ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Size

52KB
MD5

516920a683d3d758a4f3e8659ddc5b50
SHA1

b844864b9d6db065c2626d5181e3b588b96216da
SHA256

ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc
SHA512

e92775b941f632df57061236f7163affef06a4399a529560b5a7cf6d79be2a765cfe6ad0e6cf06083fdf0a87802731a34db5291479e8e2314b4b00f3e8b7d185
SSDEEP

768:d+ciLamXW9XgMxjFkpvMVX8q18q13yO1+33j5n/weikfw:IzaEW5gMxZVXf8a3yO10pwb

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 10 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	WINLOGON.EXE

Modifies system executable filetype association 2 TTPs 62 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe

Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SERVICES.EXE

Modifies visiblity of hidden/system files in Explorer 2 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SERVICES.EXE

Windows security bypass 2 TTPs 25 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	SERVICES.EXE

Blocks application from running via registry modification 30 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe

Disables RegEdit via registry modification 10 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 24 IoCs

pid	Process
1748	nEwb0Rn.exe
3740	WishfulThinking.exe
2092	WINLOGON.EXE
5052	SERVICES.EXE
3240	nEwb0Rn.exe
528	WishfulThinking.exe
3704	WINLOGON.EXE
4520	nEwb0Rn.exe
4208	SERVICES.EXE
1100	WishfulThinking.exe
4224	nEwb0Rn.exe
1768	WINLOGON.EXE
2472	WishfulThinking.exe
3340	SERVICES.EXE
5088	nEwb0Rn.exe
2468	WINLOGON.EXE
5020	WishfulThinking.exe
5012	SERVICES.EXE
1544	WINLOGON.EXE
1004	SERVICES.EXE
2072	nEwb0Rn.exe
1792	WishfulThinking.exe
4536	WINLOGON.EXE
4092	SERVICES.EXE

Sets file execution options in registry 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	WINLOGON.EXE

Loads dropped DLL 5 IoCs

pid	Process
3240	nEwb0Rn.exe
4520	nEwb0Rn.exe
4224	nEwb0Rn.exe
5088	nEwb0Rn.exe
2072	nEwb0Rn.exe

Windows security modification 2 TTPs 30 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	WINLOGON.EXE

Adds Run key to start application 2 TTPs 25 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	WINLOGON.EXE

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\desktop.ini	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
File created	C:\desktop.ini	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	nEwb0Rn.exe
File opened (read-only)	\??\O:	WINLOGON.EXE
File opened (read-only)	\??\N:	SERVICES.EXE
File opened (read-only)	\??\W:	nEwb0Rn.exe
File opened (read-only)	\??\M:	WishfulThinking.exe
File opened (read-only)	\??\X:	SERVICES.EXE
File opened (read-only)	\??\G:	nEwb0Rn.exe
File opened (read-only)	\??\S:	nEwb0Rn.exe
File opened (read-only)	\??\F:	SERVICES.EXE
File opened (read-only)	\??\H:	SERVICES.EXE
File opened (read-only)	\??\R:	nEwb0Rn.exe
File opened (read-only)	\??\W:	WINLOGON.EXE
File opened (read-only)	\??\L:	SERVICES.EXE
File opened (read-only)	\??\R:	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
File opened (read-only)	\??\Z:	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
File opened (read-only)	\??\S:	WishfulThinking.exe
File opened (read-only)	\??\W:	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
File opened (read-only)	\??\Y:	nEwb0Rn.exe
File opened (read-only)	\??\J:	WINLOGON.EXE
File opened (read-only)	\??\H:	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
File opened (read-only)	\??\Q:	WishfulThinking.exe
File opened (read-only)	\??\K:	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
File opened (read-only)	\??\H:	WINLOGON.EXE
File opened (read-only)	\??\T:	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
File opened (read-only)	\??\O:	nEwb0Rn.exe
File opened (read-only)	\??\U:	nEwb0Rn.exe
File opened (read-only)	\??\Y:	SERVICES.EXE
File opened (read-only)	\??\Z:	SERVICES.EXE
File opened (read-only)	\??\L:	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
File opened (read-only)	\??\P:	nEwb0Rn.exe
File opened (read-only)	\??\X:	nEwb0Rn.exe
File opened (read-only)	\??\V:	WishfulThinking.exe
File opened (read-only)	\??\X:	WINLOGON.EXE
File opened (read-only)	\??\Z:	WishfulThinking.exe
File opened (read-only)	\??\E:	WINLOGON.EXE
File opened (read-only)	\??\U:	WINLOGON.EXE
File opened (read-only)	\??\K:	SERVICES.EXE
File opened (read-only)	\??\V:	SERVICES.EXE
File opened (read-only)	\??\H:	nEwb0Rn.exe
File opened (read-only)	\??\Z:	nEwb0Rn.exe
File opened (read-only)	\??\B:	WishfulThinking.exe
File opened (read-only)	\??\U:	WishfulThinking.exe
File opened (read-only)	\??\O:	SERVICES.EXE
File opened (read-only)	\??\N:	WishfulThinking.exe
File opened (read-only)	\??\B:	WINLOGON.EXE
File opened (read-only)	\??\J:	SERVICES.EXE
File opened (read-only)	\??\O:	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
File opened (read-only)	\??\F:	WishfulThinking.exe
File opened (read-only)	\??\R:	WishfulThinking.exe
File opened (read-only)	\??\X:	WishfulThinking.exe
File opened (read-only)	\??\W:	SERVICES.EXE
File opened (read-only)	\??\E:	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
File opened (read-only)	\??\E:	WishfulThinking.exe
File opened (read-only)	\??\F:	WINLOGON.EXE
File opened (read-only)	\??\R:	WINLOGON.EXE
File opened (read-only)	\??\E:	SERVICES.EXE
File opened (read-only)	\??\V:	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
File opened (read-only)	\??\V:	nEwb0Rn.exe
File opened (read-only)	\??\W:	WishfulThinking.exe
File opened (read-only)	\??\V:	WINLOGON.EXE
File opened (read-only)	\??\G:	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
File opened (read-only)	\??\Y:	WishfulThinking.exe
File opened (read-only)	\??\L:	WINLOGON.EXE
File opened (read-only)	\??\Z:	WINLOGON.EXE

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	SERVICES.EXE
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	nEwb0Rn.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	SERVICES.EXE
File created	C:\Windows\SysWOW64\JawsOfLife.exe	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	nEwb0Rn.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	SERVICES.EXE
File created	C:\Windows\SysWOW64\WishfulThinking.exe	SERVICES.EXE
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	WINLOGON.EXE
File created	C:\Windows\SysWOW64\WishfulThinking.exe	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	WINLOGON.EXE
File created	C:\Windows\SysWOW64\DamageControl.scr	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	nEwb0Rn.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	WINLOGON.EXE
File created	C:\Windows\SysWOW64\WishfulThinking.exe	WINLOGON.EXE
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\nEwb0Rn.exe	SERVICES.EXE
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
File created	C:\Windows\nEwb0Rn.exe	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	WINLOGON.EXE
File created	C:\Windows\nEwb0Rn.exe	WINLOGON.EXE
File opened for modification	C:\Windows\nEwb0Rn.exe	SERVICES.EXE
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	nEwb0Rn.exe
File created	C:\Windows\nEwb0Rn.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\nEwb0Rn.exe	WishfulThinking.exe

Modifies Control Panel 45 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Animate"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Animate"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\AutoEndTasks = "1"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Animate"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\AutoEndTasks = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\AutoEndTasks = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Inanimate"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\AutoEndTasks = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Inanimate"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Animate"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Inanimate"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Inanimate"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\AutoEndTasks = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Inanimate"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Animate"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	SERVICES.EXE

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WINLOGON.EXE
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	nEwb0Rn.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	nEwb0Rn.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	WINLOGON.EXE
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
1748	nEwb0Rn.exe
2092	WINLOGON.EXE
3740	WishfulThinking.exe
5052	SERVICES.EXE

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
1748	nEwb0Rn.exe
3740	WishfulThinking.exe
2092	WINLOGON.EXE
5052	SERVICES.EXE
3240	nEwb0Rn.exe
528	WishfulThinking.exe
3704	WINLOGON.EXE
4520	nEwb0Rn.exe
4208	SERVICES.EXE
1100	WishfulThinking.exe
4224	nEwb0Rn.exe
1768	WINLOGON.EXE
2472	WishfulThinking.exe
3340	SERVICES.EXE
5088	nEwb0Rn.exe
2468	WINLOGON.EXE
5020	WishfulThinking.exe
5012	SERVICES.EXE
1544	WINLOGON.EXE
1004	SERVICES.EXE
2072	nEwb0Rn.exe
1792	WishfulThinking.exe
4536	WINLOGON.EXE
4092	SERVICES.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 1748	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	85
PID 2116 wrote to memory of 1748	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	85
PID 2116 wrote to memory of 1748	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	85
PID 2116 wrote to memory of 3740	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	86
PID 2116 wrote to memory of 3740	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	86
PID 2116 wrote to memory of 3740	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	86
PID 2116 wrote to memory of 2092	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	87
PID 2116 wrote to memory of 2092	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	87
PID 2116 wrote to memory of 2092	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	87
PID 2116 wrote to memory of 5052	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	88
PID 2116 wrote to memory of 5052	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	88
PID 2116 wrote to memory of 5052	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	88
PID 2116 wrote to memory of 3240	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	89
PID 2116 wrote to memory of 3240	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	89
PID 2116 wrote to memory of 3240	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	89
PID 2116 wrote to memory of 528	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	90
PID 2116 wrote to memory of 528	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	90
PID 2116 wrote to memory of 528	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	90
PID 2116 wrote to memory of 3704	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	91
PID 2116 wrote to memory of 3704	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	91
PID 2116 wrote to memory of 3704	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	91
PID 1748 wrote to memory of 4520	1748	nEwb0Rn.exe	92
PID 1748 wrote to memory of 4520	1748	nEwb0Rn.exe	92
PID 1748 wrote to memory of 4520	1748	nEwb0Rn.exe	92
PID 2116 wrote to memory of 4208	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	93
PID 2116 wrote to memory of 4208	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	93
PID 2116 wrote to memory of 4208	2116	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe	93
PID 1748 wrote to memory of 1100	1748	nEwb0Rn.exe	94
PID 1748 wrote to memory of 1100	1748	nEwb0Rn.exe	94
PID 1748 wrote to memory of 1100	1748	nEwb0Rn.exe	94
PID 3740 wrote to memory of 4224	3740	WishfulThinking.exe	95
PID 3740 wrote to memory of 4224	3740	WishfulThinking.exe	95
PID 3740 wrote to memory of 4224	3740	WishfulThinking.exe	95
PID 1748 wrote to memory of 1768	1748	nEwb0Rn.exe	96
PID 1748 wrote to memory of 1768	1748	nEwb0Rn.exe	96
PID 1748 wrote to memory of 1768	1748	nEwb0Rn.exe	96
PID 3740 wrote to memory of 2472	3740	WishfulThinking.exe	97
PID 3740 wrote to memory of 2472	3740	WishfulThinking.exe	97
PID 3740 wrote to memory of 2472	3740	WishfulThinking.exe	97
PID 1748 wrote to memory of 3340	1748	nEwb0Rn.exe	98
PID 1748 wrote to memory of 3340	1748	nEwb0Rn.exe	98
PID 1748 wrote to memory of 3340	1748	nEwb0Rn.exe	98
PID 2092 wrote to memory of 5088	2092	WINLOGON.EXE	99
PID 2092 wrote to memory of 5088	2092	WINLOGON.EXE	99
PID 2092 wrote to memory of 5088	2092	WINLOGON.EXE	99
PID 3740 wrote to memory of 2468	3740	WishfulThinking.exe	100
PID 3740 wrote to memory of 2468	3740	WishfulThinking.exe	100
PID 3740 wrote to memory of 2468	3740	WishfulThinking.exe	100
PID 2092 wrote to memory of 5020	2092	WINLOGON.EXE	101
PID 2092 wrote to memory of 5020	2092	WINLOGON.EXE	101
PID 2092 wrote to memory of 5020	2092	WINLOGON.EXE	101
PID 3740 wrote to memory of 5012	3740	WishfulThinking.exe	102
PID 3740 wrote to memory of 5012	3740	WishfulThinking.exe	102
PID 3740 wrote to memory of 5012	3740	WishfulThinking.exe	102
PID 2092 wrote to memory of 1544	2092	WINLOGON.EXE	103
PID 2092 wrote to memory of 1544	2092	WINLOGON.EXE	103
PID 2092 wrote to memory of 1544	2092	WINLOGON.EXE	103
PID 2092 wrote to memory of 1004	2092	WINLOGON.EXE	104
PID 2092 wrote to memory of 1004	2092	WINLOGON.EXE	104
PID 2092 wrote to memory of 1004	2092	WINLOGON.EXE	104
PID 5052 wrote to memory of 2072	5052	SERVICES.EXE	105
PID 5052 wrote to memory of 2072	5052	SERVICES.EXE	105
PID 5052 wrote to memory of 2072	5052	SERVICES.EXE	105
PID 5052 wrote to memory of 1792	5052	SERVICES.EXE	106

System policy modification 1 TTPs 35 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	nEwb0Rn.exe

C:\Users\Admin\AppData\Local\Temp\ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe
"C:\Users\Admin\AppData\Local\Temp\ea5ce4ee1ea95f50962594583031ed22a9d894eb856879738852159188f282cc.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Windows security modification
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2116
- C:\Windows\nEwb0Rn.exe
  C:\Windows\nEwb0Rn.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Sets file execution options in registry
  - Windows security modification
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1748
- - C:\Windows\nEwb0Rn.exe
    C:\Windows\nEwb0Rn.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4520
- - C:\Windows\SysWOW64\WishfulThinking.exe
    C:\Windows\system32\WishfulThinking.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1100
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1768
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3340
- C:\Windows\SysWOW64\WishfulThinking.exe
  C:\Windows\system32\WishfulThinking.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Sets file execution options in registry
  - Windows security modification
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3740
- - C:\Windows\nEwb0Rn.exe
    C:\Windows\nEwb0Rn.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4224
- - C:\Windows\SysWOW64\WishfulThinking.exe
    C:\Windows\system32\WishfulThinking.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:2472
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2468
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5012
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Sets file execution options in registry
  - Windows security modification
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2092
- - C:\Windows\nEwb0Rn.exe
    C:\Windows\nEwb0Rn.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:5088
- - C:\Windows\SysWOW64\WishfulThinking.exe
    C:\Windows\system32\WishfulThinking.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:5020
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1544
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1004
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Sets file execution options in registry
  - Windows security modification
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5052
- - C:\Windows\nEwb0Rn.exe
    C:\Windows\nEwb0Rn.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2072
- - C:\Windows\SysWOW64\WishfulThinking.exe
    C:\Windows\system32\WishfulThinking.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1792
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4536
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4092
- C:\Windows\nEwb0Rn.exe
  C:\Windows\nEwb0Rn.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3240
- C:\Windows\SysWOW64\WishfulThinking.exe
  C:\Windows\system32\WishfulThinking.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:528
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3704
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
2dc2c6d4423a2e19bf5934ff2f3cd844

SHA1
64b9eabdb2d35e8a919ff66a3d3718828156c5dd

SHA256
e2c68254af5118dfc85a7c06a6a4a3e9fc386e64fbad1c6e724c4f9f07cc3feb

SHA512
a3872d66a9f3c6ef1f7feea58661619b08c60299e13f5ea96bbb7adc57777efbebf89d3918e16b0a28fb0222f77600685ffb9ba3b34981c58752764b6b615da9

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
2dc2c6d4423a2e19bf5934ff2f3cd844

SHA1
64b9eabdb2d35e8a919ff66a3d3718828156c5dd

SHA256
e2c68254af5118dfc85a7c06a6a4a3e9fc386e64fbad1c6e724c4f9f07cc3feb

SHA512
a3872d66a9f3c6ef1f7feea58661619b08c60299e13f5ea96bbb7adc57777efbebf89d3918e16b0a28fb0222f77600685ffb9ba3b34981c58752764b6b615da9

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
2dc2c6d4423a2e19bf5934ff2f3cd844

SHA1
64b9eabdb2d35e8a919ff66a3d3718828156c5dd

SHA256
e2c68254af5118dfc85a7c06a6a4a3e9fc386e64fbad1c6e724c4f9f07cc3feb

SHA512
a3872d66a9f3c6ef1f7feea58661619b08c60299e13f5ea96bbb7adc57777efbebf89d3918e16b0a28fb0222f77600685ffb9ba3b34981c58752764b6b615da9

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
f49bea0e9d5aacbe3d6ac1722b950b0e

SHA1
337cffba571486b2ea0f2780d3d6b9fafdb05e10

SHA256
4ea15c185fadb87c5936df74a024c0e55ed15564d5e3379389f7aa7a705d7b38

SHA512
fd0fa3b1c2033daa70d6c5216499864ef5763469a3a84c04f294408bf4431ae4e617f244815766cef017748f69a729dc3160c7cd036acbb8e942c11118d7f123

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
f49bea0e9d5aacbe3d6ac1722b950b0e

SHA1
337cffba571486b2ea0f2780d3d6b9fafdb05e10

SHA256
4ea15c185fadb87c5936df74a024c0e55ed15564d5e3379389f7aa7a705d7b38

SHA512
fd0fa3b1c2033daa70d6c5216499864ef5763469a3a84c04f294408bf4431ae4e617f244815766cef017748f69a729dc3160c7cd036acbb8e942c11118d7f123

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
f49bea0e9d5aacbe3d6ac1722b950b0e

SHA1
337cffba571486b2ea0f2780d3d6b9fafdb05e10

SHA256
4ea15c185fadb87c5936df74a024c0e55ed15564d5e3379389f7aa7a705d7b38

SHA512
fd0fa3b1c2033daa70d6c5216499864ef5763469a3a84c04f294408bf4431ae4e617f244815766cef017748f69a729dc3160c7cd036acbb8e942c11118d7f123

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

Filesize
52KB

MD5
cf878e92ff11cb8597b8d6caa4e1759f

SHA1
7e8b22858266443239c248c1d1f8c147cc328722

SHA256
5e873dcd5194849b469b8a3af4320e1ec72a8857b3c85bf0e85de034b574dbb5

SHA512
fd79dd733a92e9b9c54a4436a49adf47bf750136ebe8721c5031a0eea472ad8799b1dc7f7cf5534c4e614f9d1ef81bbe689f0227aa5adfda3b96960bda227abe

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

Filesize
52KB

MD5
7a5c6ecae1776b69de6732cefbaafed1

SHA1
9cf44d7f67a83fbd3656e5b71af9a8f8524957f0

SHA256
77590cad162c32ac494da5bc3779401f3bb88b57721d1f81fb53326b645708ee

SHA512
d890d513b2ee82817fa78e863d32e3165c969f83779144859cb7a10ad01c702e6c811ed44bfae84458cff8514d4c54e00deda2917103cb7925ffc64052e23bd6

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

Filesize
52KB

MD5
f49bea0e9d5aacbe3d6ac1722b950b0e

SHA1
337cffba571486b2ea0f2780d3d6b9fafdb05e10

SHA256
4ea15c185fadb87c5936df74a024c0e55ed15564d5e3379389f7aa7a705d7b38

SHA512
fd0fa3b1c2033daa70d6c5216499864ef5763469a3a84c04f294408bf4431ae4e617f244815766cef017748f69a729dc3160c7cd036acbb8e942c11118d7f123

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

Filesize
52KB

MD5
2dc2c6d4423a2e19bf5934ff2f3cd844

SHA1
64b9eabdb2d35e8a919ff66a3d3718828156c5dd

SHA256
e2c68254af5118dfc85a7c06a6a4a3e9fc386e64fbad1c6e724c4f9f07cc3feb

SHA512
a3872d66a9f3c6ef1f7feea58661619b08c60299e13f5ea96bbb7adc57777efbebf89d3918e16b0a28fb0222f77600685ffb9ba3b34981c58752764b6b615da9

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

Filesize
52KB

MD5
cf878e92ff11cb8597b8d6caa4e1759f

SHA1
7e8b22858266443239c248c1d1f8c147cc328722

SHA256
5e873dcd5194849b469b8a3af4320e1ec72a8857b3c85bf0e85de034b574dbb5

SHA512
fd79dd733a92e9b9c54a4436a49adf47bf750136ebe8721c5031a0eea472ad8799b1dc7f7cf5534c4e614f9d1ef81bbe689f0227aa5adfda3b96960bda227abe

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

Filesize
52KB

MD5
7a5c6ecae1776b69de6732cefbaafed1

SHA1
9cf44d7f67a83fbd3656e5b71af9a8f8524957f0

SHA256
77590cad162c32ac494da5bc3779401f3bb88b57721d1f81fb53326b645708ee

SHA512
d890d513b2ee82817fa78e863d32e3165c969f83779144859cb7a10ad01c702e6c811ed44bfae84458cff8514d4c54e00deda2917103cb7925ffc64052e23bd6

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

Filesize
52KB

MD5
f49bea0e9d5aacbe3d6ac1722b950b0e

SHA1
337cffba571486b2ea0f2780d3d6b9fafdb05e10

SHA256
4ea15c185fadb87c5936df74a024c0e55ed15564d5e3379389f7aa7a705d7b38

SHA512
fd0fa3b1c2033daa70d6c5216499864ef5763469a3a84c04f294408bf4431ae4e617f244815766cef017748f69a729dc3160c7cd036acbb8e942c11118d7f123

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

Filesize
52KB

MD5
2dc2c6d4423a2e19bf5934ff2f3cd844

SHA1
64b9eabdb2d35e8a919ff66a3d3718828156c5dd

SHA256
e2c68254af5118dfc85a7c06a6a4a3e9fc386e64fbad1c6e724c4f9f07cc3feb

SHA512
a3872d66a9f3c6ef1f7feea58661619b08c60299e13f5ea96bbb7adc57777efbebf89d3918e16b0a28fb0222f77600685ffb9ba3b34981c58752764b6b615da9

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
2dc2c6d4423a2e19bf5934ff2f3cd844

SHA1
64b9eabdb2d35e8a919ff66a3d3718828156c5dd

SHA256
e2c68254af5118dfc85a7c06a6a4a3e9fc386e64fbad1c6e724c4f9f07cc3feb

SHA512
a3872d66a9f3c6ef1f7feea58661619b08c60299e13f5ea96bbb7adc57777efbebf89d3918e16b0a28fb0222f77600685ffb9ba3b34981c58752764b6b615da9

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

Filesize
52KB

MD5
cf878e92ff11cb8597b8d6caa4e1759f

SHA1
7e8b22858266443239c248c1d1f8c147cc328722

SHA256
5e873dcd5194849b469b8a3af4320e1ec72a8857b3c85bf0e85de034b574dbb5

SHA512
fd79dd733a92e9b9c54a4436a49adf47bf750136ebe8721c5031a0eea472ad8799b1dc7f7cf5534c4e614f9d1ef81bbe689f0227aa5adfda3b96960bda227abe

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

Filesize
52KB

MD5
7a5c6ecae1776b69de6732cefbaafed1

SHA1
9cf44d7f67a83fbd3656e5b71af9a8f8524957f0

SHA256
77590cad162c32ac494da5bc3779401f3bb88b57721d1f81fb53326b645708ee

SHA512
d890d513b2ee82817fa78e863d32e3165c969f83779144859cb7a10ad01c702e6c811ed44bfae84458cff8514d4c54e00deda2917103cb7925ffc64052e23bd6

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

Filesize
52KB

MD5
f49bea0e9d5aacbe3d6ac1722b950b0e

SHA1
337cffba571486b2ea0f2780d3d6b9fafdb05e10

SHA256
4ea15c185fadb87c5936df74a024c0e55ed15564d5e3379389f7aa7a705d7b38

SHA512
fd0fa3b1c2033daa70d6c5216499864ef5763469a3a84c04f294408bf4431ae4e617f244815766cef017748f69a729dc3160c7cd036acbb8e942c11118d7f123

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

Filesize
52KB

MD5
2dc2c6d4423a2e19bf5934ff2f3cd844

SHA1
64b9eabdb2d35e8a919ff66a3d3718828156c5dd

SHA256
e2c68254af5118dfc85a7c06a6a4a3e9fc386e64fbad1c6e724c4f9f07cc3feb

SHA512
a3872d66a9f3c6ef1f7feea58661619b08c60299e13f5ea96bbb7adc57777efbebf89d3918e16b0a28fb0222f77600685ffb9ba3b34981c58752764b6b615da9

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
f49bea0e9d5aacbe3d6ac1722b950b0e

SHA1
337cffba571486b2ea0f2780d3d6b9fafdb05e10

SHA256
4ea15c185fadb87c5936df74a024c0e55ed15564d5e3379389f7aa7a705d7b38

SHA512
fd0fa3b1c2033daa70d6c5216499864ef5763469a3a84c04f294408bf4431ae4e617f244815766cef017748f69a729dc3160c7cd036acbb8e942c11118d7f123

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
cf878e92ff11cb8597b8d6caa4e1759f

SHA1
7e8b22858266443239c248c1d1f8c147cc328722

SHA256
5e873dcd5194849b469b8a3af4320e1ec72a8857b3c85bf0e85de034b574dbb5

SHA512
fd79dd733a92e9b9c54a4436a49adf47bf750136ebe8721c5031a0eea472ad8799b1dc7f7cf5534c4e614f9d1ef81bbe689f0227aa5adfda3b96960bda227abe

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
7a5c6ecae1776b69de6732cefbaafed1

SHA1
9cf44d7f67a83fbd3656e5b71af9a8f8524957f0

SHA256
77590cad162c32ac494da5bc3779401f3bb88b57721d1f81fb53326b645708ee

SHA512
d890d513b2ee82817fa78e863d32e3165c969f83779144859cb7a10ad01c702e6c811ed44bfae84458cff8514d4c54e00deda2917103cb7925ffc64052e23bd6

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
f49bea0e9d5aacbe3d6ac1722b950b0e

SHA1
337cffba571486b2ea0f2780d3d6b9fafdb05e10

SHA256
4ea15c185fadb87c5936df74a024c0e55ed15564d5e3379389f7aa7a705d7b38

SHA512
fd0fa3b1c2033daa70d6c5216499864ef5763469a3a84c04f294408bf4431ae4e617f244815766cef017748f69a729dc3160c7cd036acbb8e942c11118d7f123

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
b9d0d584387effec130b9f90c39ada3e

SHA1
3510994e41525b5bc60ca4b01c486bcc54a7bc44

SHA256
5853006bf9b7d95e6acfbd668270c42d848a9f770e87fd5b0ea69866ecd28a80

SHA512
5c685509973a9e48a3b1e63868514aa29ad6c291cdcd9519f06128b877b720c17f0e08344ec4ec3f093ac803c4848f41fb2a36df00a6d9c7fc31ad4bbea222a6

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
2dc2c6d4423a2e19bf5934ff2f3cd844

SHA1
64b9eabdb2d35e8a919ff66a3d3718828156c5dd

SHA256
e2c68254af5118dfc85a7c06a6a4a3e9fc386e64fbad1c6e724c4f9f07cc3feb

SHA512
a3872d66a9f3c6ef1f7feea58661619b08c60299e13f5ea96bbb7adc57777efbebf89d3918e16b0a28fb0222f77600685ffb9ba3b34981c58752764b6b615da9

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
06f6811b7de8b759b6a453f81875061e

SHA1
40f442996ae49384c567b93a857e4df1024ed864

SHA256
f564a735465e9f6de14a72687d9d8fae75f9b7512ff52eb8ef50cab493acb589

SHA512
b637101b4c5feb7c6048be8c02d1ba5b61f6197e402c0c5484ed3c3c85daf7e399f56d6a46a5b2dc754d0d6b2cf27398529f03d3d55ec59b51bdc7fb614223e7

Download Submit
C:\Windows\MSVBVM60.DLL

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
cf878e92ff11cb8597b8d6caa4e1759f

SHA1
7e8b22858266443239c248c1d1f8c147cc328722

SHA256
5e873dcd5194849b469b8a3af4320e1ec72a8857b3c85bf0e85de034b574dbb5

SHA512
fd79dd733a92e9b9c54a4436a49adf47bf750136ebe8721c5031a0eea472ad8799b1dc7f7cf5534c4e614f9d1ef81bbe689f0227aa5adfda3b96960bda227abe

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
7a5c6ecae1776b69de6732cefbaafed1

SHA1
9cf44d7f67a83fbd3656e5b71af9a8f8524957f0

SHA256
77590cad162c32ac494da5bc3779401f3bb88b57721d1f81fb53326b645708ee

SHA512
d890d513b2ee82817fa78e863d32e3165c969f83779144859cb7a10ad01c702e6c811ed44bfae84458cff8514d4c54e00deda2917103cb7925ffc64052e23bd6

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
f49bea0e9d5aacbe3d6ac1722b950b0e

SHA1
337cffba571486b2ea0f2780d3d6b9fafdb05e10

SHA256
4ea15c185fadb87c5936df74a024c0e55ed15564d5e3379389f7aa7a705d7b38

SHA512
fd0fa3b1c2033daa70d6c5216499864ef5763469a3a84c04f294408bf4431ae4e617f244815766cef017748f69a729dc3160c7cd036acbb8e942c11118d7f123

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
4c4bd3542fdd6dd5493c0355b59c89e2

SHA1
28c6ed6564f781f3c2337a1d401cc8db8df39596

SHA256
14922ea34787b00ed5cdb583f7d623d104db6b0dfb5307790c355dfdbc60cfd6

SHA512
7b0ec6fc00b08c3d07d752308b5225786cafc3e6301cc567ffee875e6afb8c968e13c032b0fcfc15f2b348af80b57b6bcbd80a4c7514214ff848fe672e36fdee

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
2dc2c6d4423a2e19bf5934ff2f3cd844

SHA1
64b9eabdb2d35e8a919ff66a3d3718828156c5dd

SHA256
e2c68254af5118dfc85a7c06a6a4a3e9fc386e64fbad1c6e724c4f9f07cc3feb

SHA512
a3872d66a9f3c6ef1f7feea58661619b08c60299e13f5ea96bbb7adc57777efbebf89d3918e16b0a28fb0222f77600685ffb9ba3b34981c58752764b6b615da9

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
eeafeb145146a4bd6a0a48cc85f0ffd2

SHA1
34f6613cc03010019bb6c292045bcb0c37304b06

SHA256
96b475df1ab8bf36bfa8093a296ce1536e5b8bf8615af20aabc5209bd35ffdba

SHA512
eabffbf0119bd0de6481be57677412bfbc545b5e477d1333be45d4a4e5c5b5eaa63babbd2db1d785581f5acb28b8ae5f5d2bbfe7d17a4c847424f55835654468

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
e35b6a34a8f415f2e15d036d325502b8

SHA1
3372cba94d7cec18c2ee556aedcd13b215b151d7

SHA256
823855638fdc8cb924ccde80b3832d2d59221862938ef82a1bac185060b8b45e

SHA512
81707d42aec34b4ea141dc83fc990f67ad51f502e84d1f698cbc633a467e1ff3a3719abc2f27bedd2e8d948f8a1a63c6dc5697f697e3d64778da3fea2386359c

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
7a5c6ecae1776b69de6732cefbaafed1

SHA1
9cf44d7f67a83fbd3656e5b71af9a8f8524957f0

SHA256
77590cad162c32ac494da5bc3779401f3bb88b57721d1f81fb53326b645708ee

SHA512
d890d513b2ee82817fa78e863d32e3165c969f83779144859cb7a10ad01c702e6c811ed44bfae84458cff8514d4c54e00deda2917103cb7925ffc64052e23bd6

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
f49bea0e9d5aacbe3d6ac1722b950b0e

SHA1
337cffba571486b2ea0f2780d3d6b9fafdb05e10

SHA256
4ea15c185fadb87c5936df74a024c0e55ed15564d5e3379389f7aa7a705d7b38

SHA512
fd0fa3b1c2033daa70d6c5216499864ef5763469a3a84c04f294408bf4431ae4e617f244815766cef017748f69a729dc3160c7cd036acbb8e942c11118d7f123

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
4c3cd795c01b6b1428eb3c05ee64cabe

SHA1
d25ed15e99deeba0da9808fcf61daf1585aef04e

SHA256
3e92f96940c01ec35475b88f8dc6c0fe32a118cd9cfc347f9dd632f13ea67649

SHA512
c0aa36acf147d8f5c65f3b89f8365dbaf3ec883f98a6247a68f33cd6071b44da4d84e9ccdeee18f3e30e6bd31eec992ac19306a9578fab05ea37ffa9207369fe

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
2dc2c6d4423a2e19bf5934ff2f3cd844

SHA1
64b9eabdb2d35e8a919ff66a3d3718828156c5dd

SHA256
e2c68254af5118dfc85a7c06a6a4a3e9fc386e64fbad1c6e724c4f9f07cc3feb

SHA512
a3872d66a9f3c6ef1f7feea58661619b08c60299e13f5ea96bbb7adc57777efbebf89d3918e16b0a28fb0222f77600685ffb9ba3b34981c58752764b6b615da9

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
865dc777709355b97a85060428c0ed78

SHA1
7c7d4f0c7a2750363ac7f9ffb69d54135fdc0bd4

SHA256
6308f50772f8e70fe19b9775be3a128f43f7d6b5146380b2cc8bcb6554a4f69f

SHA512
6e26632bef130a2f6a7aeaadf55ba460fd932074b4f43a277efa2869075eae2cdac2cc71e36b937fcf75d40734b0ef7aeb2131c4c5e6c432ea668431cc4ef7ed

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
7a5c6ecae1776b69de6732cefbaafed1

SHA1
9cf44d7f67a83fbd3656e5b71af9a8f8524957f0

SHA256
77590cad162c32ac494da5bc3779401f3bb88b57721d1f81fb53326b645708ee

SHA512
d890d513b2ee82817fa78e863d32e3165c969f83779144859cb7a10ad01c702e6c811ed44bfae84458cff8514d4c54e00deda2917103cb7925ffc64052e23bd6

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
7a5c6ecae1776b69de6732cefbaafed1

SHA1
9cf44d7f67a83fbd3656e5b71af9a8f8524957f0

SHA256
77590cad162c32ac494da5bc3779401f3bb88b57721d1f81fb53326b645708ee

SHA512
d890d513b2ee82817fa78e863d32e3165c969f83779144859cb7a10ad01c702e6c811ed44bfae84458cff8514d4c54e00deda2917103cb7925ffc64052e23bd6

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
7a5c6ecae1776b69de6732cefbaafed1

SHA1
9cf44d7f67a83fbd3656e5b71af9a8f8524957f0

SHA256
77590cad162c32ac494da5bc3779401f3bb88b57721d1f81fb53326b645708ee

SHA512
d890d513b2ee82817fa78e863d32e3165c969f83779144859cb7a10ad01c702e6c811ed44bfae84458cff8514d4c54e00deda2917103cb7925ffc64052e23bd6

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
7a5c6ecae1776b69de6732cefbaafed1

SHA1
9cf44d7f67a83fbd3656e5b71af9a8f8524957f0

SHA256
77590cad162c32ac494da5bc3779401f3bb88b57721d1f81fb53326b645708ee

SHA512
d890d513b2ee82817fa78e863d32e3165c969f83779144859cb7a10ad01c702e6c811ed44bfae84458cff8514d4c54e00deda2917103cb7925ffc64052e23bd6

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
7a5c6ecae1776b69de6732cefbaafed1

SHA1
9cf44d7f67a83fbd3656e5b71af9a8f8524957f0

SHA256
77590cad162c32ac494da5bc3779401f3bb88b57721d1f81fb53326b645708ee

SHA512
d890d513b2ee82817fa78e863d32e3165c969f83779144859cb7a10ad01c702e6c811ed44bfae84458cff8514d4c54e00deda2917103cb7925ffc64052e23bd6

Download Submit
C:\Windows\msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
cf878e92ff11cb8597b8d6caa4e1759f

SHA1
7e8b22858266443239c248c1d1f8c147cc328722

SHA256
5e873dcd5194849b469b8a3af4320e1ec72a8857b3c85bf0e85de034b574dbb5

SHA512
fd79dd733a92e9b9c54a4436a49adf47bf750136ebe8721c5031a0eea472ad8799b1dc7f7cf5534c4e614f9d1ef81bbe689f0227aa5adfda3b96960bda227abe

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
cf878e92ff11cb8597b8d6caa4e1759f

SHA1
7e8b22858266443239c248c1d1f8c147cc328722

SHA256
5e873dcd5194849b469b8a3af4320e1ec72a8857b3c85bf0e85de034b574dbb5

SHA512
fd79dd733a92e9b9c54a4436a49adf47bf750136ebe8721c5031a0eea472ad8799b1dc7f7cf5534c4e614f9d1ef81bbe689f0227aa5adfda3b96960bda227abe

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
cf878e92ff11cb8597b8d6caa4e1759f

SHA1
7e8b22858266443239c248c1d1f8c147cc328722

SHA256
5e873dcd5194849b469b8a3af4320e1ec72a8857b3c85bf0e85de034b574dbb5

SHA512
fd79dd733a92e9b9c54a4436a49adf47bf750136ebe8721c5031a0eea472ad8799b1dc7f7cf5534c4e614f9d1ef81bbe689f0227aa5adfda3b96960bda227abe

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
cf878e92ff11cb8597b8d6caa4e1759f

SHA1
7e8b22858266443239c248c1d1f8c147cc328722

SHA256
5e873dcd5194849b469b8a3af4320e1ec72a8857b3c85bf0e85de034b574dbb5

SHA512
fd79dd733a92e9b9c54a4436a49adf47bf750136ebe8721c5031a0eea472ad8799b1dc7f7cf5534c4e614f9d1ef81bbe689f0227aa5adfda3b96960bda227abe

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
cf878e92ff11cb8597b8d6caa4e1759f

SHA1
7e8b22858266443239c248c1d1f8c147cc328722

SHA256
5e873dcd5194849b469b8a3af4320e1ec72a8857b3c85bf0e85de034b574dbb5

SHA512
fd79dd733a92e9b9c54a4436a49adf47bf750136ebe8721c5031a0eea472ad8799b1dc7f7cf5534c4e614f9d1ef81bbe689f0227aa5adfda3b96960bda227abe

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
cf878e92ff11cb8597b8d6caa4e1759f

SHA1
7e8b22858266443239c248c1d1f8c147cc328722

SHA256
5e873dcd5194849b469b8a3af4320e1ec72a8857b3c85bf0e85de034b574dbb5

SHA512
fd79dd733a92e9b9c54a4436a49adf47bf750136ebe8721c5031a0eea472ad8799b1dc7f7cf5534c4e614f9d1ef81bbe689f0227aa5adfda3b96960bda227abe

Download Submit
C:\about.htm

Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\about.htm

Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\about.htm

Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
7a5c6ecae1776b69de6732cefbaafed1

SHA1
9cf44d7f67a83fbd3656e5b71af9a8f8524957f0

SHA256
77590cad162c32ac494da5bc3779401f3bb88b57721d1f81fb53326b645708ee

SHA512
d890d513b2ee82817fa78e863d32e3165c969f83779144859cb7a10ad01c702e6c811ed44bfae84458cff8514d4c54e00deda2917103cb7925ffc64052e23bd6

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
f49bea0e9d5aacbe3d6ac1722b950b0e

SHA1
337cffba571486b2ea0f2780d3d6b9fafdb05e10

SHA256
4ea15c185fadb87c5936df74a024c0e55ed15564d5e3379389f7aa7a705d7b38

SHA512
fd0fa3b1c2033daa70d6c5216499864ef5763469a3a84c04f294408bf4431ae4e617f244815766cef017748f69a729dc3160c7cd036acbb8e942c11118d7f123

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
d119a12879081b316cf96070d1440ec4

SHA1
6bf4f7c7f3505c0f2cc3c25d99afceedcee66f60

SHA256
51baa6961c982e9649bf56b27d39f502b9c23e1bc2b6faba05a4f1e6f9de3ef4

SHA512
227d4d80500b23883e33a2e20837232d1eae5ef13b169aaa8d0e134da864a2bd1329d2818dfd6007604a93c6adb0ad8b60b085010158ef33918d95c34a9402d6

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
2dc2c6d4423a2e19bf5934ff2f3cd844

SHA1
64b9eabdb2d35e8a919ff66a3d3718828156c5dd

SHA256
e2c68254af5118dfc85a7c06a6a4a3e9fc386e64fbad1c6e724c4f9f07cc3feb

SHA512
a3872d66a9f3c6ef1f7feea58661619b08c60299e13f5ea96bbb7adc57777efbebf89d3918e16b0a28fb0222f77600685ffb9ba3b34981c58752764b6b615da9

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
4b458df81d1835c4e60ee0a7fc591805

SHA1
fa090d7e145fe680c26d337b2a9d01f865866c0b

SHA256
0308ec3658a1c45cd2b965e6a8e077708fdf4e28df6f5b0d73dd55f31eeb1501

SHA512
08a0f28f5546471071889084fd30c2116d1faa570eca0c26beec40c399d6b6246911ff068a8f9ea9372c1a8489431432b59f9c51e47cbffdca99e480bd73d8a1

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
4b458df81d1835c4e60ee0a7fc591805

SHA1
fa090d7e145fe680c26d337b2a9d01f865866c0b

SHA256
0308ec3658a1c45cd2b965e6a8e077708fdf4e28df6f5b0d73dd55f31eeb1501

SHA512
08a0f28f5546471071889084fd30c2116d1faa570eca0c26beec40c399d6b6246911ff068a8f9ea9372c1a8489431432b59f9c51e47cbffdca99e480bd73d8a1

Download Submit
memory/528-176-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1004-283-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1100-235-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1544-276-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1748-297-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1748-150-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1768-245-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1792-288-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2072-285-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2092-152-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2092-299-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2116-132-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2116-267-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2468-265-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2472-248-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3240-166-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3340-258-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3704-184-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3740-298-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3740-151-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4092-296-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4208-206-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4208-215-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4224-242-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4520-205-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4536-292-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5012-275-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5020-268-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5052-203-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5052-300-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5088-262-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download