932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2

Analysis

max time kernel
151s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Size

85KB
MD5

0d9fde1582052315cff7d346d40c47e1
SHA1

c79906d6e8c25c6b22781af6a038e1d59695c790
SHA256

932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2
SHA512

2fc23420a4389efb6e79978ce14da54177e0b01d860989e370a442c399c20788cc71e32e33fd77187a01f31f50932c25ab0dcd063a20abbcce07e29f8f372214
SSDEEP

1536:NHsxFJfgaDjofVKn1pGwTJOlw1UrVxwl:NM1JDSAOwECax2

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	cute.exe

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe

Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	cute.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cute.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cute.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 30 IoCs

pid	Process
1740	Tiwi.exe
1540	IExplorer.exe
1732	winlogon.exe
464	imoet.exe
740	cute.exe
1700	Tiwi.exe
1952	Tiwi.exe
1800	Tiwi.exe
1644	Tiwi.exe
1000	Tiwi.exe
1964	IExplorer.exe
1492	IExplorer.exe
820	IExplorer.exe
1596	IExplorer.exe
1292	winlogon.exe
1520	IExplorer.exe
660	winlogon.exe
1852	winlogon.exe
968	winlogon.exe
604	winlogon.exe
1200	imoet.exe
692	imoet.exe
1532	imoet.exe
1064	imoet.exe
1164	imoet.exe
672	cute.exe
976	cute.exe
556	cute.exe
1032	cute.exe
1600	cute.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000012767-58.dat	upx
behavioral1/files/0x00070000000132f6-62.dat	upx
behavioral1/files/0x00070000000132f6-63.dat	upx
behavioral1/files/0x00070000000132f6-65.dat	upx
behavioral1/files/0x00070000000133d3-69.dat	upx
behavioral1/files/0x00070000000133d3-70.dat	upx
behavioral1/files/0x00070000000133d3-72.dat	upx
behavioral1/files/0x00070000000133e5-76.dat	upx
behavioral1/files/0x00070000000133e5-77.dat	upx
behavioral1/files/0x00070000000133e5-79.dat	upx
behavioral1/files/0x0007000000013473-83.dat	upx
behavioral1/files/0x0007000000013473-84.dat	upx
behavioral1/files/0x0007000000013473-86.dat	upx
behavioral1/memory/2012-90-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1740-91-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1540-92-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/740-95-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/464-94-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1732-93-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x00070000000132f6-103.dat	upx
behavioral1/files/0x000700000001318e-102.dat	upx
behavioral1/files/0x000700000001313e-101.dat	upx
behavioral1/files/0x0007000000012767-100.dat	upx
behavioral1/files/0x000700000001313e-104.dat	upx
behavioral1/files/0x00070000000132e5-106.dat	upx
behavioral1/files/0x000700000001318e-105.dat	upx
behavioral1/files/0x00070000000134d5-115.dat	upx
behavioral1/files/0x00070000000134d5-114.dat	upx
behavioral1/files/0x000700000001318e-117.dat	upx
behavioral1/files/0x000700000001318e-122.dat	upx
behavioral1/files/0x000700000001339d-127.dat	upx
behavioral1/files/0x000700000001313e-133.dat	upx
behavioral1/files/0x00070000000134d5-152.dat	upx
behavioral1/files/0x0007000000012767-149.dat	upx
behavioral1/files/0x0007000000012767-148.dat	upx
behavioral1/files/0x0007000000012767-147.dat	upx
behavioral1/files/0x000700000001318e-141.dat	upx
behavioral1/files/0x0007000000012767-139.dat	upx
behavioral1/files/0x000700000001339d-134.dat	upx
behavioral1/memory/1700-163-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1952-167-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x00070000000132e5-132.dat	upx
behavioral1/files/0x00070000000134d5-131.dat	upx
behavioral1/memory/1644-174-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1800-180-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1000-184-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1492-189-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1964-186-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1596-197-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1292-198-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/820-196-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1520-199-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/660-201-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1852-209-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/604-211-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/968-215-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1292-208-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/692-227-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1064-235-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1200-232-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1532-237-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1164-243-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/976-245-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/672-244-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Loads dropped DLL 45 IoCs

pid	Process
2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
1740	Tiwi.exe
1740	Tiwi.exe
1540	IExplorer.exe
464	imoet.exe
1540	IExplorer.exe
464	imoet.exe
1732	winlogon.exe
1732	winlogon.exe
1740	Tiwi.exe
1740	Tiwi.exe
740	cute.exe
740	cute.exe
1540	IExplorer.exe
1540	IExplorer.exe
464	imoet.exe
1732	winlogon.exe
464	imoet.exe
740	cute.exe
740	cute.exe
1740	Tiwi.exe
1740	Tiwi.exe
740	cute.exe
464	imoet.exe
1732	winlogon.exe
740	cute.exe
1540	IExplorer.exe
1732	winlogon.exe
1540	IExplorer.exe
740	cute.exe
1740	Tiwi.exe
1740	Tiwi.exe
1540	IExplorer.exe
1540	IExplorer.exe
464	imoet.exe
464	imoet.exe
1732	winlogon.exe
1732	winlogon.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\cute.exe"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\tiwi = "C:\\Windows\\tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\winlogon.exe"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\imoet.exe"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	imoet.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	Tiwi.exe
File opened (read-only)	\??\L:	imoet.exe
File opened (read-only)	\??\J:	IExplorer.exe
File opened (read-only)	\??\Q:	IExplorer.exe
File opened (read-only)	\??\V:	IExplorer.exe
File opened (read-only)	\??\V:	imoet.exe
File opened (read-only)	\??\N:	IExplorer.exe
File opened (read-only)	\??\Y:	IExplorer.exe
File opened (read-only)	\??\X:	cute.exe
File opened (read-only)	\??\X:	Tiwi.exe
File opened (read-only)	\??\H:	imoet.exe
File opened (read-only)	\??\R:	imoet.exe
File opened (read-only)	\??\M:	winlogon.exe
File opened (read-only)	\??\G:	cute.exe
File opened (read-only)	\??\S:	IExplorer.exe
File opened (read-only)	\??\S:	winlogon.exe
File opened (read-only)	\??\I:	Tiwi.exe
File opened (read-only)	\??\G:	imoet.exe
File opened (read-only)	\??\Z:	imoet.exe
File opened (read-only)	\??\R:	IExplorer.exe
File opened (read-only)	\??\F:	winlogon.exe
File opened (read-only)	\??\X:	winlogon.exe
File opened (read-only)	\??\Z:	cute.exe
File opened (read-only)	\??\M:	imoet.exe
File opened (read-only)	\??\O:	imoet.exe
File opened (read-only)	\??\L:	winlogon.exe
File opened (read-only)	\??\O:	winlogon.exe
File opened (read-only)	\??\Q:	Tiwi.exe
File opened (read-only)	\??\S:	imoet.exe
File opened (read-only)	\??\L:	IExplorer.exe
File opened (read-only)	\??\J:	winlogon.exe
File opened (read-only)	\??\P:	winlogon.exe
File opened (read-only)	\??\J:	Tiwi.exe
File opened (read-only)	\??\E:	imoet.exe
File opened (read-only)	\??\H:	winlogon.exe
File opened (read-only)	\??\U:	IExplorer.exe
File opened (read-only)	\??\F:	cute.exe
File opened (read-only)	\??\P:	imoet.exe
File opened (read-only)	\??\Q:	imoet.exe
File opened (read-only)	\??\T:	imoet.exe
File opened (read-only)	\??\F:	IExplorer.exe
File opened (read-only)	\??\T:	cute.exe
File opened (read-only)	\??\H:	Tiwi.exe
File opened (read-only)	\??\L:	Tiwi.exe
File opened (read-only)	\??\S:	Tiwi.exe
File opened (read-only)	\??\T:	Tiwi.exe
File opened (read-only)	\??\Q:	winlogon.exe
File opened (read-only)	\??\S:	cute.exe
File opened (read-only)	\??\V:	Tiwi.exe
File opened (read-only)	\??\X:	IExplorer.exe
File opened (read-only)	\??\B:	winlogon.exe
File opened (read-only)	\??\Y:	winlogon.exe
File opened (read-only)	\??\V:	cute.exe
File opened (read-only)	\??\B:	imoet.exe
File opened (read-only)	\??\M:	IExplorer.exe
File opened (read-only)	\??\T:	IExplorer.exe
File opened (read-only)	\??\M:	Tiwi.exe
File opened (read-only)	\??\K:	imoet.exe
File opened (read-only)	\??\Y:	imoet.exe
File opened (read-only)	\??\O:	IExplorer.exe
File opened (read-only)	\??\B:	Tiwi.exe
File opened (read-only)	\??\E:	Tiwi.exe
File opened (read-only)	\??\K:	Tiwi.exe
File opened (read-only)	\??\I:	imoet.exe

Modifies WinLogon 2 TTPs 18 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\winlogon\	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Cemlekum"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Ketika sang Putri tertidur, kunyalakan lampion tuk menghangatkan sang putri, dan ku tunggu sang putri terbangun. Entah sampai kapan dia bisa melihat ketulusan hatiku....(kaya di fs nya siafa yach??) :P "	imoet.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	cute.exe
File opened for modification	C:\autorun.inf	cute.exe
File created	C:\autorun.inf	Tiwi.exe
File opened for modification	C:\autorun.inf	Tiwi.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shell.exe	cute.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	imoet.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\tiwi.scr	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	cute.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	imoet.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	imoet.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	cute.exe
File created	C:\Windows\SysWOW64\shell.exe	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	IExplorer.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	Tiwi.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	IExplorer.exe
File opened for modification	C:\Windows\SysWOW64\tiwi.scr	Tiwi.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	cute.exe
File created	C:\Windows\tiwi.exe	cute.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	Tiwi.exe
File created	C:\Windows\tiwi.exe	winlogon.exe
File created	C:\Windows\tiwi.exe	imoet.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
File opened for modification	C:\Windows\tiwi.exe	IExplorer.exe
File opened for modification	C:\Windows\tiwi.exe	Tiwi.exe
File created	C:\Windows\msvbvm60.dll	IExplorer.exe
File opened for modification	C:\Windows\msvbvm60.dll	IExplorer.exe
File created	C:\Windows\tiwi.exe	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
File opened for modification	C:\Windows\tiwi.exe	winlogon.exe
File opened for modification	C:\Windows\tiwi.exe	imoet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 54 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Tiwi"	winlogon.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\SwapMouseButtons = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Tiwi"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Tiwi"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Tiwi"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	imoet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\SwapMouseButtons = "1"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Tiwi"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Tiwi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\SwapMouseButtons = "1"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Tiwi"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	IExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\SwapMouseButtons = "1"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	cute.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\SwapMouseButtons = "1"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Tiwi"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\SwapMouseButtons = "1"	IExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Tiwi"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\tiwi.SCR"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Tiwi"	Tiwi.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Tiwi"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Tiwi"	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Tiwi"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Mouse\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	imoet.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	imoet.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	cute.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Windows Title = "Princess Tiwi is Here.."	cute.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com"	Tiwi.exe

Modifies Internet Explorer start page 1 TTPs 6 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	Tiwi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	IExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	imoet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com"	cute.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\Default = "C:\\WINDOWS\\win\\system\\host32.exe /ShowErrorINF"	Tiwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	IExplorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	imoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	cute.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
1732	winlogon.exe
464	imoet.exe
1740	Tiwi.exe
1540	IExplorer.exe
740	cute.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
1740	Tiwi.exe
1540	IExplorer.exe
1732	winlogon.exe
464	imoet.exe
740	cute.exe
1952	Tiwi.exe
1700	Tiwi.exe
1800	Tiwi.exe
1644	Tiwi.exe
1964	IExplorer.exe
1000	Tiwi.exe
820	IExplorer.exe
1596	IExplorer.exe
1492	IExplorer.exe
1292	winlogon.exe
660	winlogon.exe
1520	IExplorer.exe
1852	winlogon.exe
968	winlogon.exe
604	winlogon.exe
1200	imoet.exe
692	imoet.exe
1064	imoet.exe
1164	imoet.exe
1532	imoet.exe
672	cute.exe
976	cute.exe
1032	cute.exe
556	cute.exe
1600	cute.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1740	2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe	28
PID 2012 wrote to memory of 1740	2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe	28
PID 2012 wrote to memory of 1740	2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe	28
PID 2012 wrote to memory of 1740	2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe	28
PID 2012 wrote to memory of 1540	2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe	29
PID 2012 wrote to memory of 1540	2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe	29
PID 2012 wrote to memory of 1540	2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe	29
PID 2012 wrote to memory of 1540	2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe	29
PID 2012 wrote to memory of 1732	2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe	30
PID 2012 wrote to memory of 1732	2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe	30
PID 2012 wrote to memory of 1732	2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe	30
PID 2012 wrote to memory of 1732	2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe	30
PID 2012 wrote to memory of 464	2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe	31
PID 2012 wrote to memory of 464	2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe	31
PID 2012 wrote to memory of 464	2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe	31
PID 2012 wrote to memory of 464	2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe	31
PID 2012 wrote to memory of 740	2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe	32
PID 2012 wrote to memory of 740	2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe	32
PID 2012 wrote to memory of 740	2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe	32
PID 2012 wrote to memory of 740	2012	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe	32
PID 1740 wrote to memory of 1700	1740	Tiwi.exe	43
PID 1740 wrote to memory of 1700	1740	Tiwi.exe	43
PID 1740 wrote to memory of 1700	1740	Tiwi.exe	43
PID 1740 wrote to memory of 1700	1740	Tiwi.exe	43
PID 1540 wrote to memory of 1800	1540	IExplorer.exe	47
PID 1540 wrote to memory of 1800	1540	IExplorer.exe	47
PID 1540 wrote to memory of 1800	1540	IExplorer.exe	47
PID 1540 wrote to memory of 1800	1540	IExplorer.exe	47
PID 464 wrote to memory of 1952	464	imoet.exe	35
PID 464 wrote to memory of 1952	464	imoet.exe	35
PID 464 wrote to memory of 1952	464	imoet.exe	35
PID 464 wrote to memory of 1952	464	imoet.exe	35
PID 1732 wrote to memory of 1644	1732	winlogon.exe	40
PID 1732 wrote to memory of 1644	1732	winlogon.exe	40
PID 1732 wrote to memory of 1644	1732	winlogon.exe	40
PID 1732 wrote to memory of 1644	1732	winlogon.exe	40
PID 740 wrote to memory of 1000	740	cute.exe	33
PID 740 wrote to memory of 1000	740	cute.exe	33
PID 740 wrote to memory of 1000	740	cute.exe	33
PID 740 wrote to memory of 1000	740	cute.exe	33
PID 1740 wrote to memory of 1964	1740	Tiwi.exe	34
PID 1740 wrote to memory of 1964	1740	Tiwi.exe	34
PID 1740 wrote to memory of 1964	1740	Tiwi.exe	34
PID 1740 wrote to memory of 1964	1740	Tiwi.exe	34
PID 1540 wrote to memory of 1492	1540	IExplorer.exe	38
PID 1540 wrote to memory of 1492	1540	IExplorer.exe	38
PID 1540 wrote to memory of 1492	1540	IExplorer.exe	38
PID 1540 wrote to memory of 1492	1540	IExplorer.exe	38
PID 464 wrote to memory of 820	464	imoet.exe	37
PID 464 wrote to memory of 820	464	imoet.exe	37
PID 464 wrote to memory of 820	464	imoet.exe	37
PID 464 wrote to memory of 820	464	imoet.exe	37
PID 1732 wrote to memory of 1596	1732	winlogon.exe	36
PID 1732 wrote to memory of 1596	1732	winlogon.exe	36
PID 1732 wrote to memory of 1596	1732	winlogon.exe	36
PID 1732 wrote to memory of 1596	1732	winlogon.exe	36
PID 1740 wrote to memory of 1292	1740	Tiwi.exe	39
PID 1740 wrote to memory of 1292	1740	Tiwi.exe	39
PID 1740 wrote to memory of 1292	1740	Tiwi.exe	39
PID 1740 wrote to memory of 1292	1740	Tiwi.exe	39
PID 740 wrote to memory of 1520	740	cute.exe	42
PID 740 wrote to memory of 1520	740	cute.exe	42
PID 740 wrote to memory of 1520	740	cute.exe	42
PID 740 wrote to memory of 1520	740	cute.exe	42

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Tiwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	IExplorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	IExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	winlogon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	imoet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	cute.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	Tiwi.exe

C:\Users\Admin\AppData\Local\Temp\932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe
"C:\Users\Admin\AppData\Local\Temp\932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2012
- C:\Windows\Tiwi.exe
  C:\Windows\Tiwi.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1740
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1964
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1292
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1700
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:976
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1200
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1540
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1492
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:660
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1800
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1064
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:556
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1732
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1596
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1644
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:968
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1532
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1600
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:464
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1952
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:820
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1852
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1164
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1032
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Disables RegEdit via registry modification
  - Disables cmd.exe use via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:740
- - C:\Windows\Tiwi.exe
    C:\Windows\Tiwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1000
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1520
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:604
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:692
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
1fd3f44e5de2edebd14bb0c6f43a0b14

SHA1
593f94f9f0ef41dc093fb9d2451df8a5d14ecfd6

SHA256
581cfda58377c91888b68a009d41493ac3eed10af94f2302ce56ad3146612387

SHA512
993a86d3bd7f2114c7df25c6ec6d4e8d0c4a60b055d45462ffe6dd172897a323f16f3a71e0d3e26d6991c23b569f94b0c042e969bc80127c20cb1e2a9ca3b56a

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
b8be2541d62bf0881901effe67b72ee1

SHA1
15e3f78333468fb604595fd3432f461305f3310d

SHA256
3ddfdc90cd4aeefc3ecf7f4722d70d93c221ee5ba86fe4ab52592c1881de80e9

SHA512
c17622ab79769862b45d00930a424268a4ebb897f0147276475f035c69287772c6d550660cd70fa3e591bc2a4a8efd183acbc604c6db804d46e31e1f57aef97d

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
1397767852d2180e013f635e1d44c4bc

SHA1
9b7a341aa013505a76a3648db9db64664206e780

SHA256
a9ea04c373055960f6fd484fee7ab948cd4ac5af9d13f4afbbcb6ec44bcfdf97

SHA512
af78c358b26730bd0ae1481c825e15c0301e8e14483e636db1e1b317e7910dd8c2b96c1c4593a447500f99611fc84586aee9456cc73b21035a93bfdb4330cb64

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\cute.exe

Filesize
85KB

MD5
1fd3f44e5de2edebd14bb0c6f43a0b14

SHA1
593f94f9f0ef41dc093fb9d2451df8a5d14ecfd6

SHA256
581cfda58377c91888b68a009d41493ac3eed10af94f2302ce56ad3146612387

SHA512
993a86d3bd7f2114c7df25c6ec6d4e8d0c4a60b055d45462ffe6dd172897a323f16f3a71e0d3e26d6991c23b569f94b0c042e969bc80127c20cb1e2a9ca3b56a

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\imoet.exe

Filesize
85KB

MD5
b8be2541d62bf0881901effe67b72ee1

SHA1
15e3f78333468fb604595fd3432f461305f3310d

SHA256
3ddfdc90cd4aeefc3ecf7f4722d70d93c221ee5ba86fe4ab52592c1881de80e9

SHA512
c17622ab79769862b45d00930a424268a4ebb897f0147276475f035c69287772c6d550660cd70fa3e591bc2a4a8efd183acbc604c6db804d46e31e1f57aef97d

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
c7730e16429f3e5bfef7982be27af3e3

SHA1
a3ce274c4808c06aa4a6b376ed83a648eeccb4ee

SHA256
88006273c8e8b65d4869ac23ed582684f20d182073b3576a779be41bcdc4d2fc

SHA512
834dd08d0590e4d20d343c4f90e9c4d21ab71c8e86ac7ad2bab2e774d7f99a8db9f5acf780b386b05cec70330282971061a1cc83db7b57c8cda3b51fc743b982

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
c7730e16429f3e5bfef7982be27af3e3

SHA1
a3ce274c4808c06aa4a6b376ed83a648eeccb4ee

SHA256
88006273c8e8b65d4869ac23ed582684f20d182073b3576a779be41bcdc4d2fc

SHA512
834dd08d0590e4d20d343c4f90e9c4d21ab71c8e86ac7ad2bab2e774d7f99a8db9f5acf780b386b05cec70330282971061a1cc83db7b57c8cda3b51fc743b982

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
c7730e16429f3e5bfef7982be27af3e3

SHA1
a3ce274c4808c06aa4a6b376ed83a648eeccb4ee

SHA256
88006273c8e8b65d4869ac23ed582684f20d182073b3576a779be41bcdc4d2fc

SHA512
834dd08d0590e4d20d343c4f90e9c4d21ab71c8e86ac7ad2bab2e774d7f99a8db9f5acf780b386b05cec70330282971061a1cc83db7b57c8cda3b51fc743b982

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\lsass.exe

Filesize
45KB

MD5
dda61e0c71875882f7b47a635a8242a4

SHA1
b4d72a3a497cb9c08a005274e3e07bf3724f4b84

SHA256
573844e2eb2c6e903c33cbfd7415e131c9d5e2157d29b4296b44de5a2d5a5ce3

SHA512
47176f63a062fbccc1ca3efcae97d59d294da6a2072e8070eee0a69816e129d32f089d433988dd3665aa8a22289091175582c80efaab0c298049cd858dcd90f2

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
1397767852d2180e013f635e1d44c4bc

SHA1
9b7a341aa013505a76a3648db9db64664206e780

SHA256
a9ea04c373055960f6fd484fee7ab948cd4ac5af9d13f4afbbcb6ec44bcfdf97

SHA512
af78c358b26730bd0ae1481c825e15c0301e8e14483e636db1e1b317e7910dd8c2b96c1c4593a447500f99611fc84586aee9456cc73b21035a93bfdb4330cb64

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
1397767852d2180e013f635e1d44c4bc

SHA1
9b7a341aa013505a76a3648db9db64664206e780

SHA256
a9ea04c373055960f6fd484fee7ab948cd4ac5af9d13f4afbbcb6ec44bcfdf97

SHA512
af78c358b26730bd0ae1481c825e15c0301e8e14483e636db1e1b317e7910dd8c2b96c1c4593a447500f99611fc84586aee9456cc73b21035a93bfdb4330cb64

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
1397767852d2180e013f635e1d44c4bc

SHA1
9b7a341aa013505a76a3648db9db64664206e780

SHA256
a9ea04c373055960f6fd484fee7ab948cd4ac5af9d13f4afbbcb6ec44bcfdf97

SHA512
af78c358b26730bd0ae1481c825e15c0301e8e14483e636db1e1b317e7910dd8c2b96c1c4593a447500f99611fc84586aee9456cc73b21035a93bfdb4330cb64

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
1fd3f44e5de2edebd14bb0c6f43a0b14

SHA1
593f94f9f0ef41dc093fb9d2451df8a5d14ecfd6

SHA256
581cfda58377c91888b68a009d41493ac3eed10af94f2302ce56ad3146612387

SHA512
993a86d3bd7f2114c7df25c6ec6d4e8d0c4a60b055d45462ffe6dd172897a323f16f3a71e0d3e26d6991c23b569f94b0c042e969bc80127c20cb1e2a9ca3b56a

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\smss.exe

Filesize
85KB

MD5
0d9fde1582052315cff7d346d40c47e1

SHA1
c79906d6e8c25c6b22781af6a038e1d59695c790

SHA256
932d2daed83de552a3fa0aeb838b214ab9fd8f7e94ff72bbd4f98b5c3aa3c2d2

SHA512
2fc23420a4389efb6e79978ce14da54177e0b01d860989e370a442c399c20788cc71e32e33fd77187a01f31f50932c25ab0dcd063a20abbcce07e29f8f372214

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\winlogon.exe

Filesize
85KB

MD5
1397767852d2180e013f635e1d44c4bc

SHA1
9b7a341aa013505a76a3648db9db64664206e780

SHA256
a9ea04c373055960f6fd484fee7ab948cd4ac5af9d13f4afbbcb6ec44bcfdf97

SHA512
af78c358b26730bd0ae1481c825e15c0301e8e14483e636db1e1b317e7910dd8c2b96c1c4593a447500f99611fc84586aee9456cc73b21035a93bfdb4330cb64

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
1397767852d2180e013f635e1d44c4bc

SHA1
9b7a341aa013505a76a3648db9db64664206e780

SHA256
a9ea04c373055960f6fd484fee7ab948cd4ac5af9d13f4afbbcb6ec44bcfdf97

SHA512
af78c358b26730bd0ae1481c825e15c0301e8e14483e636db1e1b317e7910dd8c2b96c1c4593a447500f99611fc84586aee9456cc73b21035a93bfdb4330cb64

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
1397767852d2180e013f635e1d44c4bc

SHA1
9b7a341aa013505a76a3648db9db64664206e780

SHA256
a9ea04c373055960f6fd484fee7ab948cd4ac5af9d13f4afbbcb6ec44bcfdf97

SHA512
af78c358b26730bd0ae1481c825e15c0301e8e14483e636db1e1b317e7910dd8c2b96c1c4593a447500f99611fc84586aee9456cc73b21035a93bfdb4330cb64

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
1397767852d2180e013f635e1d44c4bc

SHA1
9b7a341aa013505a76a3648db9db64664206e780

SHA256
a9ea04c373055960f6fd484fee7ab948cd4ac5af9d13f4afbbcb6ec44bcfdf97

SHA512
af78c358b26730bd0ae1481c825e15c0301e8e14483e636db1e1b317e7910dd8c2b96c1c4593a447500f99611fc84586aee9456cc73b21035a93bfdb4330cb64

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
456196358ffc985e46757aa5ff192ed5

SHA1
62f1aecef7cf84e7c9049a039d0fba7e61e5bac1

SHA256
3e5dea9ae3e5c81b0bab303a64db1223cad01f1463b0cefcc7b9c5da2bd7bc17

SHA512
bc978447b787be6b1a6ddd04411127bda2af47035c67ad5a18607f397881352a496e2988d03a66b399c24159852811a239e0afb2cdc4e0c1cd2f30e2f95ea791

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
456196358ffc985e46757aa5ff192ed5

SHA1
62f1aecef7cf84e7c9049a039d0fba7e61e5bac1

SHA256
3e5dea9ae3e5c81b0bab303a64db1223cad01f1463b0cefcc7b9c5da2bd7bc17

SHA512
bc978447b787be6b1a6ddd04411127bda2af47035c67ad5a18607f397881352a496e2988d03a66b399c24159852811a239e0afb2cdc4e0c1cd2f30e2f95ea791

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
456196358ffc985e46757aa5ff192ed5

SHA1
62f1aecef7cf84e7c9049a039d0fba7e61e5bac1

SHA256
3e5dea9ae3e5c81b0bab303a64db1223cad01f1463b0cefcc7b9c5da2bd7bc17

SHA512
bc978447b787be6b1a6ddd04411127bda2af47035c67ad5a18607f397881352a496e2988d03a66b399c24159852811a239e0afb2cdc4e0c1cd2f30e2f95ea791

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
85KB

MD5
456196358ffc985e46757aa5ff192ed5

SHA1
62f1aecef7cf84e7c9049a039d0fba7e61e5bac1

SHA256
3e5dea9ae3e5c81b0bab303a64db1223cad01f1463b0cefcc7b9c5da2bd7bc17

SHA512
bc978447b787be6b1a6ddd04411127bda2af47035c67ad5a18607f397881352a496e2988d03a66b399c24159852811a239e0afb2cdc4e0c1cd2f30e2f95ea791

Download Submit
C:\Windows\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
7f457648844cb5b8ab600d910d837afe

SHA1
ee1f92386b0607ebc4b16b36b00935293cb9c09c

SHA256
fcaa69aed21d24e8f56b174ec6e13b31320c6dcc567970bd0a302029ee9f9f60

SHA512
d2b8e7df28a0d831db4d999f81a96e29e7687265ab3407e573662fb74b9b48a954fc0a68f6cb65a6f37773858661787c98592ec117685f9eaadaf453131cf811

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
7f457648844cb5b8ab600d910d837afe

SHA1
ee1f92386b0607ebc4b16b36b00935293cb9c09c

SHA256
fcaa69aed21d24e8f56b174ec6e13b31320c6dcc567970bd0a302029ee9f9f60

SHA512
d2b8e7df28a0d831db4d999f81a96e29e7687265ab3407e573662fb74b9b48a954fc0a68f6cb65a6f37773858661787c98592ec117685f9eaadaf453131cf811

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
7f457648844cb5b8ab600d910d837afe

SHA1
ee1f92386b0607ebc4b16b36b00935293cb9c09c

SHA256
fcaa69aed21d24e8f56b174ec6e13b31320c6dcc567970bd0a302029ee9f9f60

SHA512
d2b8e7df28a0d831db4d999f81a96e29e7687265ab3407e573662fb74b9b48a954fc0a68f6cb65a6f37773858661787c98592ec117685f9eaadaf453131cf811

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
7f457648844cb5b8ab600d910d837afe

SHA1
ee1f92386b0607ebc4b16b36b00935293cb9c09c

SHA256
fcaa69aed21d24e8f56b174ec6e13b31320c6dcc567970bd0a302029ee9f9f60

SHA512
d2b8e7df28a0d831db4d999f81a96e29e7687265ab3407e573662fb74b9b48a954fc0a68f6cb65a6f37773858661787c98592ec117685f9eaadaf453131cf811

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
1397767852d2180e013f635e1d44c4bc

SHA1
9b7a341aa013505a76a3648db9db64664206e780

SHA256
a9ea04c373055960f6fd484fee7ab948cd4ac5af9d13f4afbbcb6ec44bcfdf97

SHA512
af78c358b26730bd0ae1481c825e15c0301e8e14483e636db1e1b317e7910dd8c2b96c1c4593a447500f99611fc84586aee9456cc73b21035a93bfdb4330cb64

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
177540a0edde591a7fe5fe7091409c47

SHA1
10b634169b07e00499557d19417075667d15b1a5

SHA256
065ffc24833e6481504790a47f84af0770f1aca9ab51adf46e9ad77809b90ce3

SHA512
71061e15bf4e4f196f16b741f50562c29629492c6d1650ef868559978f00fbbece6026a551fe353336ab11710a9b2417121b61cbb2c88e6d3a4c9ff77159a5d1

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
177540a0edde591a7fe5fe7091409c47

SHA1
10b634169b07e00499557d19417075667d15b1a5

SHA256
065ffc24833e6481504790a47f84af0770f1aca9ab51adf46e9ad77809b90ce3

SHA512
71061e15bf4e4f196f16b741f50562c29629492c6d1650ef868559978f00fbbece6026a551fe353336ab11710a9b2417121b61cbb2c88e6d3a4c9ff77159a5d1

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
177540a0edde591a7fe5fe7091409c47

SHA1
10b634169b07e00499557d19417075667d15b1a5

SHA256
065ffc24833e6481504790a47f84af0770f1aca9ab51adf46e9ad77809b90ce3

SHA512
71061e15bf4e4f196f16b741f50562c29629492c6d1650ef868559978f00fbbece6026a551fe353336ab11710a9b2417121b61cbb2c88e6d3a4c9ff77159a5d1

Download Submit
C:\Windows\SysWOW64\shell.exe

Filesize
85KB

MD5
38c79162360616e56b027aab522b16de

SHA1
ca1d866a99dd299c14add7751aa94de6b5b92ca4

SHA256
22d1cc3cb3e9ed05e36838d7a6293efc700fd1f341ed6604f4735a24e3faf127

SHA512
136cbe5ebcf66f6421b0aa63f42a75e1fc72207205fb1fffdce42c1510e2155629eeb81c473763b856b6cd9ea7b717127aea3bab540e0d88fe45dade4bb5129b

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
1397767852d2180e013f635e1d44c4bc

SHA1
9b7a341aa013505a76a3648db9db64664206e780

SHA256
a9ea04c373055960f6fd484fee7ab948cd4ac5af9d13f4afbbcb6ec44bcfdf97

SHA512
af78c358b26730bd0ae1481c825e15c0301e8e14483e636db1e1b317e7910dd8c2b96c1c4593a447500f99611fc84586aee9456cc73b21035a93bfdb4330cb64

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
1397767852d2180e013f635e1d44c4bc

SHA1
9b7a341aa013505a76a3648db9db64664206e780

SHA256
a9ea04c373055960f6fd484fee7ab948cd4ac5af9d13f4afbbcb6ec44bcfdf97

SHA512
af78c358b26730bd0ae1481c825e15c0301e8e14483e636db1e1b317e7910dd8c2b96c1c4593a447500f99611fc84586aee9456cc73b21035a93bfdb4330cb64

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
1397767852d2180e013f635e1d44c4bc

SHA1
9b7a341aa013505a76a3648db9db64664206e780

SHA256
a9ea04c373055960f6fd484fee7ab948cd4ac5af9d13f4afbbcb6ec44bcfdf97

SHA512
af78c358b26730bd0ae1481c825e15c0301e8e14483e636db1e1b317e7910dd8c2b96c1c4593a447500f99611fc84586aee9456cc73b21035a93bfdb4330cb64

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
0a2391154f36ec5ba7b08e0ccaae5222

SHA1
f7eeef220a79bcb7b91d86a16121f36e7bf0282a

SHA256
215662ae03c55039ebda1e3ed030a829bc4e6cb10f90346d31f3b6fb644f5133

SHA512
0ac0bdc6a75a924f3fed18ed8fc496d6bc2e976ebf0de5ad767b2a0e5ffea406a2ee54ba96c7f2b97afda0411537007fe51e3cee3c8529f2e89ac28e118298a9

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
0a2391154f36ec5ba7b08e0ccaae5222

SHA1
f7eeef220a79bcb7b91d86a16121f36e7bf0282a

SHA256
215662ae03c55039ebda1e3ed030a829bc4e6cb10f90346d31f3b6fb644f5133

SHA512
0ac0bdc6a75a924f3fed18ed8fc496d6bc2e976ebf0de5ad767b2a0e5ffea406a2ee54ba96c7f2b97afda0411537007fe51e3cee3c8529f2e89ac28e118298a9

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
0a2391154f36ec5ba7b08e0ccaae5222

SHA1
f7eeef220a79bcb7b91d86a16121f36e7bf0282a

SHA256
215662ae03c55039ebda1e3ed030a829bc4e6cb10f90346d31f3b6fb644f5133

SHA512
0ac0bdc6a75a924f3fed18ed8fc496d6bc2e976ebf0de5ad767b2a0e5ffea406a2ee54ba96c7f2b97afda0411537007fe51e3cee3c8529f2e89ac28e118298a9

Download Submit
C:\Windows\SysWOW64\tiwi.scr

Filesize
85KB

MD5
0a2391154f36ec5ba7b08e0ccaae5222

SHA1
f7eeef220a79bcb7b91d86a16121f36e7bf0282a

SHA256
215662ae03c55039ebda1e3ed030a829bc4e6cb10f90346d31f3b6fb644f5133

SHA512
0ac0bdc6a75a924f3fed18ed8fc496d6bc2e976ebf0de5ad767b2a0e5ffea406a2ee54ba96c7f2b97afda0411537007fe51e3cee3c8529f2e89ac28e118298a9

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
42191d526f8a6156401e1dbd151ec96a

SHA1
25fc61587e40cdb9fd0839b9de81387988f1fba5

SHA256
d3ad0cc43e495f07fe738fd53b9eac375eb38ff0dcb4047f7ac7713b7cf066cd

SHA512
42fb650c05c7e1f16587d8dfc3fd527eac6815d7adf85c7f3cedc39fa395738ad8fb3bf71f5f16a2f3c52fd6bb476d1583d8e4a2c54374a83d9f846b419cd75e

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
42191d526f8a6156401e1dbd151ec96a

SHA1
25fc61587e40cdb9fd0839b9de81387988f1fba5

SHA256
d3ad0cc43e495f07fe738fd53b9eac375eb38ff0dcb4047f7ac7713b7cf066cd

SHA512
42fb650c05c7e1f16587d8dfc3fd527eac6815d7adf85c7f3cedc39fa395738ad8fb3bf71f5f16a2f3c52fd6bb476d1583d8e4a2c54374a83d9f846b419cd75e

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
42191d526f8a6156401e1dbd151ec96a

SHA1
25fc61587e40cdb9fd0839b9de81387988f1fba5

SHA256
d3ad0cc43e495f07fe738fd53b9eac375eb38ff0dcb4047f7ac7713b7cf066cd

SHA512
42fb650c05c7e1f16587d8dfc3fd527eac6815d7adf85c7f3cedc39fa395738ad8fb3bf71f5f16a2f3c52fd6bb476d1583d8e4a2c54374a83d9f846b419cd75e

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
42191d526f8a6156401e1dbd151ec96a

SHA1
25fc61587e40cdb9fd0839b9de81387988f1fba5

SHA256
d3ad0cc43e495f07fe738fd53b9eac375eb38ff0dcb4047f7ac7713b7cf066cd

SHA512
42fb650c05c7e1f16587d8dfc3fd527eac6815d7adf85c7f3cedc39fa395738ad8fb3bf71f5f16a2f3c52fd6bb476d1583d8e4a2c54374a83d9f846b419cd75e

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
42191d526f8a6156401e1dbd151ec96a

SHA1
25fc61587e40cdb9fd0839b9de81387988f1fba5

SHA256
d3ad0cc43e495f07fe738fd53b9eac375eb38ff0dcb4047f7ac7713b7cf066cd

SHA512
42fb650c05c7e1f16587d8dfc3fd527eac6815d7adf85c7f3cedc39fa395738ad8fb3bf71f5f16a2f3c52fd6bb476d1583d8e4a2c54374a83d9f846b419cd75e

Download Submit
C:\Windows\tiwi.exe

Filesize
85KB

MD5
42191d526f8a6156401e1dbd151ec96a

SHA1
25fc61587e40cdb9fd0839b9de81387988f1fba5

SHA256
d3ad0cc43e495f07fe738fd53b9eac375eb38ff0dcb4047f7ac7713b7cf066cd

SHA512
42fb650c05c7e1f16587d8dfc3fd527eac6815d7adf85c7f3cedc39fa395738ad8fb3bf71f5f16a2f3c52fd6bb476d1583d8e4a2c54374a83d9f846b419cd75e

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\present.txt

Filesize
729B

MD5
8e3c734e8dd87d639fb51500d42694b5

SHA1
f76371d31eed9663e9a4fd7cb95f54dcfc51f87f

SHA256
574a3a546332854d82e4f5b54cc5e8731fe9828e14e89a728be7e53ed21f6bad

SHA512
06ef1ddd1dd2b30d7db261e9ac78601111eeb1315d2c46f42ec71d14611376a951af3e9c6178bb7235f0d61c022d4715aeb528f775a3cf7da249ab0b2e706853

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
7f457648844cb5b8ab600d910d837afe

SHA1
ee1f92386b0607ebc4b16b36b00935293cb9c09c

SHA256
fcaa69aed21d24e8f56b174ec6e13b31320c6dcc567970bd0a302029ee9f9f60

SHA512
d2b8e7df28a0d831db4d999f81a96e29e7687265ab3407e573662fb74b9b48a954fc0a68f6cb65a6f37773858661787c98592ec117685f9eaadaf453131cf811

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
7f457648844cb5b8ab600d910d837afe

SHA1
ee1f92386b0607ebc4b16b36b00935293cb9c09c

SHA256
fcaa69aed21d24e8f56b174ec6e13b31320c6dcc567970bd0a302029ee9f9f60

SHA512
d2b8e7df28a0d831db4d999f81a96e29e7687265ab3407e573662fb74b9b48a954fc0a68f6cb65a6f37773858661787c98592ec117685f9eaadaf453131cf811

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
1397767852d2180e013f635e1d44c4bc

SHA1
9b7a341aa013505a76a3648db9db64664206e780

SHA256
a9ea04c373055960f6fd484fee7ab948cd4ac5af9d13f4afbbcb6ec44bcfdf97

SHA512
af78c358b26730bd0ae1481c825e15c0301e8e14483e636db1e1b317e7910dd8c2b96c1c4593a447500f99611fc84586aee9456cc73b21035a93bfdb4330cb64

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
9da482c931f4acbd850bfa634efc4cc5

SHA1
46873df668b8184a6a58b2c3caa6b37216f18f1f

SHA256
41b60ea364742d2b2dcafaccceaa35fe5f2ae815f80fedd2ce2eec1b3a5edf1b

SHA512
866bb44ebaf3e4813df0f8a641e9f1c19ff5d662bef303446d372d07dc7c37acd5eb14094867230eac8a0caac9d7fdfffd31780a4c83b7796a46dc8cf39c916f

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
9da482c931f4acbd850bfa634efc4cc5

SHA1
46873df668b8184a6a58b2c3caa6b37216f18f1f

SHA256
41b60ea364742d2b2dcafaccceaa35fe5f2ae815f80fedd2ce2eec1b3a5edf1b

SHA512
866bb44ebaf3e4813df0f8a641e9f1c19ff5d662bef303446d372d07dc7c37acd5eb14094867230eac8a0caac9d7fdfffd31780a4c83b7796a46dc8cf39c916f

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
9da482c931f4acbd850bfa634efc4cc5

SHA1
46873df668b8184a6a58b2c3caa6b37216f18f1f

SHA256
41b60ea364742d2b2dcafaccceaa35fe5f2ae815f80fedd2ce2eec1b3a5edf1b

SHA512
866bb44ebaf3e4813df0f8a641e9f1c19ff5d662bef303446d372d07dc7c37acd5eb14094867230eac8a0caac9d7fdfffd31780a4c83b7796a46dc8cf39c916f

Download Submit
C:\tiwi.exe

Filesize
85KB

MD5
9da482c931f4acbd850bfa634efc4cc5

SHA1
46873df668b8184a6a58b2c3caa6b37216f18f1f

SHA256
41b60ea364742d2b2dcafaccceaa35fe5f2ae815f80fedd2ce2eec1b3a5edf1b

SHA512
866bb44ebaf3e4813df0f8a641e9f1c19ff5d662bef303446d372d07dc7c37acd5eb14094867230eac8a0caac9d7fdfffd31780a4c83b7796a46dc8cf39c916f

Download Submit
\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
1fd3f44e5de2edebd14bb0c6f43a0b14

SHA1
593f94f9f0ef41dc093fb9d2451df8a5d14ecfd6

SHA256
581cfda58377c91888b68a009d41493ac3eed10af94f2302ce56ad3146612387

SHA512
993a86d3bd7f2114c7df25c6ec6d4e8d0c4a60b055d45462ffe6dd172897a323f16f3a71e0d3e26d6991c23b569f94b0c042e969bc80127c20cb1e2a9ca3b56a

Download Submit
\Users\Admin\AppData\Local\WINDOWS\cute.exe

Filesize
85KB

MD5
1fd3f44e5de2edebd14bb0c6f43a0b14

SHA1
593f94f9f0ef41dc093fb9d2451df8a5d14ecfd6

SHA256
581cfda58377c91888b68a009d41493ac3eed10af94f2302ce56ad3146612387

SHA512
993a86d3bd7f2114c7df25c6ec6d4e8d0c4a60b055d45462ffe6dd172897a323f16f3a71e0d3e26d6991c23b569f94b0c042e969bc80127c20cb1e2a9ca3b56a

Download Submit
\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
b8be2541d62bf0881901effe67b72ee1

SHA1
15e3f78333468fb604595fd3432f461305f3310d

SHA256
3ddfdc90cd4aeefc3ecf7f4722d70d93c221ee5ba86fe4ab52592c1881de80e9

SHA512
c17622ab79769862b45d00930a424268a4ebb897f0147276475f035c69287772c6d550660cd70fa3e591bc2a4a8efd183acbc604c6db804d46e31e1f57aef97d

Download Submit
\Users\Admin\AppData\Local\WINDOWS\imoet.exe

Filesize
85KB

MD5
b8be2541d62bf0881901effe67b72ee1

SHA1
15e3f78333468fb604595fd3432f461305f3310d

SHA256
3ddfdc90cd4aeefc3ecf7f4722d70d93c221ee5ba86fe4ab52592c1881de80e9

SHA512
c17622ab79769862b45d00930a424268a4ebb897f0147276475f035c69287772c6d550660cd70fa3e591bc2a4a8efd183acbc604c6db804d46e31e1f57aef97d

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
1397767852d2180e013f635e1d44c4bc

SHA1
9b7a341aa013505a76a3648db9db64664206e780

SHA256
a9ea04c373055960f6fd484fee7ab948cd4ac5af9d13f4afbbcb6ec44bcfdf97

SHA512
af78c358b26730bd0ae1481c825e15c0301e8e14483e636db1e1b317e7910dd8c2b96c1c4593a447500f99611fc84586aee9456cc73b21035a93bfdb4330cb64

Download Submit
\Users\Admin\AppData\Local\WINDOWS\winlogon.exe

Filesize
85KB

MD5
1397767852d2180e013f635e1d44c4bc

SHA1
9b7a341aa013505a76a3648db9db64664206e780

SHA256
a9ea04c373055960f6fd484fee7ab948cd4ac5af9d13f4afbbcb6ec44bcfdf97

SHA512
af78c358b26730bd0ae1481c825e15c0301e8e14483e636db1e1b317e7910dd8c2b96c1c4593a447500f99611fc84586aee9456cc73b21035a93bfdb4330cb64

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
7f457648844cb5b8ab600d910d837afe

SHA1
ee1f92386b0607ebc4b16b36b00935293cb9c09c

SHA256
fcaa69aed21d24e8f56b174ec6e13b31320c6dcc567970bd0a302029ee9f9f60

SHA512
d2b8e7df28a0d831db4d999f81a96e29e7687265ab3407e573662fb74b9b48a954fc0a68f6cb65a6f37773858661787c98592ec117685f9eaadaf453131cf811

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
85KB

MD5
7f457648844cb5b8ab600d910d837afe

SHA1
ee1f92386b0607ebc4b16b36b00935293cb9c09c

SHA256
fcaa69aed21d24e8f56b174ec6e13b31320c6dcc567970bd0a302029ee9f9f60

SHA512
d2b8e7df28a0d831db4d999f81a96e29e7687265ab3407e573662fb74b9b48a954fc0a68f6cb65a6f37773858661787c98592ec117685f9eaadaf453131cf811

Download Submit
memory/464-191-0x0000000002D30000-0x0000000002D63000-memory.dmp

Filesize
204KB

Download
memory/464-94-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/464-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/464-260-0x0000000002D30000-0x0000000002D63000-memory.dmp

Filesize
204KB

Download
memory/464-251-0x0000000002D30000-0x0000000002D63000-memory.dmp

Filesize
204KB

Download
memory/464-262-0x0000000002D30000-0x0000000002D63000-memory.dmp

Filesize
204KB

Download
memory/556-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/604-211-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/660-201-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/672-244-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/692-227-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/740-258-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/740-95-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/820-196-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/968-215-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/976-245-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1000-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1032-247-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1064-235-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1164-243-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1200-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1292-198-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1292-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1492-189-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1520-199-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1532-237-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1540-252-0x0000000002D90000-0x0000000002DC3000-memory.dmp

Filesize
204KB

Download
memory/1540-261-0x0000000002D90000-0x0000000002DC3000-memory.dmp

Filesize
204KB

Download
memory/1540-92-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1540-255-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1540-190-0x0000000002D90000-0x0000000002DC3000-memory.dmp

Filesize
204KB

Download
memory/1540-259-0x0000000002D90000-0x0000000002DC3000-memory.dmp

Filesize
204KB

Download
memory/1596-197-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1600-250-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1644-174-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1700-163-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-93-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-193-0x00000000024D0000-0x0000000002503000-memory.dmp

Filesize
204KB

Download
memory/1732-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1740-253-0x0000000001D60000-0x0000000001D93000-memory.dmp

Filesize
204KB

Download
memory/1740-91-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1740-254-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1800-180-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1852-209-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1952-167-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1964-186-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2012-90-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2012-56-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download