221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156

Analysis

max time kernel
151s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Size

85KB
MD5

309ae2acd5b2b3f16f93469ed229ae40
SHA1

fc01d5aecabd221a0cb6429f73238ef6e746c40c
SHA256

221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156
SHA512

49aed67b853694903ba5f8e4c6b619798bafecf8ad0975db580aeff9b26eadb96e6174db7b7d04e0077fe76aa292faaa6f8ca77231beb8863c07a30403bddf63
SSDEEP

768:Nh5sxVPFXfgaDjof4ZgHqLNhldu8pGTUTY26TsGrn5wFbUzMsPzB5vXwekfpb:NHsxFJfgaDjofVKn1pGwTJOlw1Ur3wlb

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	cute.exe

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	cute.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	imoet.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 35 IoCs

pid	Process
1904	Tiwi.exe
1724	IExplorer.exe
1988	winlogon.exe
996	Tiwi.exe
1704	IExplorer.exe
428	Tiwi.exe
1348	IExplorer.exe
1832	winlogon.exe
1924	winlogon.exe
1352	Tiwi.exe
1500	imoet.exe
268	imoet.exe
572	IExplorer.exe
1056	Tiwi.exe
2044	cute.exe
2024	IExplorer.exe
1308	cute.exe
840	winlogon.exe
1716	imoet.exe
1884	imoet.exe
276	cute.exe
1828	Tiwi.exe
1272	cute.exe
1376	Tiwi.exe
1644	IExplorer.exe
2000	IExplorer.exe
1732	winlogon.exe
1912	winlogon.exe
1808	imoet.exe
524	imoet.exe
1112	cute.exe
580	cute.exe
1760	winlogon.exe
1616	imoet.exe
1992	cute.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1096-56-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0006000000015c68-59.dat	upx
behavioral1/files/0x0006000000015c9c-63.dat	upx
behavioral1/memory/1096-64-0x0000000002C10000-0x0000000002C43000-memory.dmp	upx
behavioral1/memory/1904-65-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0006000000015c9c-66.dat	upx
behavioral1/files/0x0006000000015c9c-68.dat	upx
behavioral1/files/0x0006000000015cb1-72.dat	upx
behavioral1/files/0x0006000000015cb1-75.dat	upx
behavioral1/files/0x0006000000015cb1-73.dat	upx
behavioral1/files/0x0006000000015c68-80.dat	upx
behavioral1/files/0x0006000000015c9c-84.dat	upx
behavioral1/files/0x0006000000015c9c-86.dat	upx
behavioral1/memory/996-85-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0006000000015c9c-88.dat	upx
behavioral1/files/0x0006000000015ca8-97.dat	upx
behavioral1/files/0x0006000000015c91-96.dat	upx
behavioral1/files/0x0006000000015c81-95.dat	upx
behavioral1/files/0x0006000000015c9c-98.dat	upx
behavioral1/files/0x0006000000015c70-94.dat	upx
behavioral1/files/0x0006000000015c68-93.dat	upx
behavioral1/files/0x0006000000015dbd-92.dat	upx
behavioral1/files/0x0006000000015cba-91.dat	upx
behavioral1/files/0x0006000000015cda-90.dat	upx
behavioral1/files/0x0006000000015cb1-89.dat	upx
behavioral1/files/0x0006000000015c68-103.dat	upx
behavioral1/files/0x0006000000015c9c-107.dat	upx
behavioral1/memory/428-111-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0006000000015c9c-112.dat	upx
behavioral1/files/0x0006000000015cb1-113.dat	upx
behavioral1/files/0x0006000000015c9c-109.dat	upx
behavioral1/memory/1704-108-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0006000000015cb1-114.dat	upx
behavioral1/files/0x0006000000015cb1-117.dat	upx
behavioral1/memory/1348-121-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0006000000015cb1-122.dat	upx
behavioral1/memory/1832-125-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0006000000015cb1-126.dat	upx
behavioral1/files/0x0006000000015cda-127.dat	upx
behavioral1/files/0x0006000000015c91-132.dat	upx
behavioral1/files/0x0006000000015ca8-133.dat	upx
behavioral1/files/0x0006000000015c68-137.dat	upx
behavioral1/files/0x0006000000015cda-139.dat	upx
behavioral1/files/0x0006000000015c81-131.dat	upx
behavioral1/files/0x0006000000015c70-130.dat	upx
behavioral1/files/0x0006000000015dbd-129.dat	upx
behavioral1/files/0x0006000000015cba-128.dat	upx
behavioral1/files/0x0006000000015cb1-123.dat	upx
behavioral1/files/0x0006000000015c81-151.dat	upx
behavioral1/files/0x0006000000015ca8-159.dat	upx
behavioral1/files/0x0006000000015c9c-164.dat	upx
behavioral1/memory/1056-180-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/572-179-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1500-178-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/268-177-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1988-176-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1724-174-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0006000000015c68-165.dat	upx
behavioral1/files/0x0006000000015cba-163.dat	upx
behavioral1/files/0x0006000000015c91-153.dat	upx
behavioral1/files/0x0006000000015cba-152.dat	upx
behavioral1/files/0x0006000000015cba-143.dat	upx
behavioral1/files/0x0006000000015cba-157.dat	upx
behavioral1/files/0x0006000000015c9c-155.dat	upx

Loads dropped DLL 53 IoCs

pid	Process
1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
1904	Tiwi.exe
1904	Tiwi.exe
1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
1904	Tiwi.exe
1904	Tiwi.exe
1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
1904	Tiwi.exe
1724	IExplorer.exe
1724	IExplorer.exe
1904	Tiwi.exe
1904	Tiwi.exe
1904	Tiwi.exe
1988	winlogon.exe
1988	winlogon.exe
1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
1988	winlogon.exe
1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
1988	winlogon.exe
1988	winlogon.exe
1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
1988	winlogon.exe
1988	winlogon.exe
1500	imoet.exe
1500	imoet.exe
2044	cute.exe
2044	cute.exe
1500	imoet.exe
1500	imoet.exe
2044	cute.exe
2044	cute.exe
1500	imoet.exe
2044	cute.exe
2044	cute.exe
1500	imoet.exe
2044	cute.exe
1500	imoet.exe
1724	IExplorer.exe
1724	IExplorer.exe
1724	IExplorer.exe
1724	IExplorer.exe
1724	IExplorer.exe
1724	IExplorer.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	cute.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	Tiwi.exe
File opened (read-only)	\??\W:	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened (read-only)	\??\G:	cute.exe
File opened (read-only)	\??\S:	Tiwi.exe
File opened (read-only)	\??\P:	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened (read-only)	\??\T:	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened (read-only)	\??\U:	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened (read-only)	\??\H:	imoet.exe
File opened (read-only)	\??\T:	IExplorer.exe
File opened (read-only)	\??\J:	Tiwi.exe
File opened (read-only)	\??\P:	Tiwi.exe
File opened (read-only)	\??\Q:	IExplorer.exe
File opened (read-only)	\??\T:	winlogon.exe
File opened (read-only)	\??\N:	imoet.exe
File opened (read-only)	\??\Q:	imoet.exe
File opened (read-only)	\??\V:	imoet.exe
File opened (read-only)	\??\L:	IExplorer.exe
File opened (read-only)	\??\H:	cute.exe
File opened (read-only)	\??\N:	IExplorer.exe
File opened (read-only)	\??\R:	winlogon.exe
File opened (read-only)	\??\K:	IExplorer.exe
File opened (read-only)	\??\N:	Tiwi.exe
File opened (read-only)	\??\L:	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened (read-only)	\??\B:	IExplorer.exe
File opened (read-only)	\??\W:	IExplorer.exe
File opened (read-only)	\??\O:	winlogon.exe
File opened (read-only)	\??\F:	imoet.exe
File opened (read-only)	\??\H:	IExplorer.exe
File opened (read-only)	\??\O:	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened (read-only)	\??\F:	winlogon.exe
File opened (read-only)	\??\V:	winlogon.exe
File opened (read-only)	\??\F:	cute.exe
File opened (read-only)	\??\T:	Tiwi.exe
File opened (read-only)	\??\W:	Tiwi.exe
File opened (read-only)	\??\F:	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened (read-only)	\??\E:	cute.exe
File opened (read-only)	\??\E:	IExplorer.exe
File opened (read-only)	\??\Z:	IExplorer.exe
File opened (read-only)	\??\E:	Tiwi.exe
File opened (read-only)	\??\G:	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened (read-only)	\??\S:	winlogon.exe
File opened (read-only)	\??\B:	cute.exe
File opened (read-only)	\??\F:	Tiwi.exe
File opened (read-only)	\??\G:	Tiwi.exe
File opened (read-only)	\??\P:	winlogon.exe
File opened (read-only)	\??\M:	Tiwi.exe
File opened (read-only)	\??\O:	Tiwi.exe
File opened (read-only)	\??\M:	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened (read-only)	\??\Q:	winlogon.exe
File opened (read-only)	\??\Y:	imoet.exe
File opened (read-only)	\??\F:	IExplorer.exe
File opened (read-only)	\??\G:	IExplorer.exe
File opened (read-only)	\??\H:	Tiwi.exe
File opened (read-only)	\??\R:	Tiwi.exe
File opened (read-only)	\??\N:	cute.exe
File opened (read-only)	\??\Q:	cute.exe
File opened (read-only)	\??\L:	Tiwi.exe
File opened (read-only)	\??\E:	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened (read-only)	\??\Z:	cute.exe
File opened (read-only)	\??\T:	imoet.exe
File opened (read-only)	\??\B:	winlogon.exe
File opened (read-only)	\??\G:	winlogon.exe
File opened (read-only)	\??\B:	imoet.exe
File opened (read-only)	\??\U:	imoet.exe

Modifies WinLogon 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	IExplorer.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	Tiwi.exe
File created	C:\autorun.inf	Tiwi.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	winlogon.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	cute.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	Tiwi.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	cute.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	imoet.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	winlogon.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\tiwi.scr	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File created	C:\Windows\SysWOW64\shell.exe	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	imoet.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File created	C:\Windows\tiwi.exe	cute.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	Tiwi.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	winlogon.exe
File created	C:\Windows\tiwi.exe	winlogon.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	imoet.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	cute.exe
File created	C:\Windows\tiwi.exe	imoet.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	Tiwi.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 54 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\SwapMouseButtons = "1"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Tiwi"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\SwapMouseButtons = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Tiwi"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Tiwi"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\SwapMouseButtons = "1"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Tiwi"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\SwapMouseButtons = "1"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Tiwi"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\SwapMouseButtons = "1"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Tiwi"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Tiwi"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\SwapMouseButtons = "1"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Mouse\	cute.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	winlogon.exe

Modifies Internet Explorer start page 1 TTPs 6 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	IExplorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	cute.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
1904	Tiwi.exe
1500	imoet.exe
1988	winlogon.exe
2044	cute.exe
1724	IExplorer.exe

Suspicious use of SetWindowsHookEx 35 IoCs

pid	Process
1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
1904	Tiwi.exe
1724	IExplorer.exe
1988	winlogon.exe
996	Tiwi.exe
1704	IExplorer.exe
428	Tiwi.exe
1348	IExplorer.exe
1832	winlogon.exe
1924	winlogon.exe
1352	Tiwi.exe
268	imoet.exe
1500	imoet.exe
1056	Tiwi.exe
2044	cute.exe
2024	IExplorer.exe
1308	cute.exe
840	winlogon.exe
1884	imoet.exe
1716	imoet.exe
276	cute.exe
1828	Tiwi.exe
1272	cute.exe
1376	Tiwi.exe
1644	IExplorer.exe
2000	IExplorer.exe
1732	winlogon.exe
1912	winlogon.exe
1808	imoet.exe
524	imoet.exe
1112	cute.exe
580	cute.exe
1760	winlogon.exe
1616	imoet.exe
1992	cute.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1904	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	27
PID 1096 wrote to memory of 1904	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	27
PID 1096 wrote to memory of 1904	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	27
PID 1096 wrote to memory of 1904	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	27
PID 1096 wrote to memory of 1724	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	28
PID 1096 wrote to memory of 1724	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	28
PID 1096 wrote to memory of 1724	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	28
PID 1096 wrote to memory of 1724	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	28
PID 1096 wrote to memory of 1988	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	29
PID 1096 wrote to memory of 1988	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	29
PID 1096 wrote to memory of 1988	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	29
PID 1096 wrote to memory of 1988	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	29
PID 1096 wrote to memory of 996	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	30
PID 1096 wrote to memory of 996	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	30
PID 1096 wrote to memory of 996	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	30
PID 1096 wrote to memory of 996	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	30
PID 1096 wrote to memory of 1704	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	31
PID 1096 wrote to memory of 1704	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	31
PID 1096 wrote to memory of 1704	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	31
PID 1096 wrote to memory of 1704	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	31
PID 1904 wrote to memory of 428	1904	Tiwi.exe	32
PID 1904 wrote to memory of 428	1904	Tiwi.exe	32
PID 1904 wrote to memory of 428	1904	Tiwi.exe	32
PID 1904 wrote to memory of 428	1904	Tiwi.exe	32
PID 1904 wrote to memory of 1348	1904	Tiwi.exe	33
PID 1904 wrote to memory of 1348	1904	Tiwi.exe	33
PID 1904 wrote to memory of 1348	1904	Tiwi.exe	33
PID 1904 wrote to memory of 1348	1904	Tiwi.exe	33
PID 1096 wrote to memory of 1832	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	34
PID 1096 wrote to memory of 1832	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	34
PID 1096 wrote to memory of 1832	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	34
PID 1096 wrote to memory of 1832	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	34
PID 1904 wrote to memory of 1924	1904	Tiwi.exe	35
PID 1904 wrote to memory of 1924	1904	Tiwi.exe	35
PID 1904 wrote to memory of 1924	1904	Tiwi.exe	35
PID 1904 wrote to memory of 1924	1904	Tiwi.exe	35
PID 1724 wrote to memory of 1352	1724	IExplorer.exe	36
PID 1724 wrote to memory of 1352	1724	IExplorer.exe	36
PID 1724 wrote to memory of 1352	1724	IExplorer.exe	36
PID 1724 wrote to memory of 1352	1724	IExplorer.exe	36
PID 1096 wrote to memory of 1500	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	37
PID 1096 wrote to memory of 1500	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	37
PID 1096 wrote to memory of 1500	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	37
PID 1096 wrote to memory of 1500	1096	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe	37
PID 1724 wrote to memory of 572	1724	IExplorer.exe	38
PID 1724 wrote to memory of 572	1724	IExplorer.exe	38
PID 1724 wrote to memory of 572	1724	IExplorer.exe	38
PID 1724 wrote to memory of 572	1724	IExplorer.exe	38
PID 1904 wrote to memory of 268	1904	Tiwi.exe	39
PID 1904 wrote to memory of 268	1904	Tiwi.exe	39
PID 1904 wrote to memory of 268	1904	Tiwi.exe	39
PID 1904 wrote to memory of 268	1904	Tiwi.exe	39
PID 1988 wrote to memory of 1056	1988	winlogon.exe	40
PID 1988 wrote to memory of 1056	1988	winlogon.exe	40
PID 1988 wrote to memory of 1056	1988	winlogon.exe	40
PID 1988 wrote to memory of 1056	1988	winlogon.exe	40
PID 1904 wrote to memory of 2044	1904	Tiwi.exe	41
PID 1904 wrote to memory of 2044	1904	Tiwi.exe	41
PID 1904 wrote to memory of 2044	1904	Tiwi.exe	41
PID 1904 wrote to memory of 2044	1904	Tiwi.exe	41
PID 1988 wrote to memory of 2024	1988	winlogon.exe	42
PID 1988 wrote to memory of 2024	1988	winlogon.exe	42
PID 1988 wrote to memory of 2024	1988	winlogon.exe	42
PID 1988 wrote to memory of 2024	1988	winlogon.exe	42

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cute.exe

C:\Users\Admin\AppData\Local\Temp\221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe
"C:\Users\Admin\AppData\Local\Temp\221753f1059bd323b4e9f121755f419eb790711a7a279cf980dea0efeacd5156.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1096
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1904
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:428
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1348
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1924
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:268
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Modifies system executable filetype association
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Disables RegEdit via registry modification
    - Disables cmd.exe use via registry modification
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - Modifies WinLogon
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:2044
  - - C:\Windows\Tiwi.exe
      C:\Windows\Tiwi.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1376
  - - C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2000
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1912
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:524
  - - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:580
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1724
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1352
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    PID:572
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1760
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1616
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1992
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1988
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1056
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:2024
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:840
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1716
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1272
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:996
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:1704
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1832
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1500
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1828
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1644
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1732
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1808
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1112
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1308
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1884
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
0eb1dac14f7a7dae02b7404ca7fb4123

SHA1
80a332420af88b6cdd9a120613963d6a080ac761

SHA256
486017bcd9e025d29efa1bf57070aa10b4100a69309e861d2281a4f32a19ca01

SHA512
b5804baac0aca96d7ca987e8fe8757cef3c638f52bf86527b13a541b5e888d452c1d6ac6a035afff8194d0b7094888254e94e6296934f742f09824af2eb1b19f

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
0eb1dac14f7a7dae02b7404ca7fb4123

SHA1
80a332420af88b6cdd9a120613963d6a080ac761

SHA256
486017bcd9e025d29efa1bf57070aa10b4100a69309e861d2281a4f32a19ca01

SHA512
b5804baac0aca96d7ca987e8fe8757cef3c638f52bf86527b13a541b5e888d452c1d6ac6a035afff8194d0b7094888254e94e6296934f742f09824af2eb1b19f

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
181de496fe9bde39e2115c3bf04c45cd

SHA1
4159b15a6937372c561dc6602fc881349b735c65

SHA256
139a12adb97e1a938d4ba50d6984e759723c9182bcc3281745e19bcc94869f0d

SHA512
3f511902f76e94d7c5e6f95001f4e3afc8dd08d6188d2a15d6856b395916d1d9de0feba9fe403b070044588d64746c5a2a9858a633f1890a008e50a09ce34325

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
181de496fe9bde39e2115c3bf04c45cd

SHA1
4159b15a6937372c561dc6602fc881349b735c65

SHA256
139a12adb97e1a938d4ba50d6984e759723c9182bcc3281745e19bcc94869f0d

SHA512
3f511902f76e94d7c5e6f95001f4e3afc8dd08d6188d2a15d6856b395916d1d9de0feba9fe403b070044588d64746c5a2a9858a633f1890a008e50a09ce34325

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
181de496fe9bde39e2115c3bf04c45cd

SHA1
4159b15a6937372c561dc6602fc881349b735c65

SHA256
139a12adb97e1a938d4ba50d6984e759723c9182bcc3281745e19bcc94869f0d

SHA512
3f511902f76e94d7c5e6f95001f4e3afc8dd08d6188d2a15d6856b395916d1d9de0feba9fe403b070044588d64746c5a2a9858a633f1890a008e50a09ce34325

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
43506dee7ea96be9216132638de6bdf3

SHA1
5d8c5630705cd666ac461699e54c3742a48c1451

SHA256
da4d06b00413b0d7b77f80e18a160ed787acec0fc4a006511340445727baa5e9

SHA512
1edaad0f711b993eee0d2d8e14e6046df5fa5ed9817f202079a7fb155a99cb964476da43ad9f97ba4804ad23079f4f695a27bdc8ae82e0badfb3589bed965f5b

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
b3120a15c2e76f4e3667bb7a1a9d8ae2

SHA1
dfa7beb37911d860ba3fbc6cdd84e0ae98f7ff1e

SHA256
4ce883c91247a22619a16078a5e47ca40be752a6315c9cd3dc0028034e5fda2a

SHA512
5dc1605c8f0b52b98a85f909361670cb3a5ba5e26d6e370b87a7e3ef4decce34f94fc8311ba2f2e508bf600e3b8add39b1229ab1a92d2f9ad2fea6422c62738c

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
4c7255937fd965475347a2a8c0ee9f09

SHA1
ac33df9177e473b02ae888bb83e7aa70f8bd4690

SHA256
df9afc3f7e021ca1d86081c73817b0009c7f704abd983201aa651ea1b778a141

SHA512
1dd852d7d32795b21b2bb71ec0429322b428edef2aa46dc8603d425eef3d0bdbc0adb62a5ad2efdf1e32a7955f30fe97319298851c98a4a41e03ba7543ec786f

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
43506dee7ea96be9216132638de6bdf3

SHA1
5d8c5630705cd666ac461699e54c3742a48c1451

SHA256
da4d06b00413b0d7b77f80e18a160ed787acec0fc4a006511340445727baa5e9

SHA512
1edaad0f711b993eee0d2d8e14e6046df5fa5ed9817f202079a7fb155a99cb964476da43ad9f97ba4804ad23079f4f695a27bdc8ae82e0badfb3589bed965f5b

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
0eb1dac14f7a7dae02b7404ca7fb4123

SHA1
80a332420af88b6cdd9a120613963d6a080ac761

SHA256
486017bcd9e025d29efa1bf57070aa10b4100a69309e861d2281a4f32a19ca01

SHA512
b5804baac0aca96d7ca987e8fe8757cef3c638f52bf86527b13a541b5e888d452c1d6ac6a035afff8194d0b7094888254e94e6296934f742f09824af2eb1b19f

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
4c7255937fd965475347a2a8c0ee9f09

SHA1
ac33df9177e473b02ae888bb83e7aa70f8bd4690

SHA256
df9afc3f7e021ca1d86081c73817b0009c7f704abd983201aa651ea1b778a141

SHA512
1dd852d7d32795b21b2bb71ec0429322b428edef2aa46dc8603d425eef3d0bdbc0adb62a5ad2efdf1e32a7955f30fe97319298851c98a4a41e03ba7543ec786f

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
d546a86609c80402e21f7e81c8361db0

SHA1
12aad37357b2bb8f4e9b165e1c98fcd5bd78b6e6

SHA256
4239eba1075ad6df37bfdd3a4c8bf93834de0a2faddcabed154ab249f88cc2aa

SHA512
d9200805e6cae8d2b8bc1ee453e38414c0761c703b19703860b37f5183eb56560e3d4156b65b603742f2391faa15c33f2e72da6e849a1fae7c90aee6bbdac3e5

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
f25cafe90d3bf958169f645b0c01449e

SHA1
7f0677a01e4153a6c5f89c29d7ad6274f8f9e224

SHA256
f4a1a4a8c4a83ff16d6f6d9d794c49dc4596d328c89dcd340932772b45f70e8b

SHA512
474422e3e62236d8f5d95110df642a9c381ad548436780e34553358c8b76905ece1a0a8866c05d7bba97712f3be9777b9e7e8f4c4b06663eb05e5f403ccbd40d

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
0a81c45e96164b6507cd98117bcf52cf

SHA1
552f9636b1a5c14ec4a15c07f82465bce6b9577d

SHA256
9783c1f9792fcf78743b7c6e7204d0c8f9e412e0674ffa1a8e5d5747ef53657e

SHA512
ae71efdb083b0240ab3df560173675faa9ef8a4aa3b44ceb98e81c5588c7f5f40766a358f48b5adffaf0f896b30c3d75c2cc97dd7d2921f685dc489e2cd242a3

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
43506dee7ea96be9216132638de6bdf3

SHA1
5d8c5630705cd666ac461699e54c3742a48c1451

SHA256
da4d06b00413b0d7b77f80e18a160ed787acec0fc4a006511340445727baa5e9

SHA512
1edaad0f711b993eee0d2d8e14e6046df5fa5ed9817f202079a7fb155a99cb964476da43ad9f97ba4804ad23079f4f695a27bdc8ae82e0badfb3589bed965f5b

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
43506dee7ea96be9216132638de6bdf3

SHA1
5d8c5630705cd666ac461699e54c3742a48c1451

SHA256
da4d06b00413b0d7b77f80e18a160ed787acec0fc4a006511340445727baa5e9

SHA512
1edaad0f711b993eee0d2d8e14e6046df5fa5ed9817f202079a7fb155a99cb964476da43ad9f97ba4804ad23079f4f695a27bdc8ae82e0badfb3589bed965f5b

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
4c7255937fd965475347a2a8c0ee9f09

SHA1
ac33df9177e473b02ae888bb83e7aa70f8bd4690

SHA256
df9afc3f7e021ca1d86081c73817b0009c7f704abd983201aa651ea1b778a141

SHA512
1dd852d7d32795b21b2bb71ec0429322b428edef2aa46dc8603d425eef3d0bdbc0adb62a5ad2efdf1e32a7955f30fe97319298851c98a4a41e03ba7543ec786f

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe

Filesize
85KB

MD5
181de496fe9bde39e2115c3bf04c45cd

SHA1
4159b15a6937372c561dc6602fc881349b735c65

SHA256
139a12adb97e1a938d4ba50d6984e759723c9182bcc3281745e19bcc94869f0d

SHA512
3f511902f76e94d7c5e6f95001f4e3afc8dd08d6188d2a15d6856b395916d1d9de0feba9fe403b070044588d64746c5a2a9858a633f1890a008e50a09ce34325

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
0340031dadc460e138b8444fa986abe7

SHA1
003f845fc9584ce500b8a891f277f100b56f4ec0

SHA256
dbbb93b2f66aa4d6cfb51cf8f59fedcec1a927a13c3bff1eb2e8cf39290e221e

SHA512
50896e20bb5425f71534546755686c1f36481778f6af9d4950bff92897621dd5073c25b1c8984e7a6d69fb0b55e2a6ff415c7d3a3c427c56e212a0ca285c1ecd

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
1c23359fd2d67dc6d475a3d4c015ef10

SHA1
57c0bc187fbe564562c1a4f91b35e8a84c884efd

SHA256
2191f1b2f284ee36ae6e36e0346b9d0d575fe491b092cd18b09f4524c4ed703b

SHA512
86c24e7ab1cf52c4dc2dbcd1789c82fb09199f34c7faa6451a254bb430daabe5848536dcd146d3a061a406e82c696b1f017059f0ed8c7eff1fe40ba9121cac53

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
4c7255937fd965475347a2a8c0ee9f09

SHA1
ac33df9177e473b02ae888bb83e7aa70f8bd4690

SHA256
df9afc3f7e021ca1d86081c73817b0009c7f704abd983201aa651ea1b778a141

SHA512
1dd852d7d32795b21b2bb71ec0429322b428edef2aa46dc8603d425eef3d0bdbc0adb62a5ad2efdf1e32a7955f30fe97319298851c98a4a41e03ba7543ec786f

Download Submit
C:\Windows\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
43506dee7ea96be9216132638de6bdf3

SHA1
5d8c5630705cd666ac461699e54c3742a48c1451

SHA256
da4d06b00413b0d7b77f80e18a160ed787acec0fc4a006511340445727baa5e9

SHA512
1edaad0f711b993eee0d2d8e14e6046df5fa5ed9817f202079a7fb155a99cb964476da43ad9f97ba4804ad23079f4f695a27bdc8ae82e0badfb3589bed965f5b

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
43506dee7ea96be9216132638de6bdf3

SHA1
5d8c5630705cd666ac461699e54c3742a48c1451

SHA256
da4d06b00413b0d7b77f80e18a160ed787acec0fc4a006511340445727baa5e9

SHA512
1edaad0f711b993eee0d2d8e14e6046df5fa5ed9817f202079a7fb155a99cb964476da43ad9f97ba4804ad23079f4f695a27bdc8ae82e0badfb3589bed965f5b

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
43506dee7ea96be9216132638de6bdf3

SHA1
5d8c5630705cd666ac461699e54c3742a48c1451

SHA256
da4d06b00413b0d7b77f80e18a160ed787acec0fc4a006511340445727baa5e9

SHA512
1edaad0f711b993eee0d2d8e14e6046df5fa5ed9817f202079a7fb155a99cb964476da43ad9f97ba4804ad23079f4f695a27bdc8ae82e0badfb3589bed965f5b

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
43506dee7ea96be9216132638de6bdf3

SHA1
5d8c5630705cd666ac461699e54c3742a48c1451

SHA256
da4d06b00413b0d7b77f80e18a160ed787acec0fc4a006511340445727baa5e9

SHA512
1edaad0f711b993eee0d2d8e14e6046df5fa5ed9817f202079a7fb155a99cb964476da43ad9f97ba4804ad23079f4f695a27bdc8ae82e0badfb3589bed965f5b

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
43506dee7ea96be9216132638de6bdf3

SHA1
5d8c5630705cd666ac461699e54c3742a48c1451

SHA256
da4d06b00413b0d7b77f80e18a160ed787acec0fc4a006511340445727baa5e9

SHA512
1edaad0f711b993eee0d2d8e14e6046df5fa5ed9817f202079a7fb155a99cb964476da43ad9f97ba4804ad23079f4f695a27bdc8ae82e0badfb3589bed965f5b

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
3671ce98ee280711d34ffa0f92ab586c

SHA1
f873b31547adfdde658e9bfc64066f810d1ce319

SHA256
4aaf8f54844127cdbc2fe4ac209165be7380d96961dee34cda731ff2d1c60fa6

SHA512
d9dd9096383cc3fe4c992d0d7d228136122b1e987be3db8ab2de8286aa2a752508f54ade02e30fd9c1f439b4a79876633f539c55ab24272c4029233e7e86ad13

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
181de496fe9bde39e2115c3bf04c45cd

SHA1
4159b15a6937372c561dc6602fc881349b735c65

SHA256
139a12adb97e1a938d4ba50d6984e759723c9182bcc3281745e19bcc94869f0d

SHA512
3f511902f76e94d7c5e6f95001f4e3afc8dd08d6188d2a15d6856b395916d1d9de0feba9fe403b070044588d64746c5a2a9858a633f1890a008e50a09ce34325

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
d9d0382ea12261dcc83ab5ea5da4fafd

SHA1
90c23129dddaf9d83becdff70f2d9a2c9a41aeb0

SHA256
7176dc0e8e4cad461107906dbb3963a83fc5ccb0d27eafc0dca020b45f64be51

SHA512
ad005bccb52a5597437495f5a034b61cd815657ae258f5dbbff66f33c3cdebc49c48110fad6b8204a970f91cfa7527d28053710bdece73e77e575565cad58087

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
9641d876003e9d9289cefa5502c8db17

SHA1
4e95aab77f790b9f6db853dfafe7c5c197b330b9

SHA256
0e9e17d42b022ac5ee97b488c8b0425289aedf3cebdacdb5ca566132d6979aec

SHA512
e1550093b07044f8286f4547a802728544248e4ca0eb6ec59b63d1d700a015b607b0bcb5b45c1dcdb648d55b4c5606e8e1002752e158ac5e08e4309fd629d038

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
61565483511096b0aa18afd5aad4098e

SHA1
f7b5cb8acf18158bdcb5d0c3c5ee74279e989a42

SHA256
503851a88b8cfd9f0dc8de2d6fa7ab793423b0df319a836aa00f16a3be1f0317

SHA512
b1358aab097b12e4a9d66b55031cff8bdca8ad3280c301594b9c8de6ce6aed449dc5986b2475103150c2399a68bca780bfe35eff4ed38ba8f40b9fb1ec01f686

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
4c7255937fd965475347a2a8c0ee9f09

SHA1
ac33df9177e473b02ae888bb83e7aa70f8bd4690

SHA256
df9afc3f7e021ca1d86081c73817b0009c7f704abd983201aa651ea1b778a141

SHA512
1dd852d7d32795b21b2bb71ec0429322b428edef2aa46dc8603d425eef3d0bdbc0adb62a5ad2efdf1e32a7955f30fe97319298851c98a4a41e03ba7543ec786f

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
4c7255937fd965475347a2a8c0ee9f09

SHA1
ac33df9177e473b02ae888bb83e7aa70f8bd4690

SHA256
df9afc3f7e021ca1d86081c73817b0009c7f704abd983201aa651ea1b778a141

SHA512
1dd852d7d32795b21b2bb71ec0429322b428edef2aa46dc8603d425eef3d0bdbc0adb62a5ad2efdf1e32a7955f30fe97319298851c98a4a41e03ba7543ec786f

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
4c7255937fd965475347a2a8c0ee9f09

SHA1
ac33df9177e473b02ae888bb83e7aa70f8bd4690

SHA256
df9afc3f7e021ca1d86081c73817b0009c7f704abd983201aa651ea1b778a141

SHA512
1dd852d7d32795b21b2bb71ec0429322b428edef2aa46dc8603d425eef3d0bdbc0adb62a5ad2efdf1e32a7955f30fe97319298851c98a4a41e03ba7543ec786f

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
4c7255937fd965475347a2a8c0ee9f09

SHA1
ac33df9177e473b02ae888bb83e7aa70f8bd4690

SHA256
df9afc3f7e021ca1d86081c73817b0009c7f704abd983201aa651ea1b778a141

SHA512
1dd852d7d32795b21b2bb71ec0429322b428edef2aa46dc8603d425eef3d0bdbc0adb62a5ad2efdf1e32a7955f30fe97319298851c98a4a41e03ba7543ec786f

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
4c7255937fd965475347a2a8c0ee9f09

SHA1
ac33df9177e473b02ae888bb83e7aa70f8bd4690

SHA256
df9afc3f7e021ca1d86081c73817b0009c7f704abd983201aa651ea1b778a141

SHA512
1dd852d7d32795b21b2bb71ec0429322b428edef2aa46dc8603d425eef3d0bdbc0adb62a5ad2efdf1e32a7955f30fe97319298851c98a4a41e03ba7543ec786f

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
4c7255937fd965475347a2a8c0ee9f09

SHA1
ac33df9177e473b02ae888bb83e7aa70f8bd4690

SHA256
df9afc3f7e021ca1d86081c73817b0009c7f704abd983201aa651ea1b778a141

SHA512
1dd852d7d32795b21b2bb71ec0429322b428edef2aa46dc8603d425eef3d0bdbc0adb62a5ad2efdf1e32a7955f30fe97319298851c98a4a41e03ba7543ec786f

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
4c7255937fd965475347a2a8c0ee9f09

SHA1
ac33df9177e473b02ae888bb83e7aa70f8bd4690

SHA256
df9afc3f7e021ca1d86081c73817b0009c7f704abd983201aa651ea1b778a141

SHA512
1dd852d7d32795b21b2bb71ec0429322b428edef2aa46dc8603d425eef3d0bdbc0adb62a5ad2efdf1e32a7955f30fe97319298851c98a4a41e03ba7543ec786f

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
6560d4a8a9a2f87366621fcc0c651caa

SHA1
9a3d5dd321a0e109fdbd19b92c2ab94ecda4131b

SHA256
a25c485fdcb0869d4c2b3ff445ba76791bdf335421bea5b629573fc07e5631a1

SHA512
eca0e6a39e96061dee169f8280cccffa2639e64f37861f9f797a026acdd22a50568151558b9d686c1e89f0d72bf3aa08793fc42b5e6f692f81063e8b70907594

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
181de496fe9bde39e2115c3bf04c45cd

SHA1
4159b15a6937372c561dc6602fc881349b735c65

SHA256
139a12adb97e1a938d4ba50d6984e759723c9182bcc3281745e19bcc94869f0d

SHA512
3f511902f76e94d7c5e6f95001f4e3afc8dd08d6188d2a15d6856b395916d1d9de0feba9fe403b070044588d64746c5a2a9858a633f1890a008e50a09ce34325

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
643b8553d101b580ac2dcbfae3f1efcc

SHA1
d69f19d2528ae2fabc0f5348f176ab57acfabfca

SHA256
5cd3e354f0e426a872a673dd47eca9b578753c2c89064a31b132bd97e4cb5220

SHA512
cf52a72fa0e12593438b5ca7ff1ab174681e7b2fbca6cb82522a7f10e87c9c7fa1e4d27c52189daf9f5ef2c361e1465905a081e34f0fc1fa13dec97fff54f43a

Download Submit
\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
86fd134ffd52f7854f52bd2e5f8bc0cb

SHA1
220ab8c910d21a2509e0879764ce5005f2acea96

SHA256
f7977e6ca284359734747c32adc54a271002e12aa1a6ffde890637acd715497d

SHA512
59870717639c6882f7ee50690f69d8e6eb4821e2a10a1607812ec5284e8abbd4bd6c8859f18397442cf5350052967ae11dc683c1e1beff4ac8dcc9636df95113

Download Submit
\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
0eb1dac14f7a7dae02b7404ca7fb4123

SHA1
80a332420af88b6cdd9a120613963d6a080ac761

SHA256
486017bcd9e025d29efa1bf57070aa10b4100a69309e861d2281a4f32a19ca01

SHA512
b5804baac0aca96d7ca987e8fe8757cef3c638f52bf86527b13a541b5e888d452c1d6ac6a035afff8194d0b7094888254e94e6296934f742f09824af2eb1b19f

Download Submit
\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
0eb1dac14f7a7dae02b7404ca7fb4123

SHA1
80a332420af88b6cdd9a120613963d6a080ac761

SHA256
486017bcd9e025d29efa1bf57070aa10b4100a69309e861d2281a4f32a19ca01

SHA512
b5804baac0aca96d7ca987e8fe8757cef3c638f52bf86527b13a541b5e888d452c1d6ac6a035afff8194d0b7094888254e94e6296934f742f09824af2eb1b19f

Download Submit
\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
0eb1dac14f7a7dae02b7404ca7fb4123

SHA1
80a332420af88b6cdd9a120613963d6a080ac761

SHA256
486017bcd9e025d29efa1bf57070aa10b4100a69309e861d2281a4f32a19ca01

SHA512
b5804baac0aca96d7ca987e8fe8757cef3c638f52bf86527b13a541b5e888d452c1d6ac6a035afff8194d0b7094888254e94e6296934f742f09824af2eb1b19f

Download Submit
\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
0eb1dac14f7a7dae02b7404ca7fb4123

SHA1
80a332420af88b6cdd9a120613963d6a080ac761

SHA256
486017bcd9e025d29efa1bf57070aa10b4100a69309e861d2281a4f32a19ca01

SHA512
b5804baac0aca96d7ca987e8fe8757cef3c638f52bf86527b13a541b5e888d452c1d6ac6a035afff8194d0b7094888254e94e6296934f742f09824af2eb1b19f

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
181de496fe9bde39e2115c3bf04c45cd

SHA1
4159b15a6937372c561dc6602fc881349b735c65

SHA256
139a12adb97e1a938d4ba50d6984e759723c9182bcc3281745e19bcc94869f0d

SHA512
3f511902f76e94d7c5e6f95001f4e3afc8dd08d6188d2a15d6856b395916d1d9de0feba9fe403b070044588d64746c5a2a9858a633f1890a008e50a09ce34325

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
181de496fe9bde39e2115c3bf04c45cd

SHA1
4159b15a6937372c561dc6602fc881349b735c65

SHA256
139a12adb97e1a938d4ba50d6984e759723c9182bcc3281745e19bcc94869f0d

SHA512
3f511902f76e94d7c5e6f95001f4e3afc8dd08d6188d2a15d6856b395916d1d9de0feba9fe403b070044588d64746c5a2a9858a633f1890a008e50a09ce34325

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
181de496fe9bde39e2115c3bf04c45cd

SHA1
4159b15a6937372c561dc6602fc881349b735c65

SHA256
139a12adb97e1a938d4ba50d6984e759723c9182bcc3281745e19bcc94869f0d

SHA512
3f511902f76e94d7c5e6f95001f4e3afc8dd08d6188d2a15d6856b395916d1d9de0feba9fe403b070044588d64746c5a2a9858a633f1890a008e50a09ce34325

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
181de496fe9bde39e2115c3bf04c45cd

SHA1
4159b15a6937372c561dc6602fc881349b735c65

SHA256
139a12adb97e1a938d4ba50d6984e759723c9182bcc3281745e19bcc94869f0d

SHA512
3f511902f76e94d7c5e6f95001f4e3afc8dd08d6188d2a15d6856b395916d1d9de0feba9fe403b070044588d64746c5a2a9858a633f1890a008e50a09ce34325

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
181de496fe9bde39e2115c3bf04c45cd

SHA1
4159b15a6937372c561dc6602fc881349b735c65

SHA256
139a12adb97e1a938d4ba50d6984e759723c9182bcc3281745e19bcc94869f0d

SHA512
3f511902f76e94d7c5e6f95001f4e3afc8dd08d6188d2a15d6856b395916d1d9de0feba9fe403b070044588d64746c5a2a9858a633f1890a008e50a09ce34325

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
181de496fe9bde39e2115c3bf04c45cd

SHA1
4159b15a6937372c561dc6602fc881349b735c65

SHA256
139a12adb97e1a938d4ba50d6984e759723c9182bcc3281745e19bcc94869f0d

SHA512
3f511902f76e94d7c5e6f95001f4e3afc8dd08d6188d2a15d6856b395916d1d9de0feba9fe403b070044588d64746c5a2a9858a633f1890a008e50a09ce34325

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
43506dee7ea96be9216132638de6bdf3

SHA1
5d8c5630705cd666ac461699e54c3742a48c1451

SHA256
da4d06b00413b0d7b77f80e18a160ed787acec0fc4a006511340445727baa5e9

SHA512
1edaad0f711b993eee0d2d8e14e6046df5fa5ed9817f202079a7fb155a99cb964476da43ad9f97ba4804ad23079f4f695a27bdc8ae82e0badfb3589bed965f5b

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
43506dee7ea96be9216132638de6bdf3

SHA1
5d8c5630705cd666ac461699e54c3742a48c1451

SHA256
da4d06b00413b0d7b77f80e18a160ed787acec0fc4a006511340445727baa5e9

SHA512
1edaad0f711b993eee0d2d8e14e6046df5fa5ed9817f202079a7fb155a99cb964476da43ad9f97ba4804ad23079f4f695a27bdc8ae82e0badfb3589bed965f5b

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
43506dee7ea96be9216132638de6bdf3

SHA1
5d8c5630705cd666ac461699e54c3742a48c1451

SHA256
da4d06b00413b0d7b77f80e18a160ed787acec0fc4a006511340445727baa5e9

SHA512
1edaad0f711b993eee0d2d8e14e6046df5fa5ed9817f202079a7fb155a99cb964476da43ad9f97ba4804ad23079f4f695a27bdc8ae82e0badfb3589bed965f5b

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
43506dee7ea96be9216132638de6bdf3

SHA1
5d8c5630705cd666ac461699e54c3742a48c1451

SHA256
da4d06b00413b0d7b77f80e18a160ed787acec0fc4a006511340445727baa5e9

SHA512
1edaad0f711b993eee0d2d8e14e6046df5fa5ed9817f202079a7fb155a99cb964476da43ad9f97ba4804ad23079f4f695a27bdc8ae82e0badfb3589bed965f5b

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
43506dee7ea96be9216132638de6bdf3

SHA1
5d8c5630705cd666ac461699e54c3742a48c1451

SHA256
da4d06b00413b0d7b77f80e18a160ed787acec0fc4a006511340445727baa5e9

SHA512
1edaad0f711b993eee0d2d8e14e6046df5fa5ed9817f202079a7fb155a99cb964476da43ad9f97ba4804ad23079f4f695a27bdc8ae82e0badfb3589bed965f5b

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
43506dee7ea96be9216132638de6bdf3

SHA1
5d8c5630705cd666ac461699e54c3742a48c1451

SHA256
da4d06b00413b0d7b77f80e18a160ed787acec0fc4a006511340445727baa5e9

SHA512
1edaad0f711b993eee0d2d8e14e6046df5fa5ed9817f202079a7fb155a99cb964476da43ad9f97ba4804ad23079f4f695a27bdc8ae82e0badfb3589bed965f5b

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
43506dee7ea96be9216132638de6bdf3

SHA1
5d8c5630705cd666ac461699e54c3742a48c1451

SHA256
da4d06b00413b0d7b77f80e18a160ed787acec0fc4a006511340445727baa5e9

SHA512
1edaad0f711b993eee0d2d8e14e6046df5fa5ed9817f202079a7fb155a99cb964476da43ad9f97ba4804ad23079f4f695a27bdc8ae82e0badfb3589bed965f5b

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
43506dee7ea96be9216132638de6bdf3

SHA1
5d8c5630705cd666ac461699e54c3742a48c1451

SHA256
da4d06b00413b0d7b77f80e18a160ed787acec0fc4a006511340445727baa5e9

SHA512
1edaad0f711b993eee0d2d8e14e6046df5fa5ed9817f202079a7fb155a99cb964476da43ad9f97ba4804ad23079f4f695a27bdc8ae82e0badfb3589bed965f5b

Download Submit
memory/268-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/268-158-0x0000000000000000-mapping.dmp

Download
memory/276-207-0x0000000000000000-mapping.dmp

Download
memory/276-215-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/428-101-0x0000000000000000-mapping.dmp

Download
memory/428-111-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/524-251-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/524-243-0x0000000000000000-mapping.dmp

Download
memory/572-156-0x0000000000000000-mapping.dmp

Download
memory/572-179-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/580-250-0x0000000000000000-mapping.dmp

Download
memory/580-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/840-195-0x0000000000000000-mapping.dmp

Download
memory/840-199-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/996-85-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/996-79-0x0000000000000000-mapping.dmp

Download
memory/1056-180-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1056-162-0x0000000000000000-mapping.dmp

Download
memory/1056-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1096-175-0x0000000002C10000-0x0000000002C43000-memory.dmp

Filesize
204KB

Download
memory/1096-64-0x0000000002C10000-0x0000000002C43000-memory.dmp

Filesize
204KB

Download
memory/1096-57-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/1096-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1096-220-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1096-171-0x0000000002C10000-0x0000000002C43000-memory.dmp

Filesize
204KB

Download
memory/1112-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1112-249-0x0000000000000000-mapping.dmp

Download
memory/1272-210-0x0000000000000000-mapping.dmp

Download
memory/1272-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1308-197-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1308-188-0x0000000000000000-mapping.dmp

Download
memory/1348-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1348-110-0x0000000000000000-mapping.dmp

Download
memory/1352-136-0x0000000000000000-mapping.dmp

Download
memory/1376-227-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1376-230-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1376-216-0x0000000000000000-mapping.dmp

Download
memory/1500-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1500-147-0x0000000000000000-mapping.dmp

Download
memory/1500-178-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1616-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1616-273-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1616-264-0x0000000000000000-mapping.dmp

Download
memory/1644-219-0x0000000000000000-mapping.dmp

Download
memory/1644-231-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1704-87-0x0000000000000000-mapping.dmp

Download
memory/1704-108-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1716-206-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1716-201-0x0000000000000000-mapping.dmp

Download
memory/1724-278-0x00000000024A0000-0x00000000024D3000-memory.dmp

Filesize
204KB

Download
memory/1724-67-0x0000000000000000-mapping.dmp

Download
memory/1724-261-0x00000000024A0000-0x00000000024D3000-memory.dmp

Filesize
204KB

Download
memory/1724-279-0x00000000024A0000-0x00000000024D3000-memory.dmp

Filesize
204KB

Download
memory/1724-280-0x00000000024A0000-0x00000000024D3000-memory.dmp

Filesize
204KB

Download
memory/1724-281-0x00000000024A0000-0x00000000024D3000-memory.dmp

Filesize
204KB

Download
memory/1724-174-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-232-0x0000000000000000-mapping.dmp

Download
memory/1732-239-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1760-258-0x0000000000000000-mapping.dmp

Download
memory/1760-265-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1760-262-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1808-242-0x0000000000000000-mapping.dmp

Download
memory/1828-221-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1828-209-0x0000000000000000-mapping.dmp

Download
memory/1832-125-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1832-115-0x0000000000000000-mapping.dmp

Download
memory/1884-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1884-200-0x0000000000000000-mapping.dmp

Download
memory/1904-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1904-58-0x0000000000000000-mapping.dmp

Download
memory/1904-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1904-271-0x0000000001DC0000-0x0000000001DF3000-memory.dmp

Filesize
204KB

Download
memory/1912-236-0x0000000000000000-mapping.dmp

Download
memory/1912-244-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1924-124-0x0000000000000000-mapping.dmp

Download
memory/1924-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1988-74-0x0000000000000000-mapping.dmp

Download
memory/1988-176-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1988-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1992-277-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1992-274-0x0000000000000000-mapping.dmp

Download
memory/2000-229-0x0000000000000000-mapping.dmp

Download
memory/2000-240-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2024-184-0x0000000000000000-mapping.dmp

Download
memory/2024-194-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2044-272-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2044-182-0x0000000000000000-mapping.dmp

Download
memory/2044-226-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download