f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec

Analysis

max time kernel
154s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Size

85KB
MD5

0f5b0266c5bfe0ff10d855ee64bdf8d6
SHA1

17a0e559a951b54e6aaeec7616aabb9014860952
SHA256

f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec
SHA512

2d74b64e27cf46659f4168c040f5b96c8aade4caf6bc0d2d3717a9f47485b98bc57d4b2afa494c1ab907086f2c4ef7d9309ea8727d00f9610c670c47ba43ada3
SSDEEP

768:Nh5sxVPFXfgaDjof4ZgHqLNhldu8pGTUTY26TsGrn5wFbUzMsPzB5KXwekfp:NHsxFJfgaDjofVKn1pGwTJOlw1UrWwl

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	cute.exe

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	cute.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Tiwi.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 35 IoCs

pid	Process
4940	Tiwi.exe
4824	IExplorer.exe
4800	Tiwi.exe
792	IExplorer.exe
3000	winlogon.exe
2816	imoet.exe
2676	cute.exe
2584	winlogon.exe
392	imoet.exe
2836	cute.exe
4124	Tiwi.exe
788	Tiwi.exe
3924	IExplorer.exe
2032	IExplorer.exe
2508	winlogon.exe
3452	winlogon.exe
3524	imoet.exe
4304	imoet.exe
4156	cute.exe
4408	cute.exe
1196	Tiwi.exe
4536	Tiwi.exe
4996	Tiwi.exe
3196	IExplorer.exe
1840	IExplorer.exe
2276	IExplorer.exe
628	winlogon.exe
1960	winlogon.exe
3844	winlogon.exe
3240	imoet.exe
2968	imoet.exe
3916	imoet.exe
4080	cute.exe
1108	cute.exe
2392	cute.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1180-132-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e0c-136.dat	upx
behavioral2/files/0x0006000000022e0c-137.dat	upx
behavioral2/files/0x0006000000022e10-141.dat	upx
behavioral2/files/0x0006000000022e10-142.dat	upx
behavioral2/files/0x0006000000022e0c-146.dat	upx
behavioral2/files/0x0006000000022e10-152.dat	upx
behavioral2/memory/4800-155-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/792-156-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e12-158.dat	upx
behavioral2/files/0x0006000000022e12-160.dat	upx
behavioral2/memory/4940-159-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/3000-164-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/4824-162-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e13-166.dat	upx
behavioral2/files/0x0006000000022e13-167.dat	upx
behavioral2/files/0x0006000000022e14-171.dat	upx
behavioral2/files/0x0006000000022e14-172.dat	upx
behavioral2/files/0x0006000000022e12-176.dat	upx
behavioral2/memory/2584-179-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e13-181.dat	upx
behavioral2/files/0x0006000000022e14-186.dat	upx
behavioral2/memory/392-185-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e0f-191.dat	upx
behavioral2/files/0x0006000000022e0e-190.dat	upx
behavioral2/files/0x0006000000022e0d-189.dat	upx
behavioral2/files/0x0006000000022e15-187.dat	upx
behavioral2/files/0x0006000000022e11-192.dat	upx
behavioral2/memory/2836-199-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/1180-200-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e0c-197.dat	upx
behavioral2/files/0x0006000000022e0e-205.dat	upx
behavioral2/files/0x0006000000022e11-207.dat	upx
behavioral2/files/0x0006000000022e0c-211.dat	upx
behavioral2/files/0x0006000000022e0f-206.dat	upx
behavioral2/memory/4124-217-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e10-218.dat	upx
behavioral2/files/0x0006000000022e10-220.dat	upx
behavioral2/memory/788-219-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e0d-204.dat	upx
behavioral2/memory/3924-226-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/2676-231-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e12-230.dat	upx
behavioral2/files/0x0006000000022e12-233.dat	upx
behavioral2/memory/2816-229-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/3452-237-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/memory/2508-238-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e0e-241.dat	upx
behavioral2/files/0x0006000000022e13-245.dat	upx
behavioral2/files/0x0006000000022e0f-249.dat	upx
behavioral2/files/0x0006000000022e0e-248.dat	upx
behavioral2/files/0x0006000000022e0d-247.dat	upx
behavioral2/files/0x0006000000022e13-246.dat	upx
behavioral2/memory/3524-256-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e15-257.dat	upx
behavioral2/files/0x0006000000022e0e-260.dat	upx
behavioral2/files/0x0006000000022e14-264.dat	upx
behavioral2/files/0x0006000000022e14-270.dat	upx
behavioral2/files/0x0006000000022e0f-277.dat	upx
behavioral2/files/0x0006000000022e0f-275.dat	upx
behavioral2/files/0x0006000000022e0e-274.dat	upx
behavioral2/memory/4156-273-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral2/files/0x0006000000022e0d-272.dat	upx
behavioral2/files/0x0006000000022e0e-271.dat	upx

Loads dropped DLL 6 IoCs

pid	Process
4800	Tiwi.exe
4124	Tiwi.exe
788	Tiwi.exe
1196	Tiwi.exe
4536	Tiwi.exe
4996	Tiwi.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	Tiwi.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	Tiwi.exe
File opened (read-only)	\??\M:	winlogon.exe
File opened (read-only)	\??\O:	winlogon.exe
File opened (read-only)	\??\Q:	winlogon.exe
File opened (read-only)	\??\W:	winlogon.exe
File opened (read-only)	\??\G:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\T:	IExplorer.exe
File opened (read-only)	\??\X:	IExplorer.exe
File opened (read-only)	\??\L:	imoet.exe
File opened (read-only)	\??\J:	cute.exe
File opened (read-only)	\??\L:	IExplorer.exe
File opened (read-only)	\??\B:	Tiwi.exe
File opened (read-only)	\??\G:	winlogon.exe
File opened (read-only)	\??\M:	IExplorer.exe
File opened (read-only)	\??\Y:	Tiwi.exe
File opened (read-only)	\??\R:	imoet.exe
File opened (read-only)	\??\V:	cute.exe
File opened (read-only)	\??\J:	imoet.exe
File opened (read-only)	\??\S:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\H:	winlogon.exe
File opened (read-only)	\??\F:	cute.exe
File opened (read-only)	\??\J:	winlogon.exe
File opened (read-only)	\??\V:	winlogon.exe
File opened (read-only)	\??\Q:	cute.exe
File opened (read-only)	\??\I:	imoet.exe
File opened (read-only)	\??\Q:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\V:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\Z:	IExplorer.exe
File opened (read-only)	\??\N:	imoet.exe
File opened (read-only)	\??\U:	imoet.exe
File opened (read-only)	\??\Z:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\P:	winlogon.exe
File opened (read-only)	\??\X:	cute.exe
File opened (read-only)	\??\P:	imoet.exe
File opened (read-only)	\??\B:	winlogon.exe
File opened (read-only)	\??\S:	winlogon.exe
File opened (read-only)	\??\B:	cute.exe
File opened (read-only)	\??\G:	cute.exe
File opened (read-only)	\??\E:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\K:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\F:	Tiwi.exe
File opened (read-only)	\??\W:	Tiwi.exe
File opened (read-only)	\??\H:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\V:	IExplorer.exe
File opened (read-only)	\??\V:	Tiwi.exe
File opened (read-only)	\??\B:	IExplorer.exe
File opened (read-only)	\??\P:	IExplorer.exe
File opened (read-only)	\??\N:	winlogon.exe
File opened (read-only)	\??\L:	Tiwi.exe
File opened (read-only)	\??\I:	winlogon.exe
File opened (read-only)	\??\I:	IExplorer.exe
File opened (read-only)	\??\U:	IExplorer.exe
File opened (read-only)	\??\F:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\T:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\U:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\B:	imoet.exe
File opened (read-only)	\??\G:	imoet.exe
File opened (read-only)	\??\V:	imoet.exe
File opened (read-only)	\??\W:	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened (read-only)	\??\Y:	IExplorer.exe
File opened (read-only)	\??\Z:	Tiwi.exe
File opened (read-only)	\??\M:	cute.exe
File opened (read-only)	\??\Y:	cute.exe
File opened (read-only)	\??\S:	imoet.exe

Modifies WinLogon 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	imoet.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened for modification	C:\autorun.inf	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe

Drops file in System32 directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	cute.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\tiwi.scr	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	imoet.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\shell.exe	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	imoet.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	cute.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	imoet.exe
File opened for modification	C:\Windows\tiwi.exe	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	Tiwi.exe
File opened for modification	C:\Windows\tiwi.exe	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	Tiwi.exe
File opened for modification	C:\Windows\tiwi.exe	winlogon.exe
File opened for modification	C:\Windows\tiwi.exe	imoet.exe
File opened for modification	C:\Windows\tiwi.exe	cute.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	IExplorer.exe
File created	C:\Windows\tiwi.exe	winlogon.exe
File created	C:\Windows\tiwi.exe	cute.exe

Modifies Control Panel 54 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\s1159 = "Tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\s2359 = "Tiwi"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Mouse\SwapMouseButtons = "1"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\s1159 = "Tiwi"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\s2359 = "Tiwi"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\s1159 = "Tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Mouse\SwapMouseButtons = "1"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\s2359 = "Tiwi"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Mouse\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Mouse\SwapMouseButtons = "1"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\s2359 = "Tiwi"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Mouse\	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Mouse\	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Mouse\	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Mouse\SwapMouseButtons = "1"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Mouse\	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\s2359 = "Tiwi"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\s1159 = "Tiwi"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Mouse\	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Mouse\SwapMouseButtons = "1"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\s1159 = "Tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\s1159 = "Tiwi"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Mouse\SwapMouseButtons = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\s2359 = "Tiwi"	IExplorer.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	winlogon.exe

Modifies Internet Explorer start page 1 TTPs 6 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	cute.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
4940	Tiwi.exe
2816	imoet.exe
3000	winlogon.exe
4824	IExplorer.exe
2676	cute.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
4940	Tiwi.exe
4824	IExplorer.exe
4800	Tiwi.exe
792	IExplorer.exe
3000	winlogon.exe
2816	imoet.exe
2676	cute.exe
2584	winlogon.exe
392	imoet.exe
2836	cute.exe
4124	Tiwi.exe
788	Tiwi.exe
3924	IExplorer.exe
2032	IExplorer.exe
2508	winlogon.exe
3452	winlogon.exe
3524	imoet.exe
4304	imoet.exe
4156	cute.exe
4408	cute.exe
1196	Tiwi.exe
4536	Tiwi.exe
4996	Tiwi.exe
3196	IExplorer.exe
1840	IExplorer.exe
2276	IExplorer.exe
628	winlogon.exe
1960	winlogon.exe
3844	winlogon.exe
3240	imoet.exe
2968	imoet.exe
3916	imoet.exe
4080	cute.exe
1108	cute.exe
2392	cute.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 4940	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	82
PID 1180 wrote to memory of 4940	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	82
PID 1180 wrote to memory of 4940	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	82
PID 1180 wrote to memory of 4824	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	83
PID 1180 wrote to memory of 4824	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	83
PID 1180 wrote to memory of 4824	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	83
PID 1180 wrote to memory of 4800	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	84
PID 1180 wrote to memory of 4800	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	84
PID 1180 wrote to memory of 4800	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	84
PID 1180 wrote to memory of 792	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	85
PID 1180 wrote to memory of 792	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	85
PID 1180 wrote to memory of 792	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	85
PID 1180 wrote to memory of 3000	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	86
PID 1180 wrote to memory of 3000	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	86
PID 1180 wrote to memory of 3000	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	86
PID 1180 wrote to memory of 2816	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	87
PID 1180 wrote to memory of 2816	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	87
PID 1180 wrote to memory of 2816	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	87
PID 1180 wrote to memory of 2676	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	88
PID 1180 wrote to memory of 2676	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	88
PID 1180 wrote to memory of 2676	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	88
PID 1180 wrote to memory of 2584	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	89
PID 1180 wrote to memory of 2584	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	89
PID 1180 wrote to memory of 2584	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	89
PID 1180 wrote to memory of 392	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	90
PID 1180 wrote to memory of 392	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	90
PID 1180 wrote to memory of 392	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	90
PID 1180 wrote to memory of 2836	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	91
PID 1180 wrote to memory of 2836	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	91
PID 1180 wrote to memory of 2836	1180	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe	91
PID 4940 wrote to memory of 4124	4940	Tiwi.exe	92
PID 4940 wrote to memory of 4124	4940	Tiwi.exe	92
PID 4940 wrote to memory of 4124	4940	Tiwi.exe	92
PID 4824 wrote to memory of 788	4824	IExplorer.exe	93
PID 4824 wrote to memory of 788	4824	IExplorer.exe	93
PID 4824 wrote to memory of 788	4824	IExplorer.exe	93
PID 4940 wrote to memory of 2032	4940	Tiwi.exe	94
PID 4940 wrote to memory of 2032	4940	Tiwi.exe	94
PID 4940 wrote to memory of 2032	4940	Tiwi.exe	94
PID 4824 wrote to memory of 3924	4824	IExplorer.exe	95
PID 4824 wrote to memory of 3924	4824	IExplorer.exe	95
PID 4824 wrote to memory of 3924	4824	IExplorer.exe	95
PID 4940 wrote to memory of 2508	4940	Tiwi.exe	97
PID 4824 wrote to memory of 3452	4824	IExplorer.exe	96
PID 4940 wrote to memory of 2508	4940	Tiwi.exe	97
PID 4940 wrote to memory of 2508	4940	Tiwi.exe	97
PID 4824 wrote to memory of 3452	4824	IExplorer.exe	96
PID 4824 wrote to memory of 3452	4824	IExplorer.exe	96
PID 4824 wrote to memory of 3524	4824	IExplorer.exe	107
PID 4824 wrote to memory of 3524	4824	IExplorer.exe	107
PID 4824 wrote to memory of 3524	4824	IExplorer.exe	107
PID 4940 wrote to memory of 4304	4940	Tiwi.exe	106
PID 4940 wrote to memory of 4304	4940	Tiwi.exe	106
PID 4940 wrote to memory of 4304	4940	Tiwi.exe	106
PID 4824 wrote to memory of 4156	4824	IExplorer.exe	98
PID 4824 wrote to memory of 4156	4824	IExplorer.exe	98
PID 4824 wrote to memory of 4156	4824	IExplorer.exe	98
PID 4940 wrote to memory of 4408	4940	Tiwi.exe	99
PID 4940 wrote to memory of 4408	4940	Tiwi.exe	99
PID 4940 wrote to memory of 4408	4940	Tiwi.exe	99
PID 3000 wrote to memory of 1196	3000	winlogon.exe	101
PID 3000 wrote to memory of 1196	3000	winlogon.exe	101
PID 3000 wrote to memory of 1196	3000	winlogon.exe	101
PID 2816 wrote to memory of 4536	2816	imoet.exe	100

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cute.exe

C:\Users\Admin\AppData\Local\Temp\f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe
"C:\Users\Admin\AppData\Local\Temp\f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1180
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4940
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4124
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:2032
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2508
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4408
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4304
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4824
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:788
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:3924
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3452
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4156
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3524
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4800
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:792
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3000
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1196
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1840
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1960
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2968
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4080
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2816
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4536
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:3196
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3844
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3916
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2392
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:2676
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4996
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:2276
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:628
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3240
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1108
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2584
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:392
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
11042eb898d367c10db7b740992a2ca3

SHA1
2e8d05cf7b81ae25517e8ee264480514fe290698

SHA256
15d535934d99b30526572625e5ba47d164c0b295b6bae8800f8d9861f034821e

SHA512
eed494482e2c9eaee83e56a00caa5b42b27ce4a0541fc75fd1becff8d8b67a812ffb01b07b18a4dce26719b1d294e69e9d20b1125da33bc16d28931e051047e8

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
11042eb898d367c10db7b740992a2ca3

SHA1
2e8d05cf7b81ae25517e8ee264480514fe290698

SHA256
15d535934d99b30526572625e5ba47d164c0b295b6bae8800f8d9861f034821e

SHA512
eed494482e2c9eaee83e56a00caa5b42b27ce4a0541fc75fd1becff8d8b67a812ffb01b07b18a4dce26719b1d294e69e9d20b1125da33bc16d28931e051047e8

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
11042eb898d367c10db7b740992a2ca3

SHA1
2e8d05cf7b81ae25517e8ee264480514fe290698

SHA256
15d535934d99b30526572625e5ba47d164c0b295b6bae8800f8d9861f034821e

SHA512
eed494482e2c9eaee83e56a00caa5b42b27ce4a0541fc75fd1becff8d8b67a812ffb01b07b18a4dce26719b1d294e69e9d20b1125da33bc16d28931e051047e8

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
11042eb898d367c10db7b740992a2ca3

SHA1
2e8d05cf7b81ae25517e8ee264480514fe290698

SHA256
15d535934d99b30526572625e5ba47d164c0b295b6bae8800f8d9861f034821e

SHA512
eed494482e2c9eaee83e56a00caa5b42b27ce4a0541fc75fd1becff8d8b67a812ffb01b07b18a4dce26719b1d294e69e9d20b1125da33bc16d28931e051047e8

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
a6c16df57052d52cb9eef81b1d0a4157

SHA1
48e460c4136b38c50c77e56b15beddf84b8675f8

SHA256
d59c7c8661344f5d2ee6e10ba9519c4e58caa1bb6751264c3e0320642fd13d4c

SHA512
41c9465f539d96be63d217905fb694591e6fe1f22d7965338a14b345428f35521db7e87676d68cbbcc43fc06c2a35a8736f1738b029e9545c860138c3b34771d

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
a6c16df57052d52cb9eef81b1d0a4157

SHA1
48e460c4136b38c50c77e56b15beddf84b8675f8

SHA256
d59c7c8661344f5d2ee6e10ba9519c4e58caa1bb6751264c3e0320642fd13d4c

SHA512
41c9465f539d96be63d217905fb694591e6fe1f22d7965338a14b345428f35521db7e87676d68cbbcc43fc06c2a35a8736f1738b029e9545c860138c3b34771d

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
a6c16df57052d52cb9eef81b1d0a4157

SHA1
48e460c4136b38c50c77e56b15beddf84b8675f8

SHA256
d59c7c8661344f5d2ee6e10ba9519c4e58caa1bb6751264c3e0320642fd13d4c

SHA512
41c9465f539d96be63d217905fb694591e6fe1f22d7965338a14b345428f35521db7e87676d68cbbcc43fc06c2a35a8736f1738b029e9545c860138c3b34771d

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
a6c16df57052d52cb9eef81b1d0a4157

SHA1
48e460c4136b38c50c77e56b15beddf84b8675f8

SHA256
d59c7c8661344f5d2ee6e10ba9519c4e58caa1bb6751264c3e0320642fd13d4c

SHA512
41c9465f539d96be63d217905fb694591e6fe1f22d7965338a14b345428f35521db7e87676d68cbbcc43fc06c2a35a8736f1738b029e9545c860138c3b34771d

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
a50f37646d171960decb5c28677b7815

SHA1
e95d9eebd06dd94a70fed26b6d6b8806cc96410a

SHA256
52a51c5d300504c20c3104d1e43fac3f118c172d8267c4757f79936b78712fca

SHA512
c8e515f125951e813783bfa07b0a6c39e54ad058bea0ef550da9e6006fc068b801465a4cb226c9855dc209f5fb0705182ad4f0ac12bd082e7f126a975c14b24a

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
a50f37646d171960decb5c28677b7815

SHA1
e95d9eebd06dd94a70fed26b6d6b8806cc96410a

SHA256
52a51c5d300504c20c3104d1e43fac3f118c172d8267c4757f79936b78712fca

SHA512
c8e515f125951e813783bfa07b0a6c39e54ad058bea0ef550da9e6006fc068b801465a4cb226c9855dc209f5fb0705182ad4f0ac12bd082e7f126a975c14b24a

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
a50f37646d171960decb5c28677b7815

SHA1
e95d9eebd06dd94a70fed26b6d6b8806cc96410a

SHA256
52a51c5d300504c20c3104d1e43fac3f118c172d8267c4757f79936b78712fca

SHA512
c8e515f125951e813783bfa07b0a6c39e54ad058bea0ef550da9e6006fc068b801465a4cb226c9855dc209f5fb0705182ad4f0ac12bd082e7f126a975c14b24a

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
a50f37646d171960decb5c28677b7815

SHA1
e95d9eebd06dd94a70fed26b6d6b8806cc96410a

SHA256
52a51c5d300504c20c3104d1e43fac3f118c172d8267c4757f79936b78712fca

SHA512
c8e515f125951e813783bfa07b0a6c39e54ad058bea0ef550da9e6006fc068b801465a4cb226c9855dc209f5fb0705182ad4f0ac12bd082e7f126a975c14b24a

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
11042eb898d367c10db7b740992a2ca3

SHA1
2e8d05cf7b81ae25517e8ee264480514fe290698

SHA256
15d535934d99b30526572625e5ba47d164c0b295b6bae8800f8d9861f034821e

SHA512
eed494482e2c9eaee83e56a00caa5b42b27ce4a0541fc75fd1becff8d8b67a812ffb01b07b18a4dce26719b1d294e69e9d20b1125da33bc16d28931e051047e8

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
a6c16df57052d52cb9eef81b1d0a4157

SHA1
48e460c4136b38c50c77e56b15beddf84b8675f8

SHA256
d59c7c8661344f5d2ee6e10ba9519c4e58caa1bb6751264c3e0320642fd13d4c

SHA512
41c9465f539d96be63d217905fb694591e6fe1f22d7965338a14b345428f35521db7e87676d68cbbcc43fc06c2a35a8736f1738b029e9545c860138c3b34771d

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
f214fea31f0e1c509a30db4b0e77fa0a

SHA1
95efa7dba5440439c76e0dcf1993047778bab3bf

SHA256
e811f5e15a0e4046e3615abc7829395228e42323653e2a731c13265e7e92780f

SHA512
9a9623a414479ba797db184432d6b1cf9fc2966621e467238b6b7983278984587e7461d2964f15350e889270d2dd2c2b3e11a56f935d6491e794d976da8b85b0

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
b588a9bc9798f18a73aec63470c191fc

SHA1
cfe03c3d7dce2fb7beb833087406cbcbf8f1797f

SHA256
f4d0f5a07dba24af3ca91b871115481b0e8f4d940e629da65b206890a7294002

SHA512
1230ab4f5ae86027651059fed84919932af4161aca9d8d7e5679c88f99246760d5663e64f97f86a8ecd9dd47b37ea59ad4d34511d82a45fd7a4fe7d86e9b053f

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
0f5b0266c5bfe0ff10d855ee64bdf8d6

SHA1
17a0e559a951b54e6aaeec7616aabb9014860952

SHA256
f6088cfdf72d7147e4a5b1bf35f015a204ab9223f1465968cebacc7f6ee906ec

SHA512
2d74b64e27cf46659f4168c040f5b96c8aade4caf6bc0d2d3717a9f47485b98bc57d4b2afa494c1ab907086f2c4ef7d9309ea8727d00f9610c670c47ba43ada3

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
29c850caa6e2510ad26a760838866001

SHA1
5a7b6db152d4b7241cfe6ec3c06da23acbfc8630

SHA256
c66ca71ba4194ec7566e05c8f4fbe34cea6cbd5ded06522e4ae49b962434e6ec

SHA512
7da701add5c4d61740ffbbabf41a1c055e3c52839a8c1049b80b0ef55fe28dfab2f1536a4ef0ace7358ecd90ae16afdfb775dd26d1f6a5511212bec1c82738c6

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
29c850caa6e2510ad26a760838866001

SHA1
5a7b6db152d4b7241cfe6ec3c06da23acbfc8630

SHA256
c66ca71ba4194ec7566e05c8f4fbe34cea6cbd5ded06522e4ae49b962434e6ec

SHA512
7da701add5c4d61740ffbbabf41a1c055e3c52839a8c1049b80b0ef55fe28dfab2f1536a4ef0ace7358ecd90ae16afdfb775dd26d1f6a5511212bec1c82738c6

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
a6c16df57052d52cb9eef81b1d0a4157

SHA1
48e460c4136b38c50c77e56b15beddf84b8675f8

SHA256
d59c7c8661344f5d2ee6e10ba9519c4e58caa1bb6751264c3e0320642fd13d4c

SHA512
41c9465f539d96be63d217905fb694591e6fe1f22d7965338a14b345428f35521db7e87676d68cbbcc43fc06c2a35a8736f1738b029e9545c860138c3b34771d

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
a6c16df57052d52cb9eef81b1d0a4157

SHA1
48e460c4136b38c50c77e56b15beddf84b8675f8

SHA256
d59c7c8661344f5d2ee6e10ba9519c4e58caa1bb6751264c3e0320642fd13d4c

SHA512
41c9465f539d96be63d217905fb694591e6fe1f22d7965338a14b345428f35521db7e87676d68cbbcc43fc06c2a35a8736f1738b029e9545c860138c3b34771d

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe

Filesize
85KB

MD5
a50f37646d171960decb5c28677b7815

SHA1
e95d9eebd06dd94a70fed26b6d6b8806cc96410a

SHA256
52a51c5d300504c20c3104d1e43fac3f118c172d8267c4757f79936b78712fca

SHA512
c8e515f125951e813783bfa07b0a6c39e54ad058bea0ef550da9e6006fc068b801465a4cb226c9855dc209f5fb0705182ad4f0ac12bd082e7f126a975c14b24a

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
2798439a7049d7a084e4ae757371328d

SHA1
1a5fa3e7491eeb345830a365e24921bdef6f9e6f

SHA256
aa0591f01492d9a68dc3476c2edfe6e24bbacd9f412c16b301e927740b934e31

SHA512
e73782c16272fe37f038f0641edbf512f95188cd32108e3b61eb5f5206167e92150538b095a3b51bc785998ab29c853de0b695f5658fa0d7daa9228aa6d99ddb

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
b7eafbb080baec80dab1f4f49c5f2cd2

SHA1
ffcba8ca5ad9ecdd2b6b921873d4fe61769333f0

SHA256
c66e8126cd2b528b66f3893d0b4897d129ec88c4354b74c61775ba2e7216fa5e

SHA512
c6eeb8a41c2f6479583f307e1c89ede2780442d6e57e35d39443a9ecfa2eac395d7d192b901b59f9a7f90af7511919de238b05b83618f55fc98c484f287039b2

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
a6c16df57052d52cb9eef81b1d0a4157

SHA1
48e460c4136b38c50c77e56b15beddf84b8675f8

SHA256
d59c7c8661344f5d2ee6e10ba9519c4e58caa1bb6751264c3e0320642fd13d4c

SHA512
41c9465f539d96be63d217905fb694591e6fe1f22d7965338a14b345428f35521db7e87676d68cbbcc43fc06c2a35a8736f1738b029e9545c860138c3b34771d

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
a6c16df57052d52cb9eef81b1d0a4157

SHA1
48e460c4136b38c50c77e56b15beddf84b8675f8

SHA256
d59c7c8661344f5d2ee6e10ba9519c4e58caa1bb6751264c3e0320642fd13d4c

SHA512
41c9465f539d96be63d217905fb694591e6fe1f22d7965338a14b345428f35521db7e87676d68cbbcc43fc06c2a35a8736f1738b029e9545c860138c3b34771d

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
11042eb898d367c10db7b740992a2ca3

SHA1
2e8d05cf7b81ae25517e8ee264480514fe290698

SHA256
15d535934d99b30526572625e5ba47d164c0b295b6bae8800f8d9861f034821e

SHA512
eed494482e2c9eaee83e56a00caa5b42b27ce4a0541fc75fd1becff8d8b67a812ffb01b07b18a4dce26719b1d294e69e9d20b1125da33bc16d28931e051047e8

Download Submit
C:\Windows\MSVBVM60.DLL

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
29c850caa6e2510ad26a760838866001

SHA1
5a7b6db152d4b7241cfe6ec3c06da23acbfc8630

SHA256
c66ca71ba4194ec7566e05c8f4fbe34cea6cbd5ded06522e4ae49b962434e6ec

SHA512
7da701add5c4d61740ffbbabf41a1c055e3c52839a8c1049b80b0ef55fe28dfab2f1536a4ef0ace7358ecd90ae16afdfb775dd26d1f6a5511212bec1c82738c6

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
29c850caa6e2510ad26a760838866001

SHA1
5a7b6db152d4b7241cfe6ec3c06da23acbfc8630

SHA256
c66ca71ba4194ec7566e05c8f4fbe34cea6cbd5ded06522e4ae49b962434e6ec

SHA512
7da701add5c4d61740ffbbabf41a1c055e3c52839a8c1049b80b0ef55fe28dfab2f1536a4ef0ace7358ecd90ae16afdfb775dd26d1f6a5511212bec1c82738c6

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
29c850caa6e2510ad26a760838866001

SHA1
5a7b6db152d4b7241cfe6ec3c06da23acbfc8630

SHA256
c66ca71ba4194ec7566e05c8f4fbe34cea6cbd5ded06522e4ae49b962434e6ec

SHA512
7da701add5c4d61740ffbbabf41a1c055e3c52839a8c1049b80b0ef55fe28dfab2f1536a4ef0ace7358ecd90ae16afdfb775dd26d1f6a5511212bec1c82738c6

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
29c850caa6e2510ad26a760838866001

SHA1
5a7b6db152d4b7241cfe6ec3c06da23acbfc8630

SHA256
c66ca71ba4194ec7566e05c8f4fbe34cea6cbd5ded06522e4ae49b962434e6ec

SHA512
7da701add5c4d61740ffbbabf41a1c055e3c52839a8c1049b80b0ef55fe28dfab2f1536a4ef0ace7358ecd90ae16afdfb775dd26d1f6a5511212bec1c82738c6

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
29c850caa6e2510ad26a760838866001

SHA1
5a7b6db152d4b7241cfe6ec3c06da23acbfc8630

SHA256
c66ca71ba4194ec7566e05c8f4fbe34cea6cbd5ded06522e4ae49b962434e6ec

SHA512
7da701add5c4d61740ffbbabf41a1c055e3c52839a8c1049b80b0ef55fe28dfab2f1536a4ef0ace7358ecd90ae16afdfb775dd26d1f6a5511212bec1c82738c6

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
2798439a7049d7a084e4ae757371328d

SHA1
1a5fa3e7491eeb345830a365e24921bdef6f9e6f

SHA256
aa0591f01492d9a68dc3476c2edfe6e24bbacd9f412c16b301e927740b934e31

SHA512
e73782c16272fe37f038f0641edbf512f95188cd32108e3b61eb5f5206167e92150538b095a3b51bc785998ab29c853de0b695f5658fa0d7daa9228aa6d99ddb

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
140cde11d073b719f973ab79b33efd5e

SHA1
23812487575e83c814fb5203db71a941a4bf934c

SHA256
55befadbf1dc9d46593e701eb37db9943cca3b1739f014f92c78ca8337ec8da2

SHA512
d3c341c4a1ebf07a3b4d2f535014bb6be591bdbbee05a83de09bd632fabfca82cdab974e6f6637a1fdc4f3e725e79c3217d53814d98a336063b1039061c27188

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
a50f37646d171960decb5c28677b7815

SHA1
e95d9eebd06dd94a70fed26b6d6b8806cc96410a

SHA256
52a51c5d300504c20c3104d1e43fac3f118c172d8267c4757f79936b78712fca

SHA512
c8e515f125951e813783bfa07b0a6c39e54ad058bea0ef550da9e6006fc068b801465a4cb226c9855dc209f5fb0705182ad4f0ac12bd082e7f126a975c14b24a

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
a6c16df57052d52cb9eef81b1d0a4157

SHA1
48e460c4136b38c50c77e56b15beddf84b8675f8

SHA256
d59c7c8661344f5d2ee6e10ba9519c4e58caa1bb6751264c3e0320642fd13d4c

SHA512
41c9465f539d96be63d217905fb694591e6fe1f22d7965338a14b345428f35521db7e87676d68cbbcc43fc06c2a35a8736f1738b029e9545c860138c3b34771d

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
11042eb898d367c10db7b740992a2ca3

SHA1
2e8d05cf7b81ae25517e8ee264480514fe290698

SHA256
15d535934d99b30526572625e5ba47d164c0b295b6bae8800f8d9861f034821e

SHA512
eed494482e2c9eaee83e56a00caa5b42b27ce4a0541fc75fd1becff8d8b67a812ffb01b07b18a4dce26719b1d294e69e9d20b1125da33bc16d28931e051047e8

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
8e3e799fadfc9c4211735bae01c0e9db

SHA1
e3a3964959f94178fa9ea9d7abc69de121e74ad4

SHA256
3282a407d449d23b21e2716360299bf43a8438a6dbe079c674c8f9631a1b3ecd

SHA512
228484c68ffbc2520b04d746dc0b7927975758d5737be68041b64e10686b2e1bd089cdb0e1316f80628d2636c220ba318d1651cabae68b3eb335f08c21a20ef5

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
c180ec0fa976932ef3da27d958c0fc64

SHA1
1bb30046ded92ab9b20aea7c9c2644cae3546827

SHA256
42dc8053431e9386bbe879a212cb6937ce4e42551ef45e890018bcce422ea457

SHA512
fe91eb8ea9cd84fc98d9288513d226f08e38b95ebd7e8e41c605336a5a7d38f9a81bda8bb16337e55e406fff76462cf88bba94fb2341a9cd1d8dc0cadfaaaebb

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
2798439a7049d7a084e4ae757371328d

SHA1
1a5fa3e7491eeb345830a365e24921bdef6f9e6f

SHA256
aa0591f01492d9a68dc3476c2edfe6e24bbacd9f412c16b301e927740b934e31

SHA512
e73782c16272fe37f038f0641edbf512f95188cd32108e3b61eb5f5206167e92150538b095a3b51bc785998ab29c853de0b695f5658fa0d7daa9228aa6d99ddb

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
73e3331a81586193259ebb1d1cc514a4

SHA1
bdbf91a530647d121a494ad744605ad1d4436a98

SHA256
cee650868ab7c8c47526628681b14e1d3612e4a3c72ac2242f8cba8f562c185d

SHA512
64b29dbd10d6ef2a6f1c3170c84e74019ecfa4337cf5eda9035854aec32f987390f5e8dd4d1b84ebfabaeffe4e083d51422cc3627209438088551f27049e27e7

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
a6c16df57052d52cb9eef81b1d0a4157

SHA1
48e460c4136b38c50c77e56b15beddf84b8675f8

SHA256
d59c7c8661344f5d2ee6e10ba9519c4e58caa1bb6751264c3e0320642fd13d4c

SHA512
41c9465f539d96be63d217905fb694591e6fe1f22d7965338a14b345428f35521db7e87676d68cbbcc43fc06c2a35a8736f1738b029e9545c860138c3b34771d

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
a6c16df57052d52cb9eef81b1d0a4157

SHA1
48e460c4136b38c50c77e56b15beddf84b8675f8

SHA256
d59c7c8661344f5d2ee6e10ba9519c4e58caa1bb6751264c3e0320642fd13d4c

SHA512
41c9465f539d96be63d217905fb694591e6fe1f22d7965338a14b345428f35521db7e87676d68cbbcc43fc06c2a35a8736f1738b029e9545c860138c3b34771d

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
11042eb898d367c10db7b740992a2ca3

SHA1
2e8d05cf7b81ae25517e8ee264480514fe290698

SHA256
15d535934d99b30526572625e5ba47d164c0b295b6bae8800f8d9861f034821e

SHA512
eed494482e2c9eaee83e56a00caa5b42b27ce4a0541fc75fd1becff8d8b67a812ffb01b07b18a4dce26719b1d294e69e9d20b1125da33bc16d28931e051047e8

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
2bd728b8eb62e15f5e43f41467579fa9

SHA1
11d7a64f82ca75d940aa0dd01230c4b890dca25f

SHA256
03aca3b043923ccac0604088f7d50aced66224a8ba81aecf2dab4f01d4d00e64

SHA512
f6498a65e19791cf16fe0f77a8a7208671d59a0094a912364c09ff2093d38f4e45047e2ab9d612d1868da840cbcbf38d619b2e3f64ed8837a911d88d71beef6e

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
2bd728b8eb62e15f5e43f41467579fa9

SHA1
11d7a64f82ca75d940aa0dd01230c4b890dca25f

SHA256
03aca3b043923ccac0604088f7d50aced66224a8ba81aecf2dab4f01d4d00e64

SHA512
f6498a65e19791cf16fe0f77a8a7208671d59a0094a912364c09ff2093d38f4e45047e2ab9d612d1868da840cbcbf38d619b2e3f64ed8837a911d88d71beef6e

Download Submit
C:\Windows\Tiwi.exe

Filesize
85KB

MD5
2798439a7049d7a084e4ae757371328d

SHA1
1a5fa3e7491eeb345830a365e24921bdef6f9e6f

SHA256
aa0591f01492d9a68dc3476c2edfe6e24bbacd9f412c16b301e927740b934e31

SHA512
e73782c16272fe37f038f0641edbf512f95188cd32108e3b61eb5f5206167e92150538b095a3b51bc785998ab29c853de0b695f5658fa0d7daa9228aa6d99ddb

Download Submit
C:\Windows\msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
2798439a7049d7a084e4ae757371328d

SHA1
1a5fa3e7491eeb345830a365e24921bdef6f9e6f

SHA256
aa0591f01492d9a68dc3476c2edfe6e24bbacd9f412c16b301e927740b934e31

SHA512
e73782c16272fe37f038f0641edbf512f95188cd32108e3b61eb5f5206167e92150538b095a3b51bc785998ab29c853de0b695f5658fa0d7daa9228aa6d99ddb

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
2798439a7049d7a084e4ae757371328d

SHA1
1a5fa3e7491eeb345830a365e24921bdef6f9e6f

SHA256
aa0591f01492d9a68dc3476c2edfe6e24bbacd9f412c16b301e927740b934e31

SHA512
e73782c16272fe37f038f0641edbf512f95188cd32108e3b61eb5f5206167e92150538b095a3b51bc785998ab29c853de0b695f5658fa0d7daa9228aa6d99ddb

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
2798439a7049d7a084e4ae757371328d

SHA1
1a5fa3e7491eeb345830a365e24921bdef6f9e6f

SHA256
aa0591f01492d9a68dc3476c2edfe6e24bbacd9f412c16b301e927740b934e31

SHA512
e73782c16272fe37f038f0641edbf512f95188cd32108e3b61eb5f5206167e92150538b095a3b51bc785998ab29c853de0b695f5658fa0d7daa9228aa6d99ddb

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
2798439a7049d7a084e4ae757371328d

SHA1
1a5fa3e7491eeb345830a365e24921bdef6f9e6f

SHA256
aa0591f01492d9a68dc3476c2edfe6e24bbacd9f412c16b301e927740b934e31

SHA512
e73782c16272fe37f038f0641edbf512f95188cd32108e3b61eb5f5206167e92150538b095a3b51bc785998ab29c853de0b695f5658fa0d7daa9228aa6d99ddb

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
2798439a7049d7a084e4ae757371328d

SHA1
1a5fa3e7491eeb345830a365e24921bdef6f9e6f

SHA256
aa0591f01492d9a68dc3476c2edfe6e24bbacd9f412c16b301e927740b934e31

SHA512
e73782c16272fe37f038f0641edbf512f95188cd32108e3b61eb5f5206167e92150538b095a3b51bc785998ab29c853de0b695f5658fa0d7daa9228aa6d99ddb

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
1629fac467d78ea11a3149fca8c9b08c

SHA1
9d39304fbba27bdcd18ff9d938ff72f388e5f3fb

SHA256
9c18ac567f5d30adbb1bf43f54d8461f25255a6f5f51c2a29394d834b9697098

SHA512
d4beee64675e7add9dda819f97e5dadfe64d6a732ff0641be120f55caf1bb02ec61eeacb76c6654c7ac4a074c8d69843dd8914472900e90c8c7c1833eb84a716

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
a50f37646d171960decb5c28677b7815

SHA1
e95d9eebd06dd94a70fed26b6d6b8806cc96410a

SHA256
52a51c5d300504c20c3104d1e43fac3f118c172d8267c4757f79936b78712fca

SHA512
c8e515f125951e813783bfa07b0a6c39e54ad058bea0ef550da9e6006fc068b801465a4cb226c9855dc209f5fb0705182ad4f0ac12bd082e7f126a975c14b24a

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
a6c16df57052d52cb9eef81b1d0a4157

SHA1
48e460c4136b38c50c77e56b15beddf84b8675f8

SHA256
d59c7c8661344f5d2ee6e10ba9519c4e58caa1bb6751264c3e0320642fd13d4c

SHA512
41c9465f539d96be63d217905fb694591e6fe1f22d7965338a14b345428f35521db7e87676d68cbbcc43fc06c2a35a8736f1738b029e9545c860138c3b34771d

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
11042eb898d367c10db7b740992a2ca3

SHA1
2e8d05cf7b81ae25517e8ee264480514fe290698

SHA256
15d535934d99b30526572625e5ba47d164c0b295b6bae8800f8d9861f034821e

SHA512
eed494482e2c9eaee83e56a00caa5b42b27ce4a0541fc75fd1becff8d8b67a812ffb01b07b18a4dce26719b1d294e69e9d20b1125da33bc16d28931e051047e8

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
412b4a4da7c066c1179c6ece7e28bf38

SHA1
a3a2eac85d45eb878aef063ff2a3da09a1265478

SHA256
b4f1708daad40609b8b2f3fa468535b988465b3748b87b97b0a5d80356cb5e1a

SHA512
998d644ab0645d1d92d0334b2b97c6713959e6d68d80e030f270328fe6368191f8a3b115d5720cafe9621b47dc2f86ab91e407829bc33e7018d89267dd335c5f

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
b29efeeed0aaac0b556c0d11eb9e121a

SHA1
0d9dd809d168ea5db6cdf760c2192ccd487601ca

SHA256
ec07a078305ccccff0817bdf796e3f12950e192a968c3de63df68ad326b0f81e

SHA512
3048d426f5aa46bafd927f05e6d53be5eae85dc814c151623725faeb912f83f3ce05c92775e8164f6cd12a3c900a7f223acc4039f33ec319486af188656f28df

Download Submit
memory/392-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/628-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/788-219-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/792-156-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1108-338-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1180-132-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1180-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1196-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1840-304-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1960-312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2032-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2276-303-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2392-339-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2508-238-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2584-179-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2676-231-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2676-343-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2816-229-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2816-344-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2836-199-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2968-327-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3000-164-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3000-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3196-301-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3240-325-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3452-237-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3524-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3844-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3916-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3924-226-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4080-333-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4124-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4156-273-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4304-265-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4408-294-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4536-291-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4800-155-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4824-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4824-162-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4940-340-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4940-159-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4996-292-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download