538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff

Analysis

max time kernel
152s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Size

52KB
MD5

00d73f9d1b03a5234c05f949827c57b1
SHA1

2db7927595ff634da638c1b0438f98a77f789baa
SHA256

538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff
SHA512

f25578eb6a003a37d93b0b95970836c2fe52f9256243057fa55e26ce4886c1b01c408d5409d533a022db2ff8f81352eda7f3469f1b37cbac999405ff66918a3e
SSDEEP

768:d+ciLamXW9XgMxjFkpvMVX8q18q13yO1+33j5n/w25kfw:IzaEW5gMxZVXf8a3yO10pwk

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 10 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	SERVICES.EXE

Modifies system executable filetype association 2 TTPs 62 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE

Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SERVICES.EXE

Modifies visiblity of hidden/system files in Explorer 2 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SERVICES.EXE

Windows security bypass 2 TTPs 25 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	WishfulThinking.exe

Blocks application from running via registry modification 30 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe

Disables RegEdit via registry modification 10 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 24 IoCs

pid	Process
2036	nEwb0Rn.exe
996	WishfulThinking.exe
1396	WINLOGON.EXE
1668	nEwb0Rn.exe
1532	WishfulThinking.exe
1464	WINLOGON.EXE
584	nEwb0Rn.exe
920	SERVICES.EXE
1252	WishfulThinking.exe
1956	WINLOGON.EXE
1596	nEwb0Rn.exe
536	SERVICES.EXE
1076	nEwb0Rn.exe
1980	WishfulThinking.exe
1112	SERVICES.EXE
1576	WishfulThinking.exe
1808	WINLOGON.EXE
1320	WINLOGON.EXE
820	SERVICES.EXE
1828	SERVICES.EXE
1832	nEwb0Rn.exe
1820	WishfulThinking.exe
364	WINLOGON.EXE
580	SERVICES.EXE

Sets file execution options in registry 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	SERVICES.EXE

Loads dropped DLL 34 IoCs

pid	Process
1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
2036	nEwb0Rn.exe
2036	nEwb0Rn.exe
2036	nEwb0Rn.exe
2036	nEwb0Rn.exe
1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
996	WishfulThinking.exe
996	WishfulThinking.exe
2036	nEwb0Rn.exe
2036	nEwb0Rn.exe
1396	WINLOGON.EXE
1396	WINLOGON.EXE
996	WishfulThinking.exe
996	WishfulThinking.exe
1396	WINLOGON.EXE
1396	WINLOGON.EXE
996	WishfulThinking.exe
996	WishfulThinking.exe
1396	WINLOGON.EXE
920	SERVICES.EXE
920	SERVICES.EXE
920	SERVICES.EXE
920	SERVICES.EXE
920	SERVICES.EXE

Windows security modification 2 TTPs 30 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	SERVICES.EXE

Adds Run key to start application 2 TTPs 25 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	SERVICES.EXE

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\desktop.ini	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened for modification	C:\desktop.ini	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	nEwb0Rn.exe
File opened (read-only)	\??\B:	SERVICES.EXE
File opened (read-only)	\??\H:	SERVICES.EXE
File opened (read-only)	\??\Y:	SERVICES.EXE
File opened (read-only)	\??\W:	nEwb0Rn.exe
File opened (read-only)	\??\G:	SERVICES.EXE
File opened (read-only)	\??\L:	SERVICES.EXE
File opened (read-only)	\??\M:	SERVICES.EXE
File opened (read-only)	\??\L:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\M:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\E:	WishfulThinking.exe
File opened (read-only)	\??\X:	WishfulThinking.exe
File opened (read-only)	\??\H:	WINLOGON.EXE
File opened (read-only)	\??\E:	nEwb0Rn.exe
File opened (read-only)	\??\S:	WINLOGON.EXE
File opened (read-only)	\??\V:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\J:	WINLOGON.EXE
File opened (read-only)	\??\Q:	WishfulThinking.exe
File opened (read-only)	\??\U:	WishfulThinking.exe
File opened (read-only)	\??\T:	SERVICES.EXE
File opened (read-only)	\??\O:	SERVICES.EXE
File opened (read-only)	\??\R:	WishfulThinking.exe
File opened (read-only)	\??\V:	WishfulThinking.exe
File opened (read-only)	\??\G:	WINLOGON.EXE
File opened (read-only)	\??\P:	WINLOGON.EXE
File opened (read-only)	\??\Q:	WINLOGON.EXE
File opened (read-only)	\??\B:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\X:	nEwb0Rn.exe
File opened (read-only)	\??\W:	WINLOGON.EXE
File opened (read-only)	\??\W:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\V:	nEwb0Rn.exe
File opened (read-only)	\??\B:	WishfulThinking.exe
File opened (read-only)	\??\L:	WINLOGON.EXE
File opened (read-only)	\??\L:	WishfulThinking.exe
File opened (read-only)	\??\Q:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\F:	SERVICES.EXE
File opened (read-only)	\??\B:	WINLOGON.EXE
File opened (read-only)	\??\R:	SERVICES.EXE
File opened (read-only)	\??\H:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\R:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\J:	WishfulThinking.exe
File opened (read-only)	\??\T:	WishfulThinking.exe
File opened (read-only)	\??\Y:	WishfulThinking.exe
File opened (read-only)	\??\N:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\O:	WINLOGON.EXE
File opened (read-only)	\??\G:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\I:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\L:	nEwb0Rn.exe
File opened (read-only)	\??\S:	nEwb0Rn.exe
File opened (read-only)	\??\I:	SERVICES.EXE
File opened (read-only)	\??\S:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\U:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\N:	nEwb0Rn.exe
File opened (read-only)	\??\O:	WishfulThinking.exe
File opened (read-only)	\??\E:	SERVICES.EXE
File opened (read-only)	\??\I:	WINLOGON.EXE
File opened (read-only)	\??\R:	WINLOGON.EXE
File opened (read-only)	\??\J:	SERVICES.EXE
File opened (read-only)	\??\G:	nEwb0Rn.exe
File opened (read-only)	\??\H:	nEwb0Rn.exe
File opened (read-only)	\??\I:	nEwb0Rn.exe
File opened (read-only)	\??\R:	nEwb0Rn.exe
File opened (read-only)	\??\T:	nEwb0Rn.exe
File opened (read-only)	\??\Q:	SERVICES.EXE

Drops file in System32 directory 34 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\JawsOfLife.exe	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	nEwb0Rn.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	WINLOGON.EXE
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File created	C:\Windows\SysWOW64\DamageControl.scr	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	WishfulThinking.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	WINLOGON.EXE
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	SERVICES.EXE
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	SERVICES.EXE
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	nEwb0Rn.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	WINLOGON.EXE
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	WINLOGON.EXE
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	SERVICES.EXE
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	SERVICES.EXE
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	WishfulThinking.exe
File created	C:\Windows\nEwb0Rn.exe	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	nEwb0Rn.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\nEwb0Rn.exe	WINLOGON.EXE
File created	C:\Windows\nEwb0Rn.exe	SERVICES.EXE
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File created	C:\Windows\nEwb0Rn.exe	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	WINLOGON.EXE
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	SERVICES.EXE
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\nEwb0Rn.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 45 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Animate"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Inanimate"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Animate"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Inanimate"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Inanimate"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\AutoEndTasks = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Animate"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\AutoEndTasks = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Inanimate"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\AutoEndTasks = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Animate"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\AutoEndTasks = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s2359 = "Animate"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\s1159 = "Inanimate"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\AutoEndTasks = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	SERVICES.EXE

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	WINLOGON.EXE

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	WishfulThinking.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	WishfulThinking.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	SERVICES.EXE
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WINLOGON.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	SERVICES.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
2036	nEwb0Rn.exe
1396	WINLOGON.EXE
996	WishfulThinking.exe
920	SERVICES.EXE

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
2036	nEwb0Rn.exe
996	WishfulThinking.exe
1396	WINLOGON.EXE
1668	nEwb0Rn.exe
1532	WishfulThinking.exe
1464	WINLOGON.EXE
584	nEwb0Rn.exe
920	SERVICES.EXE
1252	WishfulThinking.exe
1596	nEwb0Rn.exe
1956	WINLOGON.EXE
536	SERVICES.EXE
1076	nEwb0Rn.exe
1112	SERVICES.EXE
1980	WishfulThinking.exe
1576	WishfulThinking.exe
1808	WINLOGON.EXE
1320	WINLOGON.EXE
1828	SERVICES.EXE
820	SERVICES.EXE
1832	nEwb0Rn.exe
1820	WishfulThinking.exe
364	WINLOGON.EXE
580	SERVICES.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 2036	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	27
PID 1480 wrote to memory of 2036	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	27
PID 1480 wrote to memory of 2036	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	27
PID 1480 wrote to memory of 2036	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	27
PID 1480 wrote to memory of 996	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	28
PID 1480 wrote to memory of 996	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	28
PID 1480 wrote to memory of 996	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	28
PID 1480 wrote to memory of 996	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	28
PID 1480 wrote to memory of 1396	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	29
PID 1480 wrote to memory of 1396	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	29
PID 1480 wrote to memory of 1396	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	29
PID 1480 wrote to memory of 1396	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	29
PID 1480 wrote to memory of 1668	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	30
PID 1480 wrote to memory of 1668	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	30
PID 1480 wrote to memory of 1668	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	30
PID 1480 wrote to memory of 1668	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	30
PID 1480 wrote to memory of 1532	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	31
PID 1480 wrote to memory of 1532	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	31
PID 1480 wrote to memory of 1532	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	31
PID 1480 wrote to memory of 1532	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	31
PID 1480 wrote to memory of 1464	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	32
PID 1480 wrote to memory of 1464	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	32
PID 1480 wrote to memory of 1464	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	32
PID 1480 wrote to memory of 1464	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	32
PID 2036 wrote to memory of 584	2036	nEwb0Rn.exe	34
PID 2036 wrote to memory of 584	2036	nEwb0Rn.exe	34
PID 2036 wrote to memory of 584	2036	nEwb0Rn.exe	34
PID 2036 wrote to memory of 584	2036	nEwb0Rn.exe	34
PID 1480 wrote to memory of 920	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	33
PID 1480 wrote to memory of 920	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	33
PID 1480 wrote to memory of 920	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	33
PID 1480 wrote to memory of 920	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	33
PID 2036 wrote to memory of 1252	2036	nEwb0Rn.exe	35
PID 2036 wrote to memory of 1252	2036	nEwb0Rn.exe	35
PID 2036 wrote to memory of 1252	2036	nEwb0Rn.exe	35
PID 2036 wrote to memory of 1252	2036	nEwb0Rn.exe	35
PID 996 wrote to memory of 1596	996	WishfulThinking.exe	36
PID 996 wrote to memory of 1596	996	WishfulThinking.exe	36
PID 996 wrote to memory of 1596	996	WishfulThinking.exe	36
PID 996 wrote to memory of 1596	996	WishfulThinking.exe	36
PID 2036 wrote to memory of 1956	2036	nEwb0Rn.exe	37
PID 2036 wrote to memory of 1956	2036	nEwb0Rn.exe	37
PID 2036 wrote to memory of 1956	2036	nEwb0Rn.exe	37
PID 2036 wrote to memory of 1956	2036	nEwb0Rn.exe	37
PID 1480 wrote to memory of 536	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	38
PID 1480 wrote to memory of 536	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	38
PID 1480 wrote to memory of 536	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	38
PID 1480 wrote to memory of 536	1480	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	38
PID 1396 wrote to memory of 1076	1396	WINLOGON.EXE	40
PID 1396 wrote to memory of 1076	1396	WINLOGON.EXE	40
PID 1396 wrote to memory of 1076	1396	WINLOGON.EXE	40
PID 1396 wrote to memory of 1076	1396	WINLOGON.EXE	40
PID 996 wrote to memory of 1980	996	WishfulThinking.exe	39
PID 996 wrote to memory of 1980	996	WishfulThinking.exe	39
PID 996 wrote to memory of 1980	996	WishfulThinking.exe	39
PID 996 wrote to memory of 1980	996	WishfulThinking.exe	39
PID 2036 wrote to memory of 1112	2036	nEwb0Rn.exe	41
PID 2036 wrote to memory of 1112	2036	nEwb0Rn.exe	41
PID 2036 wrote to memory of 1112	2036	nEwb0Rn.exe	41
PID 2036 wrote to memory of 1112	2036	nEwb0Rn.exe	41
PID 1396 wrote to memory of 1576	1396	WINLOGON.EXE	42
PID 1396 wrote to memory of 1576	1396	WINLOGON.EXE	42
PID 1396 wrote to memory of 1576	1396	WINLOGON.EXE	42
PID 1396 wrote to memory of 1576	1396	WINLOGON.EXE	42

System policy modification 1 TTPs 35 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe

C:\Users\Admin\AppData\Local\Temp\538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
"C:\Users\Admin\AppData\Local\Temp\538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1480
- C:\Windows\nEwb0Rn.exe
  C:\Windows\nEwb0Rn.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Sets file execution options in registry
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2036
- - C:\Windows\nEwb0Rn.exe
    C:\Windows\nEwb0Rn.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:584
- - C:\Windows\SysWOW64\WishfulThinking.exe
    C:\Windows\system32\WishfulThinking.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1252
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1956
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1112
- C:\Windows\SysWOW64\WishfulThinking.exe
  C:\Windows\system32\WishfulThinking.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Sets file execution options in registry
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:996
- - C:\Windows\nEwb0Rn.exe
    C:\Windows\nEwb0Rn.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1596
- - C:\Windows\SysWOW64\WishfulThinking.exe
    C:\Windows\system32\WishfulThinking.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1980
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1808
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:820
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Sets file execution options in registry
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1396
- - C:\Windows\nEwb0Rn.exe
    C:\Windows\nEwb0Rn.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1076
- - C:\Windows\SysWOW64\WishfulThinking.exe
    C:\Windows\system32\WishfulThinking.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1576
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1320
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1828
- C:\Windows\nEwb0Rn.exe
  C:\Windows\nEwb0Rn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1668
- C:\Windows\SysWOW64\WishfulThinking.exe
  C:\Windows\system32\WishfulThinking.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:1532
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1464
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Sets file execution options in registry
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:920
- - C:\Windows\nEwb0Rn.exe
    C:\Windows\nEwb0Rn.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1832
- - C:\Windows\SysWOW64\WishfulThinking.exe
    C:\Windows\system32\WishfulThinking.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1820
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:364
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:580
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
fb809839c6e13528b7c9b289d26f2b75

SHA1
61c213be24df0efed36f39d6b1b5ecc8cb6a0b69

SHA256
1614ab0dbd256728f22c08246f3852f4633c49ed0f28fa69a864254af83cc280

SHA512
0b095209f0717c45168e2f3f707936b2650ef4f888a01e5dd1c1a6da95dcd8df77c4074736e3796b53d07ea2ef528074e5796b3d7ea35ba6de323f10f8c319db

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
fb809839c6e13528b7c9b289d26f2b75

SHA1
61c213be24df0efed36f39d6b1b5ecc8cb6a0b69

SHA256
1614ab0dbd256728f22c08246f3852f4633c49ed0f28fa69a864254af83cc280

SHA512
0b095209f0717c45168e2f3f707936b2650ef4f888a01e5dd1c1a6da95dcd8df77c4074736e3796b53d07ea2ef528074e5796b3d7ea35ba6de323f10f8c319db

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
f19ad31e6475e124fcba9f9efcb3b5c7

SHA1
48617c2ff5ef9b1595ae9fcdd3768c36a49ad2a9

SHA256
4480de29e29776ae50c0e4b9b67b78aa3f10ef5162a08666dd9171892409267c

SHA512
516028c4650b0f1fcce670a48ea3fe2fd20a54b7445d9be2f73f80edb26daba32ed2d2998dff74123c95e57ccb05f4278842f2a09bf601e1127d9a31a89c5132

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
f19ad31e6475e124fcba9f9efcb3b5c7

SHA1
48617c2ff5ef9b1595ae9fcdd3768c36a49ad2a9

SHA256
4480de29e29776ae50c0e4b9b67b78aa3f10ef5162a08666dd9171892409267c

SHA512
516028c4650b0f1fcce670a48ea3fe2fd20a54b7445d9be2f73f80edb26daba32ed2d2998dff74123c95e57ccb05f4278842f2a09bf601e1127d9a31a89c5132

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
f19ad31e6475e124fcba9f9efcb3b5c7

SHA1
48617c2ff5ef9b1595ae9fcdd3768c36a49ad2a9

SHA256
4480de29e29776ae50c0e4b9b67b78aa3f10ef5162a08666dd9171892409267c

SHA512
516028c4650b0f1fcce670a48ea3fe2fd20a54b7445d9be2f73f80edb26daba32ed2d2998dff74123c95e57ccb05f4278842f2a09bf601e1127d9a31a89c5132

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

Filesize
52KB

MD5
d4f7f3d7172aeace9ae3f215501b191d

SHA1
30970452322828fd78df58029304a746c9b3349e

SHA256
d1ca6998ad0c6414a80a32957c8c8657d272b44aeb4ae611e6905f4d3d306584

SHA512
8ce7d9871eb5add3a48939e519f61495368f2fd9a662d59422ca0c4abf82d5113a05c334704e1f59f8e410e97af11fbc89f672d15859987b8a5a91f5de2fda60

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

Filesize
52KB

MD5
84bcef913c308c7d37e968b58e2c76da

SHA1
46707ba2235f16eb40952edb0c369b3efbf5747a

SHA256
61846765b6ebb82b0857babda77c372de70480ab9395a0cd56785c29b17ab631

SHA512
a9e69a485cb5dea8e2bae76536f83f50e13859f1f2e07fad86808fffdb29ac68a130309c4b2d09eaa77e29b2d35c331ec1e50cb0c579bba240e866938a17faf8

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

Filesize
52KB

MD5
f19ad31e6475e124fcba9f9efcb3b5c7

SHA1
48617c2ff5ef9b1595ae9fcdd3768c36a49ad2a9

SHA256
4480de29e29776ae50c0e4b9b67b78aa3f10ef5162a08666dd9171892409267c

SHA512
516028c4650b0f1fcce670a48ea3fe2fd20a54b7445d9be2f73f80edb26daba32ed2d2998dff74123c95e57ccb05f4278842f2a09bf601e1127d9a31a89c5132

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

Filesize
52KB

MD5
d4f7f3d7172aeace9ae3f215501b191d

SHA1
30970452322828fd78df58029304a746c9b3349e

SHA256
d1ca6998ad0c6414a80a32957c8c8657d272b44aeb4ae611e6905f4d3d306584

SHA512
8ce7d9871eb5add3a48939e519f61495368f2fd9a662d59422ca0c4abf82d5113a05c334704e1f59f8e410e97af11fbc89f672d15859987b8a5a91f5de2fda60

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

Filesize
52KB

MD5
84bcef913c308c7d37e968b58e2c76da

SHA1
46707ba2235f16eb40952edb0c369b3efbf5747a

SHA256
61846765b6ebb82b0857babda77c372de70480ab9395a0cd56785c29b17ab631

SHA512
a9e69a485cb5dea8e2bae76536f83f50e13859f1f2e07fad86808fffdb29ac68a130309c4b2d09eaa77e29b2d35c331ec1e50cb0c579bba240e866938a17faf8

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

Filesize
52KB

MD5
f19ad31e6475e124fcba9f9efcb3b5c7

SHA1
48617c2ff5ef9b1595ae9fcdd3768c36a49ad2a9

SHA256
4480de29e29776ae50c0e4b9b67b78aa3f10ef5162a08666dd9171892409267c

SHA512
516028c4650b0f1fcce670a48ea3fe2fd20a54b7445d9be2f73f80edb26daba32ed2d2998dff74123c95e57ccb05f4278842f2a09bf601e1127d9a31a89c5132

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
3b93861d22463dc8cd4b8ad9b710fce7

SHA1
e9f22bb0a1ab79a7a7c687fa9531e8b81ff9493f

SHA256
878ec32d471d349ec80f61530218553c09a34dca726b733f269d12ebe0a5c73e

SHA512
3485de6322c0d2f4586873fa17bd737c3d21fed0db42da1b753daa57cce8ddb6ce40f40bdcce24ebbd223e8d045e9cf8b3759e8122e6edf24b1cc71033f1522a

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
fb809839c6e13528b7c9b289d26f2b75

SHA1
61c213be24df0efed36f39d6b1b5ecc8cb6a0b69

SHA256
1614ab0dbd256728f22c08246f3852f4633c49ed0f28fa69a864254af83cc280

SHA512
0b095209f0717c45168e2f3f707936b2650ef4f888a01e5dd1c1a6da95dcd8df77c4074736e3796b53d07ea2ef528074e5796b3d7ea35ba6de323f10f8c319db

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

Filesize
52KB

MD5
d4f7f3d7172aeace9ae3f215501b191d

SHA1
30970452322828fd78df58029304a746c9b3349e

SHA256
d1ca6998ad0c6414a80a32957c8c8657d272b44aeb4ae611e6905f4d3d306584

SHA512
8ce7d9871eb5add3a48939e519f61495368f2fd9a662d59422ca0c4abf82d5113a05c334704e1f59f8e410e97af11fbc89f672d15859987b8a5a91f5de2fda60

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

Filesize
52KB

MD5
84bcef913c308c7d37e968b58e2c76da

SHA1
46707ba2235f16eb40952edb0c369b3efbf5747a

SHA256
61846765b6ebb82b0857babda77c372de70480ab9395a0cd56785c29b17ab631

SHA512
a9e69a485cb5dea8e2bae76536f83f50e13859f1f2e07fad86808fffdb29ac68a130309c4b2d09eaa77e29b2d35c331ec1e50cb0c579bba240e866938a17faf8

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

Filesize
52KB

MD5
f19ad31e6475e124fcba9f9efcb3b5c7

SHA1
48617c2ff5ef9b1595ae9fcdd3768c36a49ad2a9

SHA256
4480de29e29776ae50c0e4b9b67b78aa3f10ef5162a08666dd9171892409267c

SHA512
516028c4650b0f1fcce670a48ea3fe2fd20a54b7445d9be2f73f80edb26daba32ed2d2998dff74123c95e57ccb05f4278842f2a09bf601e1127d9a31a89c5132

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
f19ad31e6475e124fcba9f9efcb3b5c7

SHA1
48617c2ff5ef9b1595ae9fcdd3768c36a49ad2a9

SHA256
4480de29e29776ae50c0e4b9b67b78aa3f10ef5162a08666dd9171892409267c

SHA512
516028c4650b0f1fcce670a48ea3fe2fd20a54b7445d9be2f73f80edb26daba32ed2d2998dff74123c95e57ccb05f4278842f2a09bf601e1127d9a31a89c5132

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
d2b9f3c674c9bd46b01732def642950e

SHA1
640ae9319cdcd8d9e2d79534cbcebdd042e17ed9

SHA256
741ff96c92636ce9a3015eb917d9e925db0e74830dc0e449dd84936da28f8413

SHA512
7fd053d5b6f14874c82ba0e203458add84a82e6d64418ef0a77fd3679e644aca7382883f6c7b931cdc61a0d2c0c576ac846594d7c72983bfe514c6133250404b

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
84bcef913c308c7d37e968b58e2c76da

SHA1
46707ba2235f16eb40952edb0c369b3efbf5747a

SHA256
61846765b6ebb82b0857babda77c372de70480ab9395a0cd56785c29b17ab631

SHA512
a9e69a485cb5dea8e2bae76536f83f50e13859f1f2e07fad86808fffdb29ac68a130309c4b2d09eaa77e29b2d35c331ec1e50cb0c579bba240e866938a17faf8

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
435f34858ccf388ea22eceb3bcfa998e

SHA1
a9864bba5aaebc060a1a92730bbfa55cc752c99a

SHA256
4ec52e5b02cea96327635b8cfa971b56eca70192b3f638521cc4009d982e1f44

SHA512
5873f40ae00475b0fe88d488f094b1cb7ecbc74f535ecf6440f28f95b46bf306d712c448dfde85bde6278e1317163f8d85f9208a0cdfc9f2fd22f593201b466c

Download Submit
C:\Windows\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
1e9d96c6ec97454a44869ae4558c92b1

SHA1
ed91fb75ba98ad275d813f3fe6ce63bb165f3099

SHA256
07b3d30b4c50807deccc2d6650d58f82e6dc5f57f882fdaf22459238533e4ae7

SHA512
55e085efb09407f3979ea481a618f680b2862bfda5361c2c20321aedc4499ae35ea284e21d743adfe0e4e2d34d0e2585429f916608adb34f27d32ef8871706ab

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
84bcef913c308c7d37e968b58e2c76da

SHA1
46707ba2235f16eb40952edb0c369b3efbf5747a

SHA256
61846765b6ebb82b0857babda77c372de70480ab9395a0cd56785c29b17ab631

SHA512
a9e69a485cb5dea8e2bae76536f83f50e13859f1f2e07fad86808fffdb29ac68a130309c4b2d09eaa77e29b2d35c331ec1e50cb0c579bba240e866938a17faf8

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
014a40ab7052908d58e3c978286ce8a1

SHA1
a8871f1d15e87209299f8e69c88817dd0db85502

SHA256
71132df082236e30e960786437c5042400da8be6af7c57348ac2c978765b1c01

SHA512
a4566666d30273669b22f0dd84cb4f842ef4f7c2f64de907e7064ccc2921c39d3a5b56cd477e9e2ee922222f0d318a11917fe841a97fdfd01226f6b52a3d1dc4

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
004e9d528a683ab23a65d8e468812de5

SHA1
03a6bf468b5a2082f76f69f198762f983c02ead2

SHA256
44f2976c214472e4ddbd4272ea57b109b32ba5cb16aeeb6b5a5d9479a17bb5fb

SHA512
e1da5fbcaa740e6478e2230ba1bcd4b8e0705b181b7b3ba80236372fe129213ec8bc937d11ca8afe448a666dc403aa446d27281d175a11a7dfceae229c3e3d43

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
84bcef913c308c7d37e968b58e2c76da

SHA1
46707ba2235f16eb40952edb0c369b3efbf5747a

SHA256
61846765b6ebb82b0857babda77c372de70480ab9395a0cd56785c29b17ab631

SHA512
a9e69a485cb5dea8e2bae76536f83f50e13859f1f2e07fad86808fffdb29ac68a130309c4b2d09eaa77e29b2d35c331ec1e50cb0c579bba240e866938a17faf8

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
beb8665cec8cc2eff5092b66be9862e0

SHA1
6808af243dff30c7c6494340e65b10125125d045

SHA256
0e29c484d1570e5c145825ef2ba256fde91d31326a59d191405c5365859f1b76

SHA512
90b34288447accce48808e11bf64bd2a907457f1794eb5687a3412c42f7a44871829bd3ebd4d7c23b4c73651be91ba8581d2ece2b45054b69dbdea1c0d4e6097

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
84bcef913c308c7d37e968b58e2c76da

SHA1
46707ba2235f16eb40952edb0c369b3efbf5747a

SHA256
61846765b6ebb82b0857babda77c372de70480ab9395a0cd56785c29b17ab631

SHA512
a9e69a485cb5dea8e2bae76536f83f50e13859f1f2e07fad86808fffdb29ac68a130309c4b2d09eaa77e29b2d35c331ec1e50cb0c579bba240e866938a17faf8

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
84bcef913c308c7d37e968b58e2c76da

SHA1
46707ba2235f16eb40952edb0c369b3efbf5747a

SHA256
61846765b6ebb82b0857babda77c372de70480ab9395a0cd56785c29b17ab631

SHA512
a9e69a485cb5dea8e2bae76536f83f50e13859f1f2e07fad86808fffdb29ac68a130309c4b2d09eaa77e29b2d35c331ec1e50cb0c579bba240e866938a17faf8

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
84bcef913c308c7d37e968b58e2c76da

SHA1
46707ba2235f16eb40952edb0c369b3efbf5747a

SHA256
61846765b6ebb82b0857babda77c372de70480ab9395a0cd56785c29b17ab631

SHA512
a9e69a485cb5dea8e2bae76536f83f50e13859f1f2e07fad86808fffdb29ac68a130309c4b2d09eaa77e29b2d35c331ec1e50cb0c579bba240e866938a17faf8

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
84bcef913c308c7d37e968b58e2c76da

SHA1
46707ba2235f16eb40952edb0c369b3efbf5747a

SHA256
61846765b6ebb82b0857babda77c372de70480ab9395a0cd56785c29b17ab631

SHA512
a9e69a485cb5dea8e2bae76536f83f50e13859f1f2e07fad86808fffdb29ac68a130309c4b2d09eaa77e29b2d35c331ec1e50cb0c579bba240e866938a17faf8

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
84bcef913c308c7d37e968b58e2c76da

SHA1
46707ba2235f16eb40952edb0c369b3efbf5747a

SHA256
61846765b6ebb82b0857babda77c372de70480ab9395a0cd56785c29b17ab631

SHA512
a9e69a485cb5dea8e2bae76536f83f50e13859f1f2e07fad86808fffdb29ac68a130309c4b2d09eaa77e29b2d35c331ec1e50cb0c579bba240e866938a17faf8

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
d4f7f3d7172aeace9ae3f215501b191d

SHA1
30970452322828fd78df58029304a746c9b3349e

SHA256
d1ca6998ad0c6414a80a32957c8c8657d272b44aeb4ae611e6905f4d3d306584

SHA512
8ce7d9871eb5add3a48939e519f61495368f2fd9a662d59422ca0c4abf82d5113a05c334704e1f59f8e410e97af11fbc89f672d15859987b8a5a91f5de2fda60

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
d4f7f3d7172aeace9ae3f215501b191d

SHA1
30970452322828fd78df58029304a746c9b3349e

SHA256
d1ca6998ad0c6414a80a32957c8c8657d272b44aeb4ae611e6905f4d3d306584

SHA512
8ce7d9871eb5add3a48939e519f61495368f2fd9a662d59422ca0c4abf82d5113a05c334704e1f59f8e410e97af11fbc89f672d15859987b8a5a91f5de2fda60

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
d4f7f3d7172aeace9ae3f215501b191d

SHA1
30970452322828fd78df58029304a746c9b3349e

SHA256
d1ca6998ad0c6414a80a32957c8c8657d272b44aeb4ae611e6905f4d3d306584

SHA512
8ce7d9871eb5add3a48939e519f61495368f2fd9a662d59422ca0c4abf82d5113a05c334704e1f59f8e410e97af11fbc89f672d15859987b8a5a91f5de2fda60

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
d4f7f3d7172aeace9ae3f215501b191d

SHA1
30970452322828fd78df58029304a746c9b3349e

SHA256
d1ca6998ad0c6414a80a32957c8c8657d272b44aeb4ae611e6905f4d3d306584

SHA512
8ce7d9871eb5add3a48939e519f61495368f2fd9a662d59422ca0c4abf82d5113a05c334704e1f59f8e410e97af11fbc89f672d15859987b8a5a91f5de2fda60

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
d4f7f3d7172aeace9ae3f215501b191d

SHA1
30970452322828fd78df58029304a746c9b3349e

SHA256
d1ca6998ad0c6414a80a32957c8c8657d272b44aeb4ae611e6905f4d3d306584

SHA512
8ce7d9871eb5add3a48939e519f61495368f2fd9a662d59422ca0c4abf82d5113a05c334704e1f59f8e410e97af11fbc89f672d15859987b8a5a91f5de2fda60

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
d4f7f3d7172aeace9ae3f215501b191d

SHA1
30970452322828fd78df58029304a746c9b3349e

SHA256
d1ca6998ad0c6414a80a32957c8c8657d272b44aeb4ae611e6905f4d3d306584

SHA512
8ce7d9871eb5add3a48939e519f61495368f2fd9a662d59422ca0c4abf82d5113a05c334704e1f59f8e410e97af11fbc89f672d15859987b8a5a91f5de2fda60

Download Submit
C:\about.htm

Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\about.htm

Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\about.htm

Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
d4f7f3d7172aeace9ae3f215501b191d

SHA1
30970452322828fd78df58029304a746c9b3349e

SHA256
d1ca6998ad0c6414a80a32957c8c8657d272b44aeb4ae611e6905f4d3d306584

SHA512
8ce7d9871eb5add3a48939e519f61495368f2fd9a662d59422ca0c4abf82d5113a05c334704e1f59f8e410e97af11fbc89f672d15859987b8a5a91f5de2fda60

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
84bcef913c308c7d37e968b58e2c76da

SHA1
46707ba2235f16eb40952edb0c369b3efbf5747a

SHA256
61846765b6ebb82b0857babda77c372de70480ab9395a0cd56785c29b17ab631

SHA512
a9e69a485cb5dea8e2bae76536f83f50e13859f1f2e07fad86808fffdb29ac68a130309c4b2d09eaa77e29b2d35c331ec1e50cb0c579bba240e866938a17faf8

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
f19ad31e6475e124fcba9f9efcb3b5c7

SHA1
48617c2ff5ef9b1595ae9fcdd3768c36a49ad2a9

SHA256
4480de29e29776ae50c0e4b9b67b78aa3f10ef5162a08666dd9171892409267c

SHA512
516028c4650b0f1fcce670a48ea3fe2fd20a54b7445d9be2f73f80edb26daba32ed2d2998dff74123c95e57ccb05f4278842f2a09bf601e1127d9a31a89c5132

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
fb809839c6e13528b7c9b289d26f2b75

SHA1
61c213be24df0efed36f39d6b1b5ecc8cb6a0b69

SHA256
1614ab0dbd256728f22c08246f3852f4633c49ed0f28fa69a864254af83cc280

SHA512
0b095209f0717c45168e2f3f707936b2650ef4f888a01e5dd1c1a6da95dcd8df77c4074736e3796b53d07ea2ef528074e5796b3d7ea35ba6de323f10f8c319db

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
fb809839c6e13528b7c9b289d26f2b75

SHA1
61c213be24df0efed36f39d6b1b5ecc8cb6a0b69

SHA256
1614ab0dbd256728f22c08246f3852f4633c49ed0f28fa69a864254af83cc280

SHA512
0b095209f0717c45168e2f3f707936b2650ef4f888a01e5dd1c1a6da95dcd8df77c4074736e3796b53d07ea2ef528074e5796b3d7ea35ba6de323f10f8c319db

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
fb809839c6e13528b7c9b289d26f2b75

SHA1
61c213be24df0efed36f39d6b1b5ecc8cb6a0b69

SHA256
1614ab0dbd256728f22c08246f3852f4633c49ed0f28fa69a864254af83cc280

SHA512
0b095209f0717c45168e2f3f707936b2650ef4f888a01e5dd1c1a6da95dcd8df77c4074736e3796b53d07ea2ef528074e5796b3d7ea35ba6de323f10f8c319db

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
fb809839c6e13528b7c9b289d26f2b75

SHA1
61c213be24df0efed36f39d6b1b5ecc8cb6a0b69

SHA256
1614ab0dbd256728f22c08246f3852f4633c49ed0f28fa69a864254af83cc280

SHA512
0b095209f0717c45168e2f3f707936b2650ef4f888a01e5dd1c1a6da95dcd8df77c4074736e3796b53d07ea2ef528074e5796b3d7ea35ba6de323f10f8c319db

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
fb809839c6e13528b7c9b289d26f2b75

SHA1
61c213be24df0efed36f39d6b1b5ecc8cb6a0b69

SHA256
1614ab0dbd256728f22c08246f3852f4633c49ed0f28fa69a864254af83cc280

SHA512
0b095209f0717c45168e2f3f707936b2650ef4f888a01e5dd1c1a6da95dcd8df77c4074736e3796b53d07ea2ef528074e5796b3d7ea35ba6de323f10f8c319db

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
fb809839c6e13528b7c9b289d26f2b75

SHA1
61c213be24df0efed36f39d6b1b5ecc8cb6a0b69

SHA256
1614ab0dbd256728f22c08246f3852f4633c49ed0f28fa69a864254af83cc280

SHA512
0b095209f0717c45168e2f3f707936b2650ef4f888a01e5dd1c1a6da95dcd8df77c4074736e3796b53d07ea2ef528074e5796b3d7ea35ba6de323f10f8c319db

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
f19ad31e6475e124fcba9f9efcb3b5c7

SHA1
48617c2ff5ef9b1595ae9fcdd3768c36a49ad2a9

SHA256
4480de29e29776ae50c0e4b9b67b78aa3f10ef5162a08666dd9171892409267c

SHA512
516028c4650b0f1fcce670a48ea3fe2fd20a54b7445d9be2f73f80edb26daba32ed2d2998dff74123c95e57ccb05f4278842f2a09bf601e1127d9a31a89c5132

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
f19ad31e6475e124fcba9f9efcb3b5c7

SHA1
48617c2ff5ef9b1595ae9fcdd3768c36a49ad2a9

SHA256
4480de29e29776ae50c0e4b9b67b78aa3f10ef5162a08666dd9171892409267c

SHA512
516028c4650b0f1fcce670a48ea3fe2fd20a54b7445d9be2f73f80edb26daba32ed2d2998dff74123c95e57ccb05f4278842f2a09bf601e1127d9a31a89c5132

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
f19ad31e6475e124fcba9f9efcb3b5c7

SHA1
48617c2ff5ef9b1595ae9fcdd3768c36a49ad2a9

SHA256
4480de29e29776ae50c0e4b9b67b78aa3f10ef5162a08666dd9171892409267c

SHA512
516028c4650b0f1fcce670a48ea3fe2fd20a54b7445d9be2f73f80edb26daba32ed2d2998dff74123c95e57ccb05f4278842f2a09bf601e1127d9a31a89c5132

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
f19ad31e6475e124fcba9f9efcb3b5c7

SHA1
48617c2ff5ef9b1595ae9fcdd3768c36a49ad2a9

SHA256
4480de29e29776ae50c0e4b9b67b78aa3f10ef5162a08666dd9171892409267c

SHA512
516028c4650b0f1fcce670a48ea3fe2fd20a54b7445d9be2f73f80edb26daba32ed2d2998dff74123c95e57ccb05f4278842f2a09bf601e1127d9a31a89c5132

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
f19ad31e6475e124fcba9f9efcb3b5c7

SHA1
48617c2ff5ef9b1595ae9fcdd3768c36a49ad2a9

SHA256
4480de29e29776ae50c0e4b9b67b78aa3f10ef5162a08666dd9171892409267c

SHA512
516028c4650b0f1fcce670a48ea3fe2fd20a54b7445d9be2f73f80edb26daba32ed2d2998dff74123c95e57ccb05f4278842f2a09bf601e1127d9a31a89c5132

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
f19ad31e6475e124fcba9f9efcb3b5c7

SHA1
48617c2ff5ef9b1595ae9fcdd3768c36a49ad2a9

SHA256
4480de29e29776ae50c0e4b9b67b78aa3f10ef5162a08666dd9171892409267c

SHA512
516028c4650b0f1fcce670a48ea3fe2fd20a54b7445d9be2f73f80edb26daba32ed2d2998dff74123c95e57ccb05f4278842f2a09bf601e1127d9a31a89c5132

Download Submit
\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
84bcef913c308c7d37e968b58e2c76da

SHA1
46707ba2235f16eb40952edb0c369b3efbf5747a

SHA256
61846765b6ebb82b0857babda77c372de70480ab9395a0cd56785c29b17ab631

SHA512
a9e69a485cb5dea8e2bae76536f83f50e13859f1f2e07fad86808fffdb29ac68a130309c4b2d09eaa77e29b2d35c331ec1e50cb0c579bba240e866938a17faf8

Download Submit
\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
84bcef913c308c7d37e968b58e2c76da

SHA1
46707ba2235f16eb40952edb0c369b3efbf5747a

SHA256
61846765b6ebb82b0857babda77c372de70480ab9395a0cd56785c29b17ab631

SHA512
a9e69a485cb5dea8e2bae76536f83f50e13859f1f2e07fad86808fffdb29ac68a130309c4b2d09eaa77e29b2d35c331ec1e50cb0c579bba240e866938a17faf8

Download Submit
\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
84bcef913c308c7d37e968b58e2c76da

SHA1
46707ba2235f16eb40952edb0c369b3efbf5747a

SHA256
61846765b6ebb82b0857babda77c372de70480ab9395a0cd56785c29b17ab631

SHA512
a9e69a485cb5dea8e2bae76536f83f50e13859f1f2e07fad86808fffdb29ac68a130309c4b2d09eaa77e29b2d35c331ec1e50cb0c579bba240e866938a17faf8

Download Submit
\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
84bcef913c308c7d37e968b58e2c76da

SHA1
46707ba2235f16eb40952edb0c369b3efbf5747a

SHA256
61846765b6ebb82b0857babda77c372de70480ab9395a0cd56785c29b17ab631

SHA512
a9e69a485cb5dea8e2bae76536f83f50e13859f1f2e07fad86808fffdb29ac68a130309c4b2d09eaa77e29b2d35c331ec1e50cb0c579bba240e866938a17faf8

Download Submit
\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
84bcef913c308c7d37e968b58e2c76da

SHA1
46707ba2235f16eb40952edb0c369b3efbf5747a

SHA256
61846765b6ebb82b0857babda77c372de70480ab9395a0cd56785c29b17ab631

SHA512
a9e69a485cb5dea8e2bae76536f83f50e13859f1f2e07fad86808fffdb29ac68a130309c4b2d09eaa77e29b2d35c331ec1e50cb0c579bba240e866938a17faf8

Download Submit
\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
84bcef913c308c7d37e968b58e2c76da

SHA1
46707ba2235f16eb40952edb0c369b3efbf5747a

SHA256
61846765b6ebb82b0857babda77c372de70480ab9395a0cd56785c29b17ab631

SHA512
a9e69a485cb5dea8e2bae76536f83f50e13859f1f2e07fad86808fffdb29ac68a130309c4b2d09eaa77e29b2d35c331ec1e50cb0c579bba240e866938a17faf8

Download Submit
\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
84bcef913c308c7d37e968b58e2c76da

SHA1
46707ba2235f16eb40952edb0c369b3efbf5747a

SHA256
61846765b6ebb82b0857babda77c372de70480ab9395a0cd56785c29b17ab631

SHA512
a9e69a485cb5dea8e2bae76536f83f50e13859f1f2e07fad86808fffdb29ac68a130309c4b2d09eaa77e29b2d35c331ec1e50cb0c579bba240e866938a17faf8

Download Submit
\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
84bcef913c308c7d37e968b58e2c76da

SHA1
46707ba2235f16eb40952edb0c369b3efbf5747a

SHA256
61846765b6ebb82b0857babda77c372de70480ab9395a0cd56785c29b17ab631

SHA512
a9e69a485cb5dea8e2bae76536f83f50e13859f1f2e07fad86808fffdb29ac68a130309c4b2d09eaa77e29b2d35c331ec1e50cb0c579bba240e866938a17faf8

Download Submit
memory/364-230-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/364-224-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/536-176-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/580-234-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/584-128-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/820-215-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/920-195-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/920-228-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/996-193-0x0000000000430000-0x0000000000458000-memory.dmp

Filesize
160KB

Download
memory/996-72-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/996-226-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1076-183-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1112-187-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1252-139-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1320-202-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1396-219-0x0000000001E90000-0x0000000001EB8000-memory.dmp

Filesize
160KB

Download
memory/1396-192-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1396-227-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1464-113-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1480-180-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1480-68-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1480-56-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/1480-70-0x0000000002760000-0x0000000002788000-memory.dmp

Filesize
160KB

Download
memory/1480-69-0x0000000002760000-0x0000000002788000-memory.dmp

Filesize
160KB

Download
memory/1532-94-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1576-191-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1576-197-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1596-181-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1668-86-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1808-204-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1820-220-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1820-229-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1828-216-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1832-213-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1956-171-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1980-190-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2036-225-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2036-198-0x0000000001CA0000-0x0000000001CC8000-memory.dmp

Filesize
160KB

Download
memory/2036-71-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download