000000027B3000-memory.dmp

Filesize
204KB

Download
memory/1156-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1156-289-0x0000000002780000-0x00000000027B3000-memory.dmp

Filesize
204KB

Download
memory/1156-125-0x0000000002780000-0x00000000027B3000-memory.dmp

Filesize
204KB

Download
memory/1156-94-0x0000000002780000-0x00000000027B3000-memory.dmp

Filesize
204KB

Download
memory/1156-291-0x0000000002780000-0x00000000027B3000-memory.dmp

Filesize
204KB

Download
memory/1156-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1192-294-0x0000000000760000-0x0000000000793000-memory.dmp

Filesize
204KB

Download
memory/1192-259-0x0000000000760000-0x0000000000793000-memory.dmp

Filesize
204KB

Download
memory/1192-197-0x0000000000760000-0x0000000000793000-memory.dmp

Filesize
204KB

Download
memory/1192-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1192-168-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1380-248-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1492-234-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1496-236-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1600-279-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1628-201-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1628-207-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1656-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1656-166-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1672-250-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1688-222-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1744-243-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1756-247-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1760-216-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1760-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1768-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1768-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1772-83-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1800-220-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1800-198-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1856-262-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1980-290-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1980-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2036-54-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2036-284-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2036-258-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2036-64-0x00000000025C0000-0x00000000025F3000-memory.dmp

Filesize
204KB

Download
memory/2036-57-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download