f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec

Analysis

max time kernel
153s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Size

85KB
MD5

0f5b0266c5bfe0ff10d855ee64bdf8d6
SHA1

17a0e559a951b54e6aaeec7616aabb9014860952
SHA256

f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec
SHA512

2d74b64e27cf46659f4168c040f5b96c8aade4caf6bc0d2d3717a9f47485b98bc57d4b2afa494c1ab907086f2c4ef7d9309ea8727d00f9610c670c47ba43ada3
SSDEEP

768:Nh5sxVPFXfgaDjof4ZgHqLNhldu8pGTUTY26TsGrn5wFbUzMsPzB5KXwekfp:NHsxFJfgaDjofVKn1pGwTJOlw1UrWwl

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	cute.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	IExplorer.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 35 IoCs

pid	Process
1252	Tiwi.exe
1080	IExplorer.exe
1212	winlogon.exe
1476	imoet.exe
440	cute.exe
552	Tiwi.exe
1496	IExplorer.exe
1380	winlogon.exe
2000	IExplorer.exe
288	imoet.exe
1668	IExplorer.exe
848	Tiwi.exe
1756	winlogon.exe
836	cute.exe
1132	imoet.exe
1336	IExplorer.exe
1600	winlogon.exe
1704	cute.exe
1372	Tiwi.exe
968	imoet.exe
2036	IExplorer.exe
1380	cute.exe
1712	Tiwi.exe
1620	winlogon.exe
2000	IExplorer.exe
1956	Tiwi.exe
1936	imoet.exe
744	winlogon.exe
1748	IExplorer.exe
1700	cute.exe
1692	imoet.exe
1756	winlogon.exe
1876	imoet.exe
660	cute.exe
1696	cute.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000012346-58.dat	upx
behavioral1/memory/1016-59-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1252-63-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x00070000000126f1-65.dat	upx
behavioral1/files/0x00070000000126f1-66.dat	upx
behavioral1/files/0x00070000000126f1-68.dat	upx
behavioral1/files/0x0007000000012741-72.dat	upx
behavioral1/files/0x0007000000012741-73.dat	upx
behavioral1/files/0x0007000000012741-75.dat	upx
behavioral1/files/0x0007000000012767-79.dat	upx
behavioral1/files/0x0007000000012767-82.dat	upx
behavioral1/files/0x0007000000012767-80.dat	upx
behavioral1/files/0x000700000001313e-86.dat	upx
behavioral1/files/0x000700000001313e-87.dat	upx
behavioral1/files/0x000700000001313e-89.dat	upx
behavioral1/files/0x0008000000012346-94.dat	upx
behavioral1/files/0x00070000000126f1-98.dat	upx
behavioral1/files/0x00070000000126f1-102.dat	upx
behavioral1/files/0x00070000000126f1-100.dat	upx
behavioral1/memory/552-99-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1496-105-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0007000000012741-106.dat	upx
behavioral1/files/0x0007000000012741-107.dat	upx
behavioral1/files/0x0007000000012741-109.dat	upx
behavioral1/files/0x0007000000012767-112.dat	upx
behavioral1/files/0x000700000001313e-111.dat	upx
behavioral1/files/0x0007000000012741-110.dat	upx
behavioral1/files/0x00070000000126f1-120.dat	upx
behavioral1/files/0x0007000000012721-119.dat	upx
behavioral1/files/0x00070000000126c7-118.dat	upx
behavioral1/files/0x00070000000126a6-116.dat	upx
behavioral1/files/0x0007000000012677-115.dat	upx
behavioral1/files/0x0008000000012346-114.dat	upx
behavioral1/files/0x000700000001318e-113.dat	upx
behavioral1/files/0x0008000000012346-125.dat	upx
behavioral1/memory/1380-128-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0007000000012767-129.dat	upx
behavioral1/files/0x0007000000012767-130.dat	upx
behavioral1/files/0x00070000000126f1-133.dat	upx
behavioral1/files/0x00070000000126f1-135.dat	upx
behavioral1/files/0x00070000000126f1-137.dat	upx
behavioral1/files/0x00070000000126c7-154.dat	upx
behavioral1/memory/1668-155-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0007000000012741-156.dat	upx
behavioral1/files/0x0007000000012741-160.dat	upx
behavioral1/files/0x00070000000126a6-172.dat	upx
behavioral1/memory/1756-174-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x00070000000126c7-173.dat	upx
behavioral1/files/0x0007000000012767-175.dat	upx
behavioral1/memory/1212-185-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1476-188-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/440-190-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1132-192-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1336-193-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/836-187-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1600-200-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1016-199-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1132-194-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1080-184-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1704-211-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1372-210-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/968-214-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/2036-217-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1380-230-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Loads dropped DLL 53 IoCs

pid	Process
1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
1252	Tiwi.exe
1252	Tiwi.exe
1252	Tiwi.exe
1252	Tiwi.exe
1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
1252	Tiwi.exe
1252	Tiwi.exe
1080	IExplorer.exe
1080	IExplorer.exe
1080	IExplorer.exe
1080	IExplorer.exe
1252	Tiwi.exe
1252	Tiwi.exe
1080	IExplorer.exe
1080	IExplorer.exe
1212	winlogon.exe
1212	winlogon.exe
1080	IExplorer.exe
1080	IExplorer.exe
1212	winlogon.exe
1476	imoet.exe
1476	imoet.exe
1212	winlogon.exe
1212	winlogon.exe
1476	imoet.exe
1476	imoet.exe
440	cute.exe
440	cute.exe
1212	winlogon.exe
1212	winlogon.exe
1476	imoet.exe
440	cute.exe
440	cute.exe
440	cute.exe
440	cute.exe
1476	imoet.exe
1476	imoet.exe
440	cute.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	winlogon.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	IExplorer.exe
File opened (read-only)	\??\R:	IExplorer.exe
File opened (read-only)	\??\G:	winlogon.exe
File opened (read-only)	\??\X:	imoet.exe
File opened (read-only)	\??\B:	cute.exe
File opened (read-only)	\??\H:	cute.exe
File opened (read-only)	\??\B:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\H:	Tiwi.exe
File opened (read-only)	\??\J:	IExplorer.exe
File opened (read-only)	\??\W:	imoet.exe
File opened (read-only)	\??\Y:	winlogon.exe
File opened (read-only)	\??\Q:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\H:	IExplorer.exe
File opened (read-only)	\??\K:	winlogon.exe
File opened (read-only)	\??\U:	winlogon.exe
File opened (read-only)	\??\E:	cute.exe
File opened (read-only)	\??\Q:	cute.exe
File opened (read-only)	\??\O:	IExplorer.exe
File opened (read-only)	\??\Q:	winlogon.exe
File opened (read-only)	\??\H:	imoet.exe
File opened (read-only)	\??\Q:	imoet.exe
File opened (read-only)	\??\F:	cute.exe
File opened (read-only)	\??\W:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\U:	Tiwi.exe
File opened (read-only)	\??\X:	IExplorer.exe
File opened (read-only)	\??\J:	imoet.exe
File opened (read-only)	\??\K:	Tiwi.exe
File opened (read-only)	\??\W:	IExplorer.exe
File opened (read-only)	\??\N:	Tiwi.exe
File opened (read-only)	\??\X:	Tiwi.exe
File opened (read-only)	\??\X:	winlogon.exe
File opened (read-only)	\??\T:	imoet.exe
File opened (read-only)	\??\V:	imoet.exe
File opened (read-only)	\??\V:	cute.exe
File opened (read-only)	\??\M:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\N:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\G:	cute.exe
File opened (read-only)	\??\G:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\Y:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\J:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\T:	Tiwi.exe
File opened (read-only)	\??\K:	imoet.exe
File opened (read-only)	\??\L:	imoet.exe
File opened (read-only)	\??\U:	imoet.exe
File opened (read-only)	\??\X:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\R:	Tiwi.exe
File opened (read-only)	\??\O:	winlogon.exe
File opened (read-only)	\??\G:	imoet.exe
File opened (read-only)	\??\J:	cute.exe
File opened (read-only)	\??\M:	cute.exe
File opened (read-only)	\??\O:	cute.exe
File opened (read-only)	\??\S:	IExplorer.exe
File opened (read-only)	\??\V:	IExplorer.exe
File opened (read-only)	\??\B:	winlogon.exe
File opened (read-only)	\??\F:	imoet.exe
File opened (read-only)	\??\M:	imoet.exe
File opened (read-only)	\??\N:	cute.exe
File opened (read-only)	\??\W:	Tiwi.exe
File opened (read-only)	\??\R:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\Q:	Tiwi.exe
File opened (read-only)	\??\I:	winlogon.exe
File opened (read-only)	\??\R:	winlogon.exe
File opened (read-only)	\??\P:	imoet.exe
File opened (read-only)	\??\E:	Tiwi.exe

Modifies WinLogon 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	cute.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened for modification	C:\autorun.inf	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe

Drops file in System32 directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File created	C:\Windows\SysWOW64\tiwi.scr	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	imoet.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	cute.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	imoet.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	cute.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File created	C:\Windows\SysWOW64\shell.exe	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	Tiwi.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	imoet.exe
File created	C:\Windows\tiwi.exe	cute.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	Tiwi.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	cute.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	Tiwi.exe
File created	C:\Windows\tiwi.exe	IExplorer.exe
File created	C:\Windows\tiwi.exe	winlogon.exe
File opened for modification	C:\Windows\tiwi.exe	imoet.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 54 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Tiwi"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Tiwi"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\SwapMouseButtons = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\SwapMouseButtons = "1"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Tiwi"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Tiwi"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Tiwi"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\SwapMouseButtons = "1"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Tiwi"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Tiwi"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\SwapMouseButtons = "1"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\SwapMouseButtons = "1"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Tiwi"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Tiwi"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Tiwi"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\SwapMouseButtons = "1"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	cute.exe

Modifies Internet Explorer start page 1 TTPs 6 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	imoet.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	Tiwi.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
1252	Tiwi.exe
1476	imoet.exe
1212	winlogon.exe
1080	IExplorer.exe
440	cute.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
1252	Tiwi.exe
1080	IExplorer.exe
1212	winlogon.exe
1476	imoet.exe
440	cute.exe
552	Tiwi.exe
1496	IExplorer.exe
1380	cute.exe
2000	IExplorer.exe
288	imoet.exe
1668	IExplorer.exe
1756	winlogon.exe
848	Tiwi.exe
836	cute.exe
1132	imoet.exe
1336	IExplorer.exe
1600	winlogon.exe
1704	cute.exe
1372	Tiwi.exe
968	imoet.exe
2036	IExplorer.exe
1712	Tiwi.exe
1620	winlogon.exe
1380	cute.exe
2000	IExplorer.exe
1956	Tiwi.exe
1936	imoet.exe
744	winlogon.exe
1748	IExplorer.exe
1700	cute.exe
1692	imoet.exe
1756	winlogon.exe
1876	imoet.exe
660	cute.exe
1696	cute.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1252	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	28
PID 1016 wrote to memory of 1252	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	28
PID 1016 wrote to memory of 1252	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	28
PID 1016 wrote to memory of 1252	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	28
PID 1016 wrote to memory of 1080	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	29
PID 1016 wrote to memory of 1080	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	29
PID 1016 wrote to memory of 1080	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	29
PID 1016 wrote to memory of 1080	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	29
PID 1016 wrote to memory of 1212	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	30
PID 1016 wrote to memory of 1212	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	30
PID 1016 wrote to memory of 1212	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	30
PID 1016 wrote to memory of 1212	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	30
PID 1016 wrote to memory of 1476	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	31
PID 1016 wrote to memory of 1476	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	31
PID 1016 wrote to memory of 1476	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	31
PID 1016 wrote to memory of 1476	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	31
PID 1016 wrote to memory of 440	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	32
PID 1016 wrote to memory of 440	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	32
PID 1016 wrote to memory of 440	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	32
PID 1016 wrote to memory of 440	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	32
PID 1016 wrote to memory of 552	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	33
PID 1016 wrote to memory of 552	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	33
PID 1016 wrote to memory of 552	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	33
PID 1016 wrote to memory of 552	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	33
PID 1016 wrote to memory of 1496	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	34
PID 1016 wrote to memory of 1496	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	34
PID 1016 wrote to memory of 1496	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	34
PID 1016 wrote to memory of 1496	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	34
PID 1016 wrote to memory of 1380	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	35
PID 1016 wrote to memory of 1380	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	35
PID 1016 wrote to memory of 1380	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	35
PID 1016 wrote to memory of 1380	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	35
PID 1252 wrote to memory of 2000	1252	Tiwi.exe	49
PID 1252 wrote to memory of 2000	1252	Tiwi.exe	49
PID 1252 wrote to memory of 2000	1252	Tiwi.exe	49
PID 1252 wrote to memory of 2000	1252	Tiwi.exe	49
PID 1016 wrote to memory of 288	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	37
PID 1016 wrote to memory of 288	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	37
PID 1016 wrote to memory of 288	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	37
PID 1016 wrote to memory of 288	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	37
PID 1252 wrote to memory of 1668	1252	Tiwi.exe	62
PID 1252 wrote to memory of 1668	1252	Tiwi.exe	62
PID 1252 wrote to memory of 1668	1252	Tiwi.exe	62
PID 1252 wrote to memory of 1668	1252	Tiwi.exe	62
PID 1080 wrote to memory of 848	1080	IExplorer.exe	38
PID 1080 wrote to memory of 848	1080	IExplorer.exe	38
PID 1080 wrote to memory of 848	1080	IExplorer.exe	38
PID 1080 wrote to memory of 848	1080	IExplorer.exe	38
PID 1252 wrote to memory of 1756	1252	Tiwi.exe	61
PID 1252 wrote to memory of 1756	1252	Tiwi.exe	61
PID 1252 wrote to memory of 1756	1252	Tiwi.exe	61
PID 1252 wrote to memory of 1756	1252	Tiwi.exe	61
PID 1016 wrote to memory of 836	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	60
PID 1016 wrote to memory of 836	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	60
PID 1016 wrote to memory of 836	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	60
PID 1016 wrote to memory of 836	1016	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	60
PID 1252 wrote to memory of 1132	1252	Tiwi.exe	40
PID 1252 wrote to memory of 1132	1252	Tiwi.exe	40
PID 1252 wrote to memory of 1132	1252	Tiwi.exe	40
PID 1252 wrote to memory of 1132	1252	Tiwi.exe	40
PID 1080 wrote to memory of 1336	1080	IExplorer.exe	39
PID 1080 wrote to memory of 1336	1080	IExplorer.exe	39
PID 1080 wrote to memory of 1336	1080	IExplorer.exe	39
PID 1080 wrote to memory of 1336	1080	IExplorer.exe	39

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe

C:\Users\Admin\AppData\Local\Temp\f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
"C:\Users\Admin\AppData\Local\Temp\f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1016
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1252
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    PID:2000
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1132
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1704
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1756
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1668
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1080
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:848
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1336
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1600
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:968
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1380
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1212
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1372
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:2036
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1620
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1936
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1700
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1476
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1712
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:2000
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:744
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1692
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:660
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:440
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1956
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1748
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1876
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    PID:1756
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1696
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:552
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:1496
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:288
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
81148d2f0e47bfc10cde9ab7c73a3b32

SHA1
3cb11229ea2b9d92d10382894b421cf2a8876733

SHA256
911147889439a30b36484fec160549da735de7cbc5bdecd6bef97b7c82dfab88

SHA512
2617a0031943eeea72b7ebdf7957e8de8eb3bcfa53d3b1c562614b4fd4af610ef3ad47c97cbf53d61425ddbe6a0d6173e8c9936243136ddefa0a6c68e4f69cd1

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
81148d2f0e47bfc10cde9ab7c73a3b32

SHA1
3cb11229ea2b9d92d10382894b421cf2a8876733

SHA256
911147889439a30b36484fec160549da735de7cbc5bdecd6bef97b7c82dfab88

SHA512
2617a0031943eeea72b7ebdf7957e8de8eb3bcfa53d3b1c562614b4fd4af610ef3ad47c97cbf53d61425ddbe6a0d6173e8c9936243136ddefa0a6c68e4f69cd1

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
454193c7ec32e05c3387c3112bc5589f

SHA1
db7cfeaab566ed8c5949c94da19a8ba241252505

SHA256
23e550442999ee98444faba7691c1ebe70213c6dcd1025a8fec9acd9e12b22a7

SHA512
aa80a97293a50866302a00f4d7e02902872bd91710b1b51b79a4fbea35e49259bc7d4166d48d9871aff833cca3c440e5d1cc3917ddf2fbdb69b7caf966f68975

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
454193c7ec32e05c3387c3112bc5589f

SHA1
db7cfeaab566ed8c5949c94da19a8ba241252505

SHA256
23e550442999ee98444faba7691c1ebe70213c6dcd1025a8fec9acd9e12b22a7

SHA512
aa80a97293a50866302a00f4d7e02902872bd91710b1b51b79a4fbea35e49259bc7d4166d48d9871aff833cca3c440e5d1cc3917ddf2fbdb69b7caf966f68975

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
0f0443c7996e3ea977ec174a966e3d2d

SHA1
a700ac9b907f4bfb4aa2183894ead35acd9baf0b

SHA256
597520e78a2ef7513252f12fb60401c2bcaf96f31aa1661bd57422166df8d3f6

SHA512
18ccf3fe57e18d4a8e74ed9af9d046054ec7c276a24437c28066f7c3dd588b41cf74f1a76d99cc98c71d33ecd3d2815b0cadc3f9ab678463bed49400834ef190

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
0f0443c7996e3ea977ec174a966e3d2d

SHA1
a700ac9b907f4bfb4aa2183894ead35acd9baf0b

SHA256
597520e78a2ef7513252f12fb60401c2bcaf96f31aa1661bd57422166df8d3f6

SHA512
18ccf3fe57e18d4a8e74ed9af9d046054ec7c276a24437c28066f7c3dd588b41cf74f1a76d99cc98c71d33ecd3d2815b0cadc3f9ab678463bed49400834ef190

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
0f0443c7996e3ea977ec174a966e3d2d

SHA1
a700ac9b907f4bfb4aa2183894ead35acd9baf0b

SHA256
597520e78a2ef7513252f12fb60401c2bcaf96f31aa1661bd57422166df8d3f6

SHA512
18ccf3fe57e18d4a8e74ed9af9d046054ec7c276a24437c28066f7c3dd588b41cf74f1a76d99cc98c71d33ecd3d2815b0cadc3f9ab678463bed49400834ef190

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
81148d2f0e47bfc10cde9ab7c73a3b32

SHA1
3cb11229ea2b9d92d10382894b421cf2a8876733

SHA256
911147889439a30b36484fec160549da735de7cbc5bdecd6bef97b7c82dfab88

SHA512
2617a0031943eeea72b7ebdf7957e8de8eb3bcfa53d3b1c562614b4fd4af610ef3ad47c97cbf53d61425ddbe6a0d6173e8c9936243136ddefa0a6c68e4f69cd1

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
454193c7ec32e05c3387c3112bc5589f

SHA1
db7cfeaab566ed8c5949c94da19a8ba241252505

SHA256
23e550442999ee98444faba7691c1ebe70213c6dcd1025a8fec9acd9e12b22a7

SHA512
aa80a97293a50866302a00f4d7e02902872bd91710b1b51b79a4fbea35e49259bc7d4166d48d9871aff833cca3c440e5d1cc3917ddf2fbdb69b7caf966f68975

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
47c06b3c47f39c9794f354bbe5fe4c98

SHA1
307d1d9717ffa3193c6c8383ef9f7f7b82310da6

SHA256
5def73bb6493cfbf3ca34ddd3374ecbb0102176d2ea23e238d4165769cfd45c7

SHA512
36ca7593b69dbf5e3ee971b2590970fddf4744d9a3cbc95d86bb0f4263b511820f268c5c9e1d0f798c37a8720658ca2203e3bf5ab73fee51c95cbea6881a84f4

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
c67aa35a29011b69865570b51b742b91

SHA1
d8f6a7892ae8915724557f146f2e1efac91a9124

SHA256
eb6894d2f9e4c82b6cf25b48f313837d1da7eded63741def60d9749a93791abe

SHA512
67d17bb38905414eed7dc6e8bb64ad077a817a94cd49534c5c448649281ca6996b5e7e81793027e8ec0129af1cbe407020d936e50a17fc26378d435c2a2480c1

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
3b028d003de9e6bbdad9960b58bc2a42

SHA1
2afc322442c2c0ff5a81775b79f32d78af0c69e1

SHA256
09e1c65b86e2c59fce9f11e79e2228f0b3d811b5fa27f665eda229169a5efb06

SHA512
d7a158896183f8258f926d20b3090b2b5eeb02b655c4227a207e4abb383129111568e46250e3af4a84fa40dce8eb3df14dca113d5113a7eb08691ac63dfc57b4

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
0dad01874e34380409cc4784356ce3a7

SHA1
140b21f093b8c362ddffcf6e6bff92dd855f750c

SHA256
c8103f0fadc4524e1af94cfe84c71caac8ad6974158833ff84325ae34b198daa

SHA512
eb12196f2f7bf2867b68bccd16fa0949a6bc8bee54eec39322921a79af7644f96083de9ada9351078eb0b40818974d6312349fad4926c160cb2fa2679ad97664

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
0dad01874e34380409cc4784356ce3a7

SHA1
140b21f093b8c362ddffcf6e6bff92dd855f750c

SHA256
c8103f0fadc4524e1af94cfe84c71caac8ad6974158833ff84325ae34b198daa

SHA512
eb12196f2f7bf2867b68bccd16fa0949a6bc8bee54eec39322921a79af7644f96083de9ada9351078eb0b40818974d6312349fad4926c160cb2fa2679ad97664

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
0f0443c7996e3ea977ec174a966e3d2d

SHA1
a700ac9b907f4bfb4aa2183894ead35acd9baf0b

SHA256
597520e78a2ef7513252f12fb60401c2bcaf96f31aa1661bd57422166df8d3f6

SHA512
18ccf3fe57e18d4a8e74ed9af9d046054ec7c276a24437c28066f7c3dd588b41cf74f1a76d99cc98c71d33ecd3d2815b0cadc3f9ab678463bed49400834ef190

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe

Filesize
85KB

MD5
0f0443c7996e3ea977ec174a966e3d2d

SHA1
a700ac9b907f4bfb4aa2183894ead35acd9baf0b

SHA256
597520e78a2ef7513252f12fb60401c2bcaf96f31aa1661bd57422166df8d3f6

SHA512
18ccf3fe57e18d4a8e74ed9af9d046054ec7c276a24437c28066f7c3dd588b41cf74f1a76d99cc98c71d33ecd3d2815b0cadc3f9ab678463bed49400834ef190

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
c59873083d00b5ff19ce13f9c509a20d

SHA1
5ce9052561ce4d6e145ae83e4d3155e46c1226af

SHA256
d5aad7ec884fb82fedd8448536959a385ab4fa9bcc973f783cc5a4d50c19436e

SHA512
30a24a8f08dad285490456d5f8f81e6011deae9f2b91d96b61a83a7ce95c8f550c1e77490dba595c215f76c980aacf22493443e0a6156e21e281931776c28f1e

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
ce1b1469618ac2d5f737a66a23534a49

SHA1
7eb0a4346cd43551da80c0b81d7cd9ba66f69b79

SHA256
8aaa2f10f976e8463e121805e18fc58caa64bfe68579e088903ff5987389707d

SHA512
48289b6ad9a0516f4d66f71e33a7b411e2d7985860466d2f595cd90cfc1a9166b836f992278773330092c288a3a13d3d01378799ef837dae2714c81326143e93

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
0f0443c7996e3ea977ec174a966e3d2d

SHA1
a700ac9b907f4bfb4aa2183894ead35acd9baf0b

SHA256
597520e78a2ef7513252f12fb60401c2bcaf96f31aa1661bd57422166df8d3f6

SHA512
18ccf3fe57e18d4a8e74ed9af9d046054ec7c276a24437c28066f7c3dd588b41cf74f1a76d99cc98c71d33ecd3d2815b0cadc3f9ab678463bed49400834ef190

Download Submit
C:\Windows\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
0dad01874e34380409cc4784356ce3a7

SHA1
140b21f093b8c362ddffcf6e6bff92dd855f750c

SHA256
c8103f0fadc4524e1af94cfe84c71caac8ad6974158833ff84325ae34b198daa

SHA512
eb12196f2f7bf2867b68bccd16fa0949a6bc8bee54eec39322921a79af7644f96083de9ada9351078eb0b40818974d6312349fad4926c160cb2fa2679ad97664

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
0dad01874e34380409cc4784356ce3a7

SHA1
140b21f093b8c362ddffcf6e6bff92dd855f750c

SHA256
c8103f0fadc4524e1af94cfe84c71caac8ad6974158833ff84325ae34b198daa

SHA512
eb12196f2f7bf2867b68bccd16fa0949a6bc8bee54eec39322921a79af7644f96083de9ada9351078eb0b40818974d6312349fad4926c160cb2fa2679ad97664

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
0dad01874e34380409cc4784356ce3a7

SHA1
140b21f093b8c362ddffcf6e6bff92dd855f750c

SHA256
c8103f0fadc4524e1af94cfe84c71caac8ad6974158833ff84325ae34b198daa

SHA512
eb12196f2f7bf2867b68bccd16fa0949a6bc8bee54eec39322921a79af7644f96083de9ada9351078eb0b40818974d6312349fad4926c160cb2fa2679ad97664

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
0dad01874e34380409cc4784356ce3a7

SHA1
140b21f093b8c362ddffcf6e6bff92dd855f750c

SHA256
c8103f0fadc4524e1af94cfe84c71caac8ad6974158833ff84325ae34b198daa

SHA512
eb12196f2f7bf2867b68bccd16fa0949a6bc8bee54eec39322921a79af7644f96083de9ada9351078eb0b40818974d6312349fad4926c160cb2fa2679ad97664

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
e6bef033e6a8e7d654b95a51118473b9

SHA1
bfbd6c08448f8100e55eaa5995fcc1a93069cb2b

SHA256
ed1558887a14cd50102d895e63dbcbccb3d56026777847f2c724c7edf9832942

SHA512
15b7d96610a72235e083b33c1fe4154da7706ffe6bbd775f77cf39de27b9a2d85ed78affa6a4a28566c7ecf4e72f3c38b53f85d5817a07f30a945b2395ac7f5f

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
0f0443c7996e3ea977ec174a966e3d2d

SHA1
a700ac9b907f4bfb4aa2183894ead35acd9baf0b

SHA256
597520e78a2ef7513252f12fb60401c2bcaf96f31aa1661bd57422166df8d3f6

SHA512
18ccf3fe57e18d4a8e74ed9af9d046054ec7c276a24437c28066f7c3dd588b41cf74f1a76d99cc98c71d33ecd3d2815b0cadc3f9ab678463bed49400834ef190

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
0f0443c7996e3ea977ec174a966e3d2d

SHA1
a700ac9b907f4bfb4aa2183894ead35acd9baf0b

SHA256
597520e78a2ef7513252f12fb60401c2bcaf96f31aa1661bd57422166df8d3f6

SHA512
18ccf3fe57e18d4a8e74ed9af9d046054ec7c276a24437c28066f7c3dd588b41cf74f1a76d99cc98c71d33ecd3d2815b0cadc3f9ab678463bed49400834ef190

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
454193c7ec32e05c3387c3112bc5589f

SHA1
db7cfeaab566ed8c5949c94da19a8ba241252505

SHA256
23e550442999ee98444faba7691c1ebe70213c6dcd1025a8fec9acd9e12b22a7

SHA512
aa80a97293a50866302a00f4d7e02902872bd91710b1b51b79a4fbea35e49259bc7d4166d48d9871aff833cca3c440e5d1cc3917ddf2fbdb69b7caf966f68975

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
8398da274398f42e34fe12a640aecb2f

SHA1
90f86d22d0cd786935500b63a901907cc0ef5953

SHA256
f20b365a66740460216997566abbca5b2474ba51580354f13f7f9e53a7191c67

SHA512
a455ab4756108c1bc35b0715666c9e7f65f4b3bd93fe3f4141129682ce5ab297d06bee11f384ba717a567bfbb4a022c1d3fb5d1c46c808195631bbee88628574

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
0f0443c7996e3ea977ec174a966e3d2d

SHA1
a700ac9b907f4bfb4aa2183894ead35acd9baf0b

SHA256
597520e78a2ef7513252f12fb60401c2bcaf96f31aa1661bd57422166df8d3f6

SHA512
18ccf3fe57e18d4a8e74ed9af9d046054ec7c276a24437c28066f7c3dd588b41cf74f1a76d99cc98c71d33ecd3d2815b0cadc3f9ab678463bed49400834ef190

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
0f0443c7996e3ea977ec174a966e3d2d

SHA1
a700ac9b907f4bfb4aa2183894ead35acd9baf0b

SHA256
597520e78a2ef7513252f12fb60401c2bcaf96f31aa1661bd57422166df8d3f6

SHA512
18ccf3fe57e18d4a8e74ed9af9d046054ec7c276a24437c28066f7c3dd588b41cf74f1a76d99cc98c71d33ecd3d2815b0cadc3f9ab678463bed49400834ef190

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
454193c7ec32e05c3387c3112bc5589f

SHA1
db7cfeaab566ed8c5949c94da19a8ba241252505

SHA256
23e550442999ee98444faba7691c1ebe70213c6dcd1025a8fec9acd9e12b22a7

SHA512
aa80a97293a50866302a00f4d7e02902872bd91710b1b51b79a4fbea35e49259bc7d4166d48d9871aff833cca3c440e5d1cc3917ddf2fbdb69b7caf966f68975

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
3b028d003de9e6bbdad9960b58bc2a42

SHA1
2afc322442c2c0ff5a81775b79f32d78af0c69e1

SHA256
09e1c65b86e2c59fce9f11e79e2228f0b3d811b5fa27f665eda229169a5efb06

SHA512
d7a158896183f8258f926d20b3090b2b5eeb02b655c4227a207e4abb383129111568e46250e3af4a84fa40dce8eb3df14dca113d5113a7eb08691ac63dfc57b4

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
3b028d003de9e6bbdad9960b58bc2a42

SHA1
2afc322442c2c0ff5a81775b79f32d78af0c69e1

SHA256
09e1c65b86e2c59fce9f11e79e2228f0b3d811b5fa27f665eda229169a5efb06

SHA512
d7a158896183f8258f926d20b3090b2b5eeb02b655c4227a207e4abb383129111568e46250e3af4a84fa40dce8eb3df14dca113d5113a7eb08691ac63dfc57b4

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
3b028d003de9e6bbdad9960b58bc2a42

SHA1
2afc322442c2c0ff5a81775b79f32d78af0c69e1

SHA256
09e1c65b86e2c59fce9f11e79e2228f0b3d811b5fa27f665eda229169a5efb06

SHA512
d7a158896183f8258f926d20b3090b2b5eeb02b655c4227a207e4abb383129111568e46250e3af4a84fa40dce8eb3df14dca113d5113a7eb08691ac63dfc57b4

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
3b028d003de9e6bbdad9960b58bc2a42

SHA1
2afc322442c2c0ff5a81775b79f32d78af0c69e1

SHA256
09e1c65b86e2c59fce9f11e79e2228f0b3d811b5fa27f665eda229169a5efb06

SHA512
d7a158896183f8258f926d20b3090b2b5eeb02b655c4227a207e4abb383129111568e46250e3af4a84fa40dce8eb3df14dca113d5113a7eb08691ac63dfc57b4

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
3b028d003de9e6bbdad9960b58bc2a42

SHA1
2afc322442c2c0ff5a81775b79f32d78af0c69e1

SHA256
09e1c65b86e2c59fce9f11e79e2228f0b3d811b5fa27f665eda229169a5efb06

SHA512
d7a158896183f8258f926d20b3090b2b5eeb02b655c4227a207e4abb383129111568e46250e3af4a84fa40dce8eb3df14dca113d5113a7eb08691ac63dfc57b4

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
37eeb01aca4f9ad7f25589b63bf1ab23

SHA1
8f37e5a94e22c29928cd4b61d08201996a12e691

SHA256
2437056249cf88627dbebc31058d0a0c58384944d2d47dc2a273021bb76087fa

SHA512
f6c42ee023e450e8eaf6281e967c1101995f5a07f5fd33467fa8ad1dbc4ae0a40bb0c131381b599fd8f0b37b80b3ada07491ee3672b228cbdef6b8058d0d8b28

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
0f0443c7996e3ea977ec174a966e3d2d

SHA1
a700ac9b907f4bfb4aa2183894ead35acd9baf0b

SHA256
597520e78a2ef7513252f12fb60401c2bcaf96f31aa1661bd57422166df8d3f6

SHA512
18ccf3fe57e18d4a8e74ed9af9d046054ec7c276a24437c28066f7c3dd588b41cf74f1a76d99cc98c71d33ecd3d2815b0cadc3f9ab678463bed49400834ef190

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
0f0443c7996e3ea977ec174a966e3d2d

SHA1
a700ac9b907f4bfb4aa2183894ead35acd9baf0b

SHA256
597520e78a2ef7513252f12fb60401c2bcaf96f31aa1661bd57422166df8d3f6

SHA512
18ccf3fe57e18d4a8e74ed9af9d046054ec7c276a24437c28066f7c3dd588b41cf74f1a76d99cc98c71d33ecd3d2815b0cadc3f9ab678463bed49400834ef190

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
454193c7ec32e05c3387c3112bc5589f

SHA1
db7cfeaab566ed8c5949c94da19a8ba241252505

SHA256
23e550442999ee98444faba7691c1ebe70213c6dcd1025a8fec9acd9e12b22a7

SHA512
aa80a97293a50866302a00f4d7e02902872bd91710b1b51b79a4fbea35e49259bc7d4166d48d9871aff833cca3c440e5d1cc3917ddf2fbdb69b7caf966f68975

Download Submit
\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
81148d2f0e47bfc10cde9ab7c73a3b32

SHA1
3cb11229ea2b9d92d10382894b421cf2a8876733

SHA256
911147889439a30b36484fec160549da735de7cbc5bdecd6bef97b7c82dfab88

SHA512
2617a0031943eeea72b7ebdf7957e8de8eb3bcfa53d3b1c562614b4fd4af610ef3ad47c97cbf53d61425ddbe6a0d6173e8c9936243136ddefa0a6c68e4f69cd1

Download Submit
\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
81148d2f0e47bfc10cde9ab7c73a3b32

SHA1
3cb11229ea2b9d92d10382894b421cf2a8876733

SHA256
911147889439a30b36484fec160549da735de7cbc5bdecd6bef97b7c82dfab88

SHA512
2617a0031943eeea72b7ebdf7957e8de8eb3bcfa53d3b1c562614b4fd4af610ef3ad47c97cbf53d61425ddbe6a0d6173e8c9936243136ddefa0a6c68e4f69cd1

Download Submit
\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
81148d2f0e47bfc10cde9ab7c73a3b32

SHA1
3cb11229ea2b9d92d10382894b421cf2a8876733

SHA256
911147889439a30b36484fec160549da735de7cbc5bdecd6bef97b7c82dfab88

SHA512
2617a0031943eeea72b7ebdf7957e8de8eb3bcfa53d3b1c562614b4fd4af610ef3ad47c97cbf53d61425ddbe6a0d6173e8c9936243136ddefa0a6c68e4f69cd1

Download Submit
\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
81148d2f0e47bfc10cde9ab7c73a3b32

SHA1
3cb11229ea2b9d92d10382894b421cf2a8876733

SHA256
911147889439a30b36484fec160549da735de7cbc5bdecd6bef97b7c82dfab88

SHA512
2617a0031943eeea72b7ebdf7957e8de8eb3bcfa53d3b1c562614b4fd4af610ef3ad47c97cbf53d61425ddbe6a0d6173e8c9936243136ddefa0a6c68e4f69cd1

Download Submit
\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
454193c7ec32e05c3387c3112bc5589f

SHA1
db7cfeaab566ed8c5949c94da19a8ba241252505

SHA256
23e550442999ee98444faba7691c1ebe70213c6dcd1025a8fec9acd9e12b22a7

SHA512
aa80a97293a50866302a00f4d7e02902872bd91710b1b51b79a4fbea35e49259bc7d4166d48d9871aff833cca3c440e5d1cc3917ddf2fbdb69b7caf966f68975

Download Submit
\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
454193c7ec32e05c3387c3112bc5589f

SHA1
db7cfeaab566ed8c5949c94da19a8ba241252505

SHA256
23e550442999ee98444faba7691c1ebe70213c6dcd1025a8fec9acd9e12b22a7

SHA512
aa80a97293a50866302a00f4d7e02902872bd91710b1b51b79a4fbea35e49259bc7d4166d48d9871aff833cca3c440e5d1cc3917ddf2fbdb69b7caf966f68975

Download Submit
\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
454193c7ec32e05c3387c3112bc5589f

SHA1
db7cfeaab566ed8c5949c94da19a8ba241252505

SHA256
23e550442999ee98444faba7691c1ebe70213c6dcd1025a8fec9acd9e12b22a7

SHA512
aa80a97293a50866302a00f4d7e02902872bd91710b1b51b79a4fbea35e49259bc7d4166d48d9871aff833cca3c440e5d1cc3917ddf2fbdb69b7caf966f68975

Download Submit
\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
454193c7ec32e05c3387c3112bc5589f

SHA1
db7cfeaab566ed8c5949c94da19a8ba241252505

SHA256
23e550442999ee98444faba7691c1ebe70213c6dcd1025a8fec9acd9e12b22a7

SHA512
aa80a97293a50866302a00f4d7e02902872bd91710b1b51b79a4fbea35e49259bc7d4166d48d9871aff833cca3c440e5d1cc3917ddf2fbdb69b7caf966f68975

Download Submit
\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
454193c7ec32e05c3387c3112bc5589f

SHA1
db7cfeaab566ed8c5949c94da19a8ba241252505

SHA256
23e550442999ee98444faba7691c1ebe70213c6dcd1025a8fec9acd9e12b22a7

SHA512
aa80a97293a50866302a00f4d7e02902872bd91710b1b51b79a4fbea35e49259bc7d4166d48d9871aff833cca3c440e5d1cc3917ddf2fbdb69b7caf966f68975

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
0f0443c7996e3ea977ec174a966e3d2d

SHA1
a700ac9b907f4bfb4aa2183894ead35acd9baf0b

SHA256
597520e78a2ef7513252f12fb60401c2bcaf96f31aa1661bd57422166df8d3f6

SHA512
18ccf3fe57e18d4a8e74ed9af9d046054ec7c276a24437c28066f7c3dd588b41cf74f1a76d99cc98c71d33ecd3d2815b0cadc3f9ab678463bed49400834ef190

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
0f0443c7996e3ea977ec174a966e3d2d

SHA1
a700ac9b907f4bfb4aa2183894ead35acd9baf0b

SHA256
597520e78a2ef7513252f12fb60401c2bcaf96f31aa1661bd57422166df8d3f6

SHA512
18ccf3fe57e18d4a8e74ed9af9d046054ec7c276a24437c28066f7c3dd588b41cf74f1a76d99cc98c71d33ecd3d2815b0cadc3f9ab678463bed49400834ef190

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
0f0443c7996e3ea977ec174a966e3d2d

SHA1
a700ac9b907f4bfb4aa2183894ead35acd9baf0b

SHA256
597520e78a2ef7513252f12fb60401c2bcaf96f31aa1661bd57422166df8d3f6

SHA512
18ccf3fe57e18d4a8e74ed9af9d046054ec7c276a24437c28066f7c3dd588b41cf74f1a76d99cc98c71d33ecd3d2815b0cadc3f9ab678463bed49400834ef190

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
0f0443c7996e3ea977ec174a966e3d2d

SHA1
a700ac9b907f4bfb4aa2183894ead35acd9baf0b

SHA256
597520e78a2ef7513252f12fb60401c2bcaf96f31aa1661bd57422166df8d3f6

SHA512
18ccf3fe57e18d4a8e74ed9af9d046054ec7c276a24437c28066f7c3dd588b41cf74f1a76d99cc98c71d33ecd3d2815b0cadc3f9ab678463bed49400834ef190

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
0f0443c7996e3ea977ec174a966e3d2d

SHA1
a700ac9b907f4bfb4aa2183894ead35acd9baf0b

SHA256
597520e78a2ef7513252f12fb60401c2bcaf96f31aa1661bd57422166df8d3f6

SHA512
18ccf3fe57e18d4a8e74ed9af9d046054ec7c276a24437c28066f7c3dd588b41cf74f1a76d99cc98c71d33ecd3d2815b0cadc3f9ab678463bed49400834ef190

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
0f0443c7996e3ea977ec174a966e3d2d

SHA1
a700ac9b907f4bfb4aa2183894ead35acd9baf0b

SHA256
597520e78a2ef7513252f12fb60401c2bcaf96f31aa1661bd57422166df8d3f6

SHA512
18ccf3fe57e18d4a8e74ed9af9d046054ec7c276a24437c28066f7c3dd588b41cf74f1a76d99cc98c71d33ecd3d2815b0cadc3f9ab678463bed49400834ef190

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
0dad01874e34380409cc4784356ce3a7

SHA1
140b21f093b8c362ddffcf6e6bff92dd855f750c

SHA256
c8103f0fadc4524e1af94cfe84c71caac8ad6974158833ff84325ae34b198daa

SHA512
eb12196f2f7bf2867b68bccd16fa0949a6bc8bee54eec39322921a79af7644f96083de9ada9351078eb0b40818974d6312349fad4926c160cb2fa2679ad97664

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
0dad01874e34380409cc4784356ce3a7

SHA1
140b21f093b8c362ddffcf6e6bff92dd855f750c

SHA256
c8103f0fadc4524e1af94cfe84c71caac8ad6974158833ff84325ae34b198daa

SHA512
eb12196f2f7bf2867b68bccd16fa0949a6bc8bee54eec39322921a79af7644f96083de9ada9351078eb0b40818974d6312349fad4926c160cb2fa2679ad97664

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
0dad01874e34380409cc4784356ce3a7

SHA1
140b21f093b8c362ddffcf6e6bff92dd855f750c

SHA256
c8103f0fadc4524e1af94cfe84c71caac8ad6974158833ff84325ae34b198daa

SHA512
eb12196f2f7bf2867b68bccd16fa0949a6bc8bee54eec39322921a79af7644f96083de9ada9351078eb0b40818974d6312349fad4926c160cb2fa2679ad97664

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
0dad01874e34380409cc4784356ce3a7

SHA1
140b21f093b8c362ddffcf6e6bff92dd855f750c

SHA256
c8103f0fadc4524e1af94cfe84c71caac8ad6974158833ff84325ae34b198daa

SHA512
eb12196f2f7bf2867b68bccd16fa0949a6bc8bee54eec39322921a79af7644f96083de9ada9351078eb0b40818974d6312349fad4926c160cb2fa2679ad97664

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
0dad01874e34380409cc4784356ce3a7

SHA1
140b21f093b8c362ddffcf6e6bff92dd855f750c

SHA256
c8103f0fadc4524e1af94cfe84c71caac8ad6974158833ff84325ae34b198daa

SHA512
eb12196f2f7bf2867b68bccd16fa0949a6bc8bee54eec39322921a79af7644f96083de9ada9351078eb0b40818974d6312349fad4926c160cb2fa2679ad97664

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
0dad01874e34380409cc4784356ce3a7

SHA1
140b21f093b8c362ddffcf6e6bff92dd855f750c

SHA256
c8103f0fadc4524e1af94cfe84c71caac8ad6974158833ff84325ae34b198daa

SHA512
eb12196f2f7bf2867b68bccd16fa0949a6bc8bee54eec39322921a79af7644f96083de9ada9351078eb0b40818974d6312349fad4926c160cb2fa2679ad97664

Download Submit
memory/288-159-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/440-190-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/440-277-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/552-99-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/660-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/744-247-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/836-187-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/848-181-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/968-214-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-182-0x00000000025D0000-0x0000000002603000-memory.dmp

Filesize
204KB

Download
memory/1016-59-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-61-0x00000000025D0000-0x0000000002603000-memory.dmp

Filesize
204KB

Download
memory/1016-183-0x00000000025D0000-0x0000000002603000-memory.dmp

Filesize
204KB

Download
memory/1016-199-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-56-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/1080-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1080-272-0x0000000002560000-0x0000000002593000-memory.dmp

Filesize
204KB

Download
memory/1080-274-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1132-192-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1132-194-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1212-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1212-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1252-273-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1252-63-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1336-193-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1372-210-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1380-230-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1380-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1476-188-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1476-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1496-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1600-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1620-231-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1668-155-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1692-258-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1696-271-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1700-252-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1704-211-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1712-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1748-250-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1756-174-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1756-262-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1876-265-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1936-243-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1956-239-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2000-134-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2000-240-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2036-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download