3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949

Analysis

max time kernel
152s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Size

52KB
MD5

69050390b1f20dc5031564ae9e6ec5e0
SHA1

2ff6c8f0028b49f1ff3de08f1950e4aa076a8fef
SHA256

3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949
SHA512

b60e1f9aa9bd1f1b43299e0297054f9d992d27114419f82b021c184cad9b0e1f0164208126e30a86a109e7d4eae0d2c7bd061c6a0aa8d7d09194c6f005cbef77
SSDEEP

768:d+ciLamXW9XgMxjFkpvMVX8q18q13yO1+33j5n/wfkfw:IzaEW5gMxZVXf8a3yO10pw/

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 10 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe

Modifies system executable filetype association 2 TTPs 62 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	SERVICES.EXE

Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SERVICES.EXE

Modifies visiblity of hidden/system files in Explorer 2 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SERVICES.EXE

Windows security bypass 2 TTPs 25 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe

Blocks application from running via registry modification 30 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE

Disables RegEdit via registry modification 10 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 20 IoCs

pid	Process
612	nEwb0Rn.exe
1424	WishfulThinking.exe
1392	WINLOGON.EXE
772	SERVICES.EXE
1840	nEwb0Rn.exe
2000	nEwb0Rn.exe
992	nEwb0Rn.exe
744	WishfulThinking.exe
1976	WishfulThinking.exe
1016	nEwb0Rn.exe
1672	WishfulThinking.exe
1692	WishfulThinking.exe
112	WINLOGON.EXE
1760	WINLOGON.EXE
1316	SERVICES.EXE
896	SERVICES.EXE
368	WINLOGON.EXE
1844	WINLOGON.EXE
1756	SERVICES.EXE
768	SERVICES.EXE

Sets file execution options in registry 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	SERVICES.EXE

Loads dropped DLL 28 IoCs

pid	Process
1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
612	nEwb0Rn.exe
612	nEwb0Rn.exe
1424	WishfulThinking.exe
1424	WishfulThinking.exe
772	SERVICES.EXE
612	nEwb0Rn.exe
612	nEwb0Rn.exe
772	SERVICES.EXE
1392	WINLOGON.EXE
1392	WINLOGON.EXE
1424	WishfulThinking.exe
1424	WishfulThinking.exe
612	nEwb0Rn.exe
612	nEwb0Rn.exe
1424	WishfulThinking.exe
1424	WishfulThinking.exe
1392	WINLOGON.EXE
772	SERVICES.EXE
772	SERVICES.EXE
1392	WINLOGON.EXE
1392	WINLOGON.EXE
772	SERVICES.EXE

Windows security modification 2 TTPs 30 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	SERVICES.EXE

Adds Run key to start application 2 TTPs 25 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	SERVICES.EXE

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\desktop.ini	WishfulThinking.exe
File created	C:\desktop.ini	WishfulThinking.exe
File opened for modification	C:\desktop.ini	nEwb0Rn.exe
File created	C:\desktop.ini	nEwb0Rn.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SERVICES.EXE
File opened (read-only)	\??\Y:	SERVICES.EXE
File opened (read-only)	\??\R:	WishfulThinking.exe
File opened (read-only)	\??\V:	WishfulThinking.exe
File opened (read-only)	\??\E:	nEwb0Rn.exe
File opened (read-only)	\??\N:	WINLOGON.EXE
File opened (read-only)	\??\K:	WINLOGON.EXE
File opened (read-only)	\??\Y:	WINLOGON.EXE
File opened (read-only)	\??\H:	SERVICES.EXE
File opened (read-only)	\??\P:	SERVICES.EXE
File opened (read-only)	\??\B:	nEwb0Rn.exe
File opened (read-only)	\??\G:	nEwb0Rn.exe
File opened (read-only)	\??\L:	nEwb0Rn.exe
File opened (read-only)	\??\E:	WINLOGON.EXE
File opened (read-only)	\??\Z:	SERVICES.EXE
File opened (read-only)	\??\Y:	nEwb0Rn.exe
File opened (read-only)	\??\N:	SERVICES.EXE
File opened (read-only)	\??\J:	WishfulThinking.exe
File opened (read-only)	\??\N:	WishfulThinking.exe
File opened (read-only)	\??\F:	nEwb0Rn.exe
File opened (read-only)	\??\I:	nEwb0Rn.exe
File opened (read-only)	\??\R:	SERVICES.EXE
File opened (read-only)	\??\P:	WishfulThinking.exe
File opened (read-only)	\??\O:	WINLOGON.EXE
File opened (read-only)	\??\R:	WINLOGON.EXE
File opened (read-only)	\??\X:	WINLOGON.EXE
File opened (read-only)	\??\W:	WishfulThinking.exe
File opened (read-only)	\??\K:	nEwb0Rn.exe
File opened (read-only)	\??\Z:	nEwb0Rn.exe
File opened (read-only)	\??\U:	SERVICES.EXE
File opened (read-only)	\??\T:	WishfulThinking.exe
File opened (read-only)	\??\P:	nEwb0Rn.exe
File opened (read-only)	\??\S:	WINLOGON.EXE
File opened (read-only)	\??\Q:	SERVICES.EXE
File opened (read-only)	\??\G:	SERVICES.EXE
File opened (read-only)	\??\W:	SERVICES.EXE
File opened (read-only)	\??\G:	WishfulThinking.exe
File opened (read-only)	\??\O:	nEwb0Rn.exe
File opened (read-only)	\??\W:	nEwb0Rn.exe
File opened (read-only)	\??\U:	WINLOGON.EXE
File opened (read-only)	\??\H:	WINLOGON.EXE
File opened (read-only)	\??\J:	WINLOGON.EXE
File opened (read-only)	\??\Q:	WishfulThinking.exe
File opened (read-only)	\??\S:	WishfulThinking.exe
File opened (read-only)	\??\X:	WishfulThinking.exe
File opened (read-only)	\??\U:	nEwb0Rn.exe
File opened (read-only)	\??\L:	WINLOGON.EXE
File opened (read-only)	\??\S:	SERVICES.EXE
File opened (read-only)	\??\E:	WishfulThinking.exe
File opened (read-only)	\??\K:	WishfulThinking.exe
File opened (read-only)	\??\N:	nEwb0Rn.exe
File opened (read-only)	\??\Q:	nEwb0Rn.exe
File opened (read-only)	\??\V:	SERVICES.EXE
File opened (read-only)	\??\U:	WishfulThinking.exe
File opened (read-only)	\??\Z:	WishfulThinking.exe
File opened (read-only)	\??\H:	nEwb0Rn.exe
File opened (read-only)	\??\T:	SERVICES.EXE
File opened (read-only)	\??\X:	SERVICES.EXE
File opened (read-only)	\??\P:	WINLOGON.EXE
File opened (read-only)	\??\V:	WINLOGON.EXE
File opened (read-only)	\??\L:	SERVICES.EXE
File opened (read-only)	\??\O:	SERVICES.EXE
File opened (read-only)	\??\M:	SERVICES.EXE
File opened (read-only)	\??\B:	WishfulThinking.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	WINLOGON.EXE
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	WINLOGON.EXE
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	SERVICES.EXE
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\JawsOfLife.exe	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	WINLOGON.EXE
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	SERVICES.EXE
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	SERVICES.EXE
File created	C:\Windows\SysWOW64\WishfulThinking.exe	WINLOGON.EXE
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	nEwb0Rn.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	WishfulThinking.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	SERVICES.EXE
File created	C:\Windows\SysWOW64\DamageControl.scr	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	WishfulThinking.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	SERVICES.EXE
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\nEwb0Rn.exe	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
File created	C:\Windows\nEwb0Rn.exe	WINLOGON.EXE
File created	C:\Windows\nEwb0Rn.exe	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	nEwb0Rn.exe
File created	C:\Windows\nEwb0Rn.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	WINLOGON.EXE
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
File created	C:\Windows\nEwb0Rn.exe	SERVICES.EXE
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 45 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Animate"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\AutoEndTasks = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\AutoEndTasks = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Animate"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Inanimate"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Inanimate"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Animate"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Animate"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Inanimate"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\AutoEndTasks = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\AutoEndTasks = "1"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Inanimate"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s2359 = "Animate"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\AutoEndTasks = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\s1159 = "Inanimate"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	WishfulThinking.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\	nEwb0Rn.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	WINLOGON.EXE
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	SERVICES.EXE
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WishfulThinking.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	SERVICES.EXE
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WINLOGON.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
612	nEwb0Rn.exe
1392	WINLOGON.EXE
1424	WishfulThinking.exe
772	SERVICES.EXE

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
612	nEwb0Rn.exe
1424	WishfulThinking.exe
1392	WINLOGON.EXE
772	SERVICES.EXE
2000	nEwb0Rn.exe
1840	nEwb0Rn.exe
1976	WishfulThinking.exe
992	nEwb0Rn.exe
744	WishfulThinking.exe
1016	nEwb0Rn.exe
112	WINLOGON.EXE
1760	WINLOGON.EXE
1672	WishfulThinking.exe
1316	SERVICES.EXE
896	SERVICES.EXE
368	WINLOGON.EXE
1844	WINLOGON.EXE
1756	SERVICES.EXE
768	SERVICES.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 612	1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe	27
PID 1996 wrote to memory of 612	1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe	27
PID 1996 wrote to memory of 612	1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe	27
PID 1996 wrote to memory of 612	1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe	27
PID 1996 wrote to memory of 1424	1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe	28
PID 1996 wrote to memory of 1424	1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe	28
PID 1996 wrote to memory of 1424	1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe	28
PID 1996 wrote to memory of 1424	1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe	28
PID 1996 wrote to memory of 1392	1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe	29
PID 1996 wrote to memory of 1392	1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe	29
PID 1996 wrote to memory of 1392	1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe	29
PID 1996 wrote to memory of 1392	1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe	29
PID 1996 wrote to memory of 772	1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe	30
PID 1996 wrote to memory of 772	1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe	30
PID 1996 wrote to memory of 772	1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe	30
PID 1996 wrote to memory of 772	1996	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe	30
PID 1424 wrote to memory of 1840	1424	WishfulThinking.exe	31
PID 1424 wrote to memory of 1840	1424	WishfulThinking.exe	31
PID 1424 wrote to memory of 1840	1424	WishfulThinking.exe	31
PID 1424 wrote to memory of 1840	1424	WishfulThinking.exe	31
PID 612 wrote to memory of 2000	612	nEwb0Rn.exe	32
PID 612 wrote to memory of 2000	612	nEwb0Rn.exe	32
PID 612 wrote to memory of 2000	612	nEwb0Rn.exe	32
PID 612 wrote to memory of 2000	612	nEwb0Rn.exe	32
PID 772 wrote to memory of 992	772	SERVICES.EXE	33
PID 772 wrote to memory of 992	772	SERVICES.EXE	33
PID 772 wrote to memory of 992	772	SERVICES.EXE	33
PID 772 wrote to memory of 992	772	SERVICES.EXE	33
PID 612 wrote to memory of 744	612	nEwb0Rn.exe	34
PID 612 wrote to memory of 744	612	nEwb0Rn.exe	34
PID 612 wrote to memory of 744	612	nEwb0Rn.exe	34
PID 612 wrote to memory of 744	612	nEwb0Rn.exe	34
PID 1424 wrote to memory of 1976	1424	WishfulThinking.exe	35
PID 1424 wrote to memory of 1976	1424	WishfulThinking.exe	35
PID 1424 wrote to memory of 1976	1424	WishfulThinking.exe	35
PID 1424 wrote to memory of 1976	1424	WishfulThinking.exe	35
PID 1392 wrote to memory of 1016	1392	WINLOGON.EXE	36
PID 1392 wrote to memory of 1016	1392	WINLOGON.EXE	36
PID 1392 wrote to memory of 1016	1392	WINLOGON.EXE	36
PID 1392 wrote to memory of 1016	1392	WINLOGON.EXE	36
PID 612 wrote to memory of 112	612	nEwb0Rn.exe	38
PID 612 wrote to memory of 112	612	nEwb0Rn.exe	38
PID 612 wrote to memory of 112	612	nEwb0Rn.exe	38
PID 612 wrote to memory of 112	612	nEwb0Rn.exe	38
PID 772 wrote to memory of 1672	772	SERVICES.EXE	37
PID 772 wrote to memory of 1672	772	SERVICES.EXE	37
PID 772 wrote to memory of 1672	772	SERVICES.EXE	37
PID 772 wrote to memory of 1672	772	SERVICES.EXE	37
PID 1392 wrote to memory of 1692	1392	WINLOGON.EXE	39
PID 1392 wrote to memory of 1692	1392	WINLOGON.EXE	39
PID 1392 wrote to memory of 1692	1392	WINLOGON.EXE	39
PID 1392 wrote to memory of 1692	1392	WINLOGON.EXE	39
PID 1424 wrote to memory of 1760	1424	WishfulThinking.exe	40
PID 1424 wrote to memory of 1760	1424	WishfulThinking.exe	40
PID 1424 wrote to memory of 1760	1424	WishfulThinking.exe	40
PID 1424 wrote to memory of 1760	1424	WishfulThinking.exe	40
PID 612 wrote to memory of 1316	612	nEwb0Rn.exe	41
PID 612 wrote to memory of 1316	612	nEwb0Rn.exe	41
PID 612 wrote to memory of 1316	612	nEwb0Rn.exe	41
PID 612 wrote to memory of 1316	612	nEwb0Rn.exe	41
PID 1424 wrote to memory of 896	1424	WishfulThinking.exe	42
PID 1424 wrote to memory of 896	1424	WishfulThinking.exe	42
PID 1424 wrote to memory of 896	1424	WishfulThinking.exe	42
PID 1424 wrote to memory of 896	1424	WishfulThinking.exe	42

System policy modification 1 TTPs 35 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	SERVICES.EXE

C:\Users\Admin\AppData\Local\Temp\3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe
"C:\Users\Admin\AppData\Local\Temp\3f65a7a370dedd93960e350b4b7b110676d79826ad3487899e77ee96f20d6949.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1996
- C:\Windows\nEwb0Rn.exe
  C:\Windows\nEwb0Rn.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Sets file execution options in registry
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:612
- - C:\Windows\nEwb0Rn.exe
    C:\Windows\nEwb0Rn.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2000
- - C:\Windows\SysWOW64\WishfulThinking.exe
    C:\Windows\system32\WishfulThinking.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:744
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:112
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1316
- C:\Windows\SysWOW64\WishfulThinking.exe
  C:\Windows\system32\WishfulThinking.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Sets file execution options in registry
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1424
- - C:\Windows\nEwb0Rn.exe
    C:\Windows\nEwb0Rn.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1840
- - C:\Windows\SysWOW64\WishfulThinking.exe
    C:\Windows\system32\WishfulThinking.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1976
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1760
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:896
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Sets file execution options in registry
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1392
- - C:\Windows\nEwb0Rn.exe
    C:\Windows\nEwb0Rn.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1016
- - C:\Windows\SysWOW64\WishfulThinking.exe
    C:\Windows\system32\WishfulThinking.exe
    3⤵
    - Executes dropped EXE
    PID:1692
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:368
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1756
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Sets file execution options in registry
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:772
- - C:\Windows\nEwb0Rn.exe
    C:\Windows\nEwb0Rn.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:992
- - C:\Windows\SysWOW64\WishfulThinking.exe
    C:\Windows\system32\WishfulThinking.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1672
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1844
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
abe0919b7691dbb91dfac8b24b09563d

SHA1
c5cc721410821bf3595d0a7141ba5a4caac132ee

SHA256
0d38ca22545b19fded261c2039dcc4a7de664b1fe38339669ad718f6435af400

SHA512
52b28a4e0e2c12d43134300ec3d8e6f681d9642cd68f78f17e9a1f2ec5d0f22dfad1876d731423481d5ca3d0d1b5b4b19428dc2453266283a56835903a4d2a66

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
f8ccde13f549448b8d728217d9ac7d8a

SHA1
8022073eeb4d3414a18440c84338a72093de06f8

SHA256
1bb63e22660437bd2da684d5d0fd650c82b1e6ed9c49bec8d4a80d380f7cdc12

SHA512
a6d851e85d524b41584e19ef942258e124815c80ed1f15b3fe9c1b8b8da16f34d099a30c8a6e92090680d8286dda3d47ba73b0c317d95d95a2c815f6403979e0

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

Filesize
52KB

MD5
59491621f636bc492a5fc3421bdbbb53

SHA1
17a062b5ffd2d20144b383dfa032658514ffff30

SHA256
2cc0af3353e99ae11bfe84bdbfadca24e735e13c171438c9efcc2faee94fface

SHA512
97ed233c00ebb44a3cec19df7e130e71498131e028fe1f329e9ab9ce3c6565214fbb12aa5445512ed70e212073741562b8c82d75ed23effb2e65fc9d0a2aec2b

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

Filesize
52KB

MD5
59491621f636bc492a5fc3421bdbbb53

SHA1
17a062b5ffd2d20144b383dfa032658514ffff30

SHA256
2cc0af3353e99ae11bfe84bdbfadca24e735e13c171438c9efcc2faee94fface

SHA512
97ed233c00ebb44a3cec19df7e130e71498131e028fe1f329e9ab9ce3c6565214fbb12aa5445512ed70e212073741562b8c82d75ed23effb2e65fc9d0a2aec2b

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

Filesize
52KB

MD5
abe0919b7691dbb91dfac8b24b09563d

SHA1
c5cc721410821bf3595d0a7141ba5a4caac132ee

SHA256
0d38ca22545b19fded261c2039dcc4a7de664b1fe38339669ad718f6435af400

SHA512
52b28a4e0e2c12d43134300ec3d8e6f681d9642cd68f78f17e9a1f2ec5d0f22dfad1876d731423481d5ca3d0d1b5b4b19428dc2453266283a56835903a4d2a66

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

Filesize
52KB

MD5
f8ccde13f549448b8d728217d9ac7d8a

SHA1
8022073eeb4d3414a18440c84338a72093de06f8

SHA256
1bb63e22660437bd2da684d5d0fd650c82b1e6ed9c49bec8d4a80d380f7cdc12

SHA512
a6d851e85d524b41584e19ef942258e124815c80ed1f15b3fe9c1b8b8da16f34d099a30c8a6e92090680d8286dda3d47ba73b0c317d95d95a2c815f6403979e0

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

Filesize
52KB

MD5
59491621f636bc492a5fc3421bdbbb53

SHA1
17a062b5ffd2d20144b383dfa032658514ffff30

SHA256
2cc0af3353e99ae11bfe84bdbfadca24e735e13c171438c9efcc2faee94fface

SHA512
97ed233c00ebb44a3cec19df7e130e71498131e028fe1f329e9ab9ce3c6565214fbb12aa5445512ed70e212073741562b8c82d75ed23effb2e65fc9d0a2aec2b

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

Filesize
52KB

MD5
59491621f636bc492a5fc3421bdbbb53

SHA1
17a062b5ffd2d20144b383dfa032658514ffff30

SHA256
2cc0af3353e99ae11bfe84bdbfadca24e735e13c171438c9efcc2faee94fface

SHA512
97ed233c00ebb44a3cec19df7e130e71498131e028fe1f329e9ab9ce3c6565214fbb12aa5445512ed70e212073741562b8c82d75ed23effb2e65fc9d0a2aec2b

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

Filesize
52KB

MD5
abe0919b7691dbb91dfac8b24b09563d

SHA1
c5cc721410821bf3595d0a7141ba5a4caac132ee

SHA256
0d38ca22545b19fded261c2039dcc4a7de664b1fe38339669ad718f6435af400

SHA512
52b28a4e0e2c12d43134300ec3d8e6f681d9642cd68f78f17e9a1f2ec5d0f22dfad1876d731423481d5ca3d0d1b5b4b19428dc2453266283a56835903a4d2a66

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

Filesize
52KB

MD5
f8ccde13f549448b8d728217d9ac7d8a

SHA1
8022073eeb4d3414a18440c84338a72093de06f8

SHA256
1bb63e22660437bd2da684d5d0fd650c82b1e6ed9c49bec8d4a80d380f7cdc12

SHA512
a6d851e85d524b41584e19ef942258e124815c80ed1f15b3fe9c1b8b8da16f34d099a30c8a6e92090680d8286dda3d47ba73b0c317d95d95a2c815f6403979e0

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
abe0919b7691dbb91dfac8b24b09563d

SHA1
c5cc721410821bf3595d0a7141ba5a4caac132ee

SHA256
0d38ca22545b19fded261c2039dcc4a7de664b1fe38339669ad718f6435af400

SHA512
52b28a4e0e2c12d43134300ec3d8e6f681d9642cd68f78f17e9a1f2ec5d0f22dfad1876d731423481d5ca3d0d1b5b4b19428dc2453266283a56835903a4d2a66

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

Filesize
52KB

MD5
59491621f636bc492a5fc3421bdbbb53

SHA1
17a062b5ffd2d20144b383dfa032658514ffff30

SHA256
2cc0af3353e99ae11bfe84bdbfadca24e735e13c171438c9efcc2faee94fface

SHA512
97ed233c00ebb44a3cec19df7e130e71498131e028fe1f329e9ab9ce3c6565214fbb12aa5445512ed70e212073741562b8c82d75ed23effb2e65fc9d0a2aec2b

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

Filesize
52KB

MD5
59491621f636bc492a5fc3421bdbbb53

SHA1
17a062b5ffd2d20144b383dfa032658514ffff30

SHA256
2cc0af3353e99ae11bfe84bdbfadca24e735e13c171438c9efcc2faee94fface

SHA512
97ed233c00ebb44a3cec19df7e130e71498131e028fe1f329e9ab9ce3c6565214fbb12aa5445512ed70e212073741562b8c82d75ed23effb2e65fc9d0a2aec2b

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

Filesize
52KB

MD5
abe0919b7691dbb91dfac8b24b09563d

SHA1
c5cc721410821bf3595d0a7141ba5a4caac132ee

SHA256
0d38ca22545b19fded261c2039dcc4a7de664b1fe38339669ad718f6435af400

SHA512
52b28a4e0e2c12d43134300ec3d8e6f681d9642cd68f78f17e9a1f2ec5d0f22dfad1876d731423481d5ca3d0d1b5b4b19428dc2453266283a56835903a4d2a66

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

Filesize
52KB

MD5
f8ccde13f549448b8d728217d9ac7d8a

SHA1
8022073eeb4d3414a18440c84338a72093de06f8

SHA256
1bb63e22660437bd2da684d5d0fd650c82b1e6ed9c49bec8d4a80d380f7cdc12

SHA512
a6d851e85d524b41584e19ef942258e124815c80ed1f15b3fe9c1b8b8da16f34d099a30c8a6e92090680d8286dda3d47ba73b0c317d95d95a2c815f6403979e0

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
f8ccde13f549448b8d728217d9ac7d8a

SHA1
8022073eeb4d3414a18440c84338a72093de06f8

SHA256
1bb63e22660437bd2da684d5d0fd650c82b1e6ed9c49bec8d4a80d380f7cdc12

SHA512
a6d851e85d524b41584e19ef942258e124815c80ed1f15b3fe9c1b8b8da16f34d099a30c8a6e92090680d8286dda3d47ba73b0c317d95d95a2c815f6403979e0

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
ab5741f96403d266b1d75c2bb14627e2

SHA1
e88b219330264a2718b30e086b678628d22ea760

SHA256
34f748dabe840a3bcc4824787a8f804baae7207bd934146847f12b949407b084

SHA512
5b3dd518e401d230491502a9e96e4f1774f2fbd18a15eda7a6aca685431eafc114249a190032f3e6ca3d0a91800d7d173e961e60f3fd5b6a044e54252960aedb

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
ab5741f96403d266b1d75c2bb14627e2

SHA1
e88b219330264a2718b30e086b678628d22ea760

SHA256
34f748dabe840a3bcc4824787a8f804baae7207bd934146847f12b949407b084

SHA512
5b3dd518e401d230491502a9e96e4f1774f2fbd18a15eda7a6aca685431eafc114249a190032f3e6ca3d0a91800d7d173e961e60f3fd5b6a044e54252960aedb

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
ab5741f96403d266b1d75c2bb14627e2

SHA1
e88b219330264a2718b30e086b678628d22ea760

SHA256
34f748dabe840a3bcc4824787a8f804baae7207bd934146847f12b949407b084

SHA512
5b3dd518e401d230491502a9e96e4f1774f2fbd18a15eda7a6aca685431eafc114249a190032f3e6ca3d0a91800d7d173e961e60f3fd5b6a044e54252960aedb

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
abc9d9ae5105b35cd0540a88f1036aa2

SHA1
5b2010212a81a08bad95385ba80a4dea5394ae25

SHA256
25a08841e7ade0542a8cbf3338f9cbaf774d6a6c1b9530d3917e902daa09e2b4

SHA512
c6f401d951b193c5452c230b35ca859e8a48a4c109efd083400672603c9ebf1629d38590d47c3db5aa085f9f5e4f65642cde9a67be41eb39a702f832a6c0c3ba

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
59491621f636bc492a5fc3421bdbbb53

SHA1
17a062b5ffd2d20144b383dfa032658514ffff30

SHA256
2cc0af3353e99ae11bfe84bdbfadca24e735e13c171438c9efcc2faee94fface

SHA512
97ed233c00ebb44a3cec19df7e130e71498131e028fe1f329e9ab9ce3c6565214fbb12aa5445512ed70e212073741562b8c82d75ed23effb2e65fc9d0a2aec2b

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
59491621f636bc492a5fc3421bdbbb53

SHA1
17a062b5ffd2d20144b383dfa032658514ffff30

SHA256
2cc0af3353e99ae11bfe84bdbfadca24e735e13c171438c9efcc2faee94fface

SHA512
97ed233c00ebb44a3cec19df7e130e71498131e028fe1f329e9ab9ce3c6565214fbb12aa5445512ed70e212073741562b8c82d75ed23effb2e65fc9d0a2aec2b

Download Submit
C:\Windows\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
8eaee74e2638558db654ce9d253d92b1

SHA1
72d38825145c81fa406c3258ab3966f95d60502a

SHA256
f986e33af3a103a5650b9329097de44ee08cd27910ca5aaae50d2bc58afa728a

SHA512
8de4971ff87d4e3eecf5aecad98e2c934a3983b92da6f0017d81081c8fe37dcb8401c521762fe27c6833617c33eb3a7762dd5548af00c315571f6d1ae04e0898

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
8eaee74e2638558db654ce9d253d92b1

SHA1
72d38825145c81fa406c3258ab3966f95d60502a

SHA256
f986e33af3a103a5650b9329097de44ee08cd27910ca5aaae50d2bc58afa728a

SHA512
8de4971ff87d4e3eecf5aecad98e2c934a3983b92da6f0017d81081c8fe37dcb8401c521762fe27c6833617c33eb3a7762dd5548af00c315571f6d1ae04e0898

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
8eaee74e2638558db654ce9d253d92b1

SHA1
72d38825145c81fa406c3258ab3966f95d60502a

SHA256
f986e33af3a103a5650b9329097de44ee08cd27910ca5aaae50d2bc58afa728a

SHA512
8de4971ff87d4e3eecf5aecad98e2c934a3983b92da6f0017d81081c8fe37dcb8401c521762fe27c6833617c33eb3a7762dd5548af00c315571f6d1ae04e0898

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
1e6180f06de9f87c25b48b06dcbb6517

SHA1
441b3f075aad57827bb21142c67270cbc7ee0573

SHA256
e9e798d26de4bace6065e30f73ab72344b8b4ce383b07ac730bd53bfb93074f1

SHA512
30fe660a625e52551d9a3ae7c1af607c8c94cc219a43b5f09ed96326f7006be8d8e77d065a20c6e214cb765ffdc04aa0b71f3a5ea753fd56777226cd1177453b

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
59491621f636bc492a5fc3421bdbbb53

SHA1
17a062b5ffd2d20144b383dfa032658514ffff30

SHA256
2cc0af3353e99ae11bfe84bdbfadca24e735e13c171438c9efcc2faee94fface

SHA512
97ed233c00ebb44a3cec19df7e130e71498131e028fe1f329e9ab9ce3c6565214fbb12aa5445512ed70e212073741562b8c82d75ed23effb2e65fc9d0a2aec2b

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
59491621f636bc492a5fc3421bdbbb53

SHA1
17a062b5ffd2d20144b383dfa032658514ffff30

SHA256
2cc0af3353e99ae11bfe84bdbfadca24e735e13c171438c9efcc2faee94fface

SHA512
97ed233c00ebb44a3cec19df7e130e71498131e028fe1f329e9ab9ce3c6565214fbb12aa5445512ed70e212073741562b8c82d75ed23effb2e65fc9d0a2aec2b

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
e8e5353bdc52f31f4fa821834ad1f271

SHA1
912ae5b8dac7ba7e8eda1522e991084f77ed5fa6

SHA256
7077852a6699ddcbaf1f0c4a27c46940c7e1f0f2ee718c369974407fdb3da760

SHA512
42298dda4e318d31bd67ad9f78e543a265d1447cfd782679ae578a15c9227b63b9c48c2a2253f36e7bcac9d3f37c13b4f06ada02945cdf5bff591c6f7f03265d

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
e8e5353bdc52f31f4fa821834ad1f271

SHA1
912ae5b8dac7ba7e8eda1522e991084f77ed5fa6

SHA256
7077852a6699ddcbaf1f0c4a27c46940c7e1f0f2ee718c369974407fdb3da760

SHA512
42298dda4e318d31bd67ad9f78e543a265d1447cfd782679ae578a15c9227b63b9c48c2a2253f36e7bcac9d3f37c13b4f06ada02945cdf5bff591c6f7f03265d

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
957efc1b68272ab550662b1bdde71d7e

SHA1
fc716376e038cfbc3a5554c4c523a49f878f824f

SHA256
9d97a0056c5799f7a33715f8fa8ab83558be69b3c13f013a73e9e8a6009a5f41

SHA512
1e9cdd8a9e1e9f0dff63be6efc0677e24f347dc15aee4928109f28de02b1aece688697ed687847b5b4480217ef523c46974d9cb252211341185cb0ac6ddfb90a

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
c0fc11cdf34b2c662cdbe8d789481a08

SHA1
da0044173862da68d77f1e79d6ea18e0cf87877f

SHA256
3365592150c4377b9152929fd11f8dc73b2dd4381236782c5efc71a7ab4ecc31

SHA512
1cbf94a29f526b7c111e1ab0df01016436315ebe12113e4c6d3920d240a5e84e82b28adb2f7ba93b77a42520a99970b522476f2694670044173d3578c20dd8db

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
59491621f636bc492a5fc3421bdbbb53

SHA1
17a062b5ffd2d20144b383dfa032658514ffff30

SHA256
2cc0af3353e99ae11bfe84bdbfadca24e735e13c171438c9efcc2faee94fface

SHA512
97ed233c00ebb44a3cec19df7e130e71498131e028fe1f329e9ab9ce3c6565214fbb12aa5445512ed70e212073741562b8c82d75ed23effb2e65fc9d0a2aec2b

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
59491621f636bc492a5fc3421bdbbb53

SHA1
17a062b5ffd2d20144b383dfa032658514ffff30

SHA256
2cc0af3353e99ae11bfe84bdbfadca24e735e13c171438c9efcc2faee94fface

SHA512
97ed233c00ebb44a3cec19df7e130e71498131e028fe1f329e9ab9ce3c6565214fbb12aa5445512ed70e212073741562b8c82d75ed23effb2e65fc9d0a2aec2b

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
385847d5e4d84b71193a67dd6bee0281

SHA1
6aecb084924bd88cb0632e63f12fb8e3d84657d9

SHA256
a8a81a7c7621390da1b1ed4d55d2305947c25bc321c14d909c4ae12b2aff25be

SHA512
bc01fdf6b9eeeb7b444971fdfcb42b45d281ad3b65847e7cb1980743276314ed84d4c75ba957ef8da54d4fa861e4fcb5f52b2599b6e7b4f3f2cb5eba5e827ce4

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
385847d5e4d84b71193a67dd6bee0281

SHA1
6aecb084924bd88cb0632e63f12fb8e3d84657d9

SHA256
a8a81a7c7621390da1b1ed4d55d2305947c25bc321c14d909c4ae12b2aff25be

SHA512
bc01fdf6b9eeeb7b444971fdfcb42b45d281ad3b65847e7cb1980743276314ed84d4c75ba957ef8da54d4fa861e4fcb5f52b2599b6e7b4f3f2cb5eba5e827ce4

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
385847d5e4d84b71193a67dd6bee0281

SHA1
6aecb084924bd88cb0632e63f12fb8e3d84657d9

SHA256
a8a81a7c7621390da1b1ed4d55d2305947c25bc321c14d909c4ae12b2aff25be

SHA512
bc01fdf6b9eeeb7b444971fdfcb42b45d281ad3b65847e7cb1980743276314ed84d4c75ba957ef8da54d4fa861e4fcb5f52b2599b6e7b4f3f2cb5eba5e827ce4

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
385847d5e4d84b71193a67dd6bee0281

SHA1
6aecb084924bd88cb0632e63f12fb8e3d84657d9

SHA256
a8a81a7c7621390da1b1ed4d55d2305947c25bc321c14d909c4ae12b2aff25be

SHA512
bc01fdf6b9eeeb7b444971fdfcb42b45d281ad3b65847e7cb1980743276314ed84d4c75ba957ef8da54d4fa861e4fcb5f52b2599b6e7b4f3f2cb5eba5e827ce4

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
59491621f636bc492a5fc3421bdbbb53

SHA1
17a062b5ffd2d20144b383dfa032658514ffff30

SHA256
2cc0af3353e99ae11bfe84bdbfadca24e735e13c171438c9efcc2faee94fface

SHA512
97ed233c00ebb44a3cec19df7e130e71498131e028fe1f329e9ab9ce3c6565214fbb12aa5445512ed70e212073741562b8c82d75ed23effb2e65fc9d0a2aec2b

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
59491621f636bc492a5fc3421bdbbb53

SHA1
17a062b5ffd2d20144b383dfa032658514ffff30

SHA256
2cc0af3353e99ae11bfe84bdbfadca24e735e13c171438c9efcc2faee94fface

SHA512
97ed233c00ebb44a3cec19df7e130e71498131e028fe1f329e9ab9ce3c6565214fbb12aa5445512ed70e212073741562b8c82d75ed23effb2e65fc9d0a2aec2b

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
59491621f636bc492a5fc3421bdbbb53

SHA1
17a062b5ffd2d20144b383dfa032658514ffff30

SHA256
2cc0af3353e99ae11bfe84bdbfadca24e735e13c171438c9efcc2faee94fface

SHA512
97ed233c00ebb44a3cec19df7e130e71498131e028fe1f329e9ab9ce3c6565214fbb12aa5445512ed70e212073741562b8c82d75ed23effb2e65fc9d0a2aec2b

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
59491621f636bc492a5fc3421bdbbb53

SHA1
17a062b5ffd2d20144b383dfa032658514ffff30

SHA256
2cc0af3353e99ae11bfe84bdbfadca24e735e13c171438c9efcc2faee94fface

SHA512
97ed233c00ebb44a3cec19df7e130e71498131e028fe1f329e9ab9ce3c6565214fbb12aa5445512ed70e212073741562b8c82d75ed23effb2e65fc9d0a2aec2b

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
59491621f636bc492a5fc3421bdbbb53

SHA1
17a062b5ffd2d20144b383dfa032658514ffff30

SHA256
2cc0af3353e99ae11bfe84bdbfadca24e735e13c171438c9efcc2faee94fface

SHA512
97ed233c00ebb44a3cec19df7e130e71498131e028fe1f329e9ab9ce3c6565214fbb12aa5445512ed70e212073741562b8c82d75ed23effb2e65fc9d0a2aec2b

Download Submit
C:\about.htm

Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\about.htm

Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\about.htm

Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\about.htm

Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
3fe4cea5a5f2392586fcfdece2fa2a77

SHA1
f4950e9dd944d7e8fa00868fd9e2691ecd99722f

SHA256
bb759433310bed4f3c721518ed533c6b3c05806cb50ec308d986be0444c89381

SHA512
c6ce3f6a68867d85ad902c11555ccb7113541c4f58b32171cf710b2e075aa48553772972710a7676ce16c8bbf1618e5b7bfbf867559e10d9ccadcd716931a1ba

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
3fe4cea5a5f2392586fcfdece2fa2a77

SHA1
f4950e9dd944d7e8fa00868fd9e2691ecd99722f

SHA256
bb759433310bed4f3c721518ed533c6b3c05806cb50ec308d986be0444c89381

SHA512
c6ce3f6a68867d85ad902c11555ccb7113541c4f58b32171cf710b2e075aa48553772972710a7676ce16c8bbf1618e5b7bfbf867559e10d9ccadcd716931a1ba

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
3fe4cea5a5f2392586fcfdece2fa2a77

SHA1
f4950e9dd944d7e8fa00868fd9e2691ecd99722f

SHA256
bb759433310bed4f3c721518ed533c6b3c05806cb50ec308d986be0444c89381

SHA512
c6ce3f6a68867d85ad902c11555ccb7113541c4f58b32171cf710b2e075aa48553772972710a7676ce16c8bbf1618e5b7bfbf867559e10d9ccadcd716931a1ba

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
7ac76ae66641fc158add6a6e69afb701

SHA1
89593885080853e435190027f19da70b543828d1

SHA256
f0ae698bcc4f6f625ebb18ae392eb68cfe551ee93777241dee558eddd61db1ca

SHA512
a4273ee73f1d7df5580489a03e3e7a45a9c46af7a6e71d66d4c906c012dd88369137f42c6108f80ee4d17b6716b02a7cdaa5bd3303e15d5c81bed98897e29c07

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
59491621f636bc492a5fc3421bdbbb53

SHA1
17a062b5ffd2d20144b383dfa032658514ffff30

SHA256
2cc0af3353e99ae11bfe84bdbfadca24e735e13c171438c9efcc2faee94fface

SHA512
97ed233c00ebb44a3cec19df7e130e71498131e028fe1f329e9ab9ce3c6565214fbb12aa5445512ed70e212073741562b8c82d75ed23effb2e65fc9d0a2aec2b

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
59491621f636bc492a5fc3421bdbbb53

SHA1
17a062b5ffd2d20144b383dfa032658514ffff30

SHA256
2cc0af3353e99ae11bfe84bdbfadca24e735e13c171438c9efcc2faee94fface

SHA512
97ed233c00ebb44a3cec19df7e130e71498131e028fe1f329e9ab9ce3c6565214fbb12aa5445512ed70e212073741562b8c82d75ed23effb2e65fc9d0a2aec2b

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
abe0919b7691dbb91dfac8b24b09563d

SHA1
c5cc721410821bf3595d0a7141ba5a4caac132ee

SHA256
0d38ca22545b19fded261c2039dcc4a7de664b1fe38339669ad718f6435af400

SHA512
52b28a4e0e2c12d43134300ec3d8e6f681d9642cd68f78f17e9a1f2ec5d0f22dfad1876d731423481d5ca3d0d1b5b4b19428dc2453266283a56835903a4d2a66

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
abe0919b7691dbb91dfac8b24b09563d

SHA1
c5cc721410821bf3595d0a7141ba5a4caac132ee

SHA256
0d38ca22545b19fded261c2039dcc4a7de664b1fe38339669ad718f6435af400

SHA512
52b28a4e0e2c12d43134300ec3d8e6f681d9642cd68f78f17e9a1f2ec5d0f22dfad1876d731423481d5ca3d0d1b5b4b19428dc2453266283a56835903a4d2a66

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
f8ccde13f549448b8d728217d9ac7d8a

SHA1
8022073eeb4d3414a18440c84338a72093de06f8

SHA256
1bb63e22660437bd2da684d5d0fd650c82b1e6ed9c49bec8d4a80d380f7cdc12

SHA512
a6d851e85d524b41584e19ef942258e124815c80ed1f15b3fe9c1b8b8da16f34d099a30c8a6e92090680d8286dda3d47ba73b0c317d95d95a2c815f6403979e0

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
f8ccde13f549448b8d728217d9ac7d8a

SHA1
8022073eeb4d3414a18440c84338a72093de06f8

SHA256
1bb63e22660437bd2da684d5d0fd650c82b1e6ed9c49bec8d4a80d380f7cdc12

SHA512
a6d851e85d524b41584e19ef942258e124815c80ed1f15b3fe9c1b8b8da16f34d099a30c8a6e92090680d8286dda3d47ba73b0c317d95d95a2c815f6403979e0

Download Submit
\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
385847d5e4d84b71193a67dd6bee0281

SHA1
6aecb084924bd88cb0632e63f12fb8e3d84657d9

SHA256
a8a81a7c7621390da1b1ed4d55d2305947c25bc321c14d909c4ae12b2aff25be

SHA512
bc01fdf6b9eeeb7b444971fdfcb42b45d281ad3b65847e7cb1980743276314ed84d4c75ba957ef8da54d4fa861e4fcb5f52b2599b6e7b4f3f2cb5eba5e827ce4

Download Submit
\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
385847d5e4d84b71193a67dd6bee0281

SHA1
6aecb084924bd88cb0632e63f12fb8e3d84657d9

SHA256
a8a81a7c7621390da1b1ed4d55d2305947c25bc321c14d909c4ae12b2aff25be

SHA512
bc01fdf6b9eeeb7b444971fdfcb42b45d281ad3b65847e7cb1980743276314ed84d4c75ba957ef8da54d4fa861e4fcb5f52b2599b6e7b4f3f2cb5eba5e827ce4

Download Submit
\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
385847d5e4d84b71193a67dd6bee0281

SHA1
6aecb084924bd88cb0632e63f12fb8e3d84657d9

SHA256
a8a81a7c7621390da1b1ed4d55d2305947c25bc321c14d909c4ae12b2aff25be

SHA512
bc01fdf6b9eeeb7b444971fdfcb42b45d281ad3b65847e7cb1980743276314ed84d4c75ba957ef8da54d4fa861e4fcb5f52b2599b6e7b4f3f2cb5eba5e827ce4

Download Submit
\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
385847d5e4d84b71193a67dd6bee0281

SHA1
6aecb084924bd88cb0632e63f12fb8e3d84657d9

SHA256
a8a81a7c7621390da1b1ed4d55d2305947c25bc321c14d909c4ae12b2aff25be

SHA512
bc01fdf6b9eeeb7b444971fdfcb42b45d281ad3b65847e7cb1980743276314ed84d4c75ba957ef8da54d4fa861e4fcb5f52b2599b6e7b4f3f2cb5eba5e827ce4

Download Submit
\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
385847d5e4d84b71193a67dd6bee0281

SHA1
6aecb084924bd88cb0632e63f12fb8e3d84657d9

SHA256
a8a81a7c7621390da1b1ed4d55d2305947c25bc321c14d909c4ae12b2aff25be

SHA512
bc01fdf6b9eeeb7b444971fdfcb42b45d281ad3b65847e7cb1980743276314ed84d4c75ba957ef8da54d4fa861e4fcb5f52b2599b6e7b4f3f2cb5eba5e827ce4

Download Submit
\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
385847d5e4d84b71193a67dd6bee0281

SHA1
6aecb084924bd88cb0632e63f12fb8e3d84657d9

SHA256
a8a81a7c7621390da1b1ed4d55d2305947c25bc321c14d909c4ae12b2aff25be

SHA512
bc01fdf6b9eeeb7b444971fdfcb42b45d281ad3b65847e7cb1980743276314ed84d4c75ba957ef8da54d4fa861e4fcb5f52b2599b6e7b4f3f2cb5eba5e827ce4

Download Submit
memory/112-174-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/368-199-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/612-194-0x00000000004E0000-0x0000000000508000-memory.dmp

Filesize
160KB

Download
memory/612-213-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/612-84-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/612-218-0x00000000004E0000-0x0000000000508000-memory.dmp

Filesize
160KB

Download
memory/612-190-0x00000000004E0000-0x0000000000508000-memory.dmp

Filesize
160KB

Download
memory/612-221-0x00000000004E0000-0x0000000000508000-memory.dmp

Filesize
160KB

Download
memory/744-163-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/768-211-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/768-210-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/772-217-0x00000000007E0000-0x0000000000808000-memory.dmp

Filesize
160KB

Download
memory/772-216-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/772-87-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/772-192-0x00000000007E0000-0x0000000000808000-memory.dmp

Filesize
160KB

Download
memory/772-187-0x00000000007E0000-0x0000000000808000-memory.dmp

Filesize
160KB

Download
memory/896-189-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/992-166-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1016-168-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1316-196-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1392-86-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1392-220-0x0000000000560000-0x0000000000588000-memory.dmp

Filesize
160KB

Download
memory/1392-208-0x0000000000560000-0x0000000000588000-memory.dmp

Filesize
160KB

Download
memory/1392-215-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1424-186-0x0000000002D00000-0x0000000002D28000-memory.dmp

Filesize
160KB

Download
memory/1424-219-0x0000000002D00000-0x0000000002D28000-memory.dmp

Filesize
160KB

Download
memory/1424-85-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1424-214-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1672-191-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1692-175-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1756-212-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1756-209-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1760-178-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1840-143-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1844-201-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1844-200-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1976-162-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1996-83-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1996-56-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/2000-137-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download