538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff

Analysis

max time kernel
150s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Size

52KB
MD5

00d73f9d1b03a5234c05f949827c57b1
SHA1

2db7927595ff634da638c1b0438f98a77f789baa
SHA256

538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff
SHA512

f25578eb6a003a37d93b0b95970836c2fe52f9256243057fa55e26ce4886c1b01c408d5409d533a022db2ff8f81352eda7f3469f1b37cbac999405ff66918a3e
SSDEEP

768:d+ciLamXW9XgMxjFkpvMVX8q18q13yO1+33j5n/w25kfw:IzaEW5gMxZVXf8a3yO10pwk

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 10 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	nEwb0Rn.exe

Modifies system executable filetype association 2 TTPs 62 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WINLOGON.EXE

Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WINLOGON.EXE

Modifies visiblity of hidden/system files in Explorer 2 TTPs 5 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WishfulThinking.exe

Windows security bypass 2 TTPs 25 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	nEwb0Rn.exe

Blocks application from running via registry modification 30 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe

Disables RegEdit via registry modification 10 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 24 IoCs

pid	Process
4928	nEwb0Rn.exe
4820	WishfulThinking.exe
1324	nEwb0Rn.exe
1580	WishfulThinking.exe
3488	WINLOGON.EXE
1660	nEwb0Rn.exe
3808	nEwb0Rn.exe
4684	WishfulThinking.exe
3056	SERVICES.EXE
4532	WishfulThinking.exe
336	WINLOGON.EXE
4240	WINLOGON.EXE
544	SERVICES.EXE
2948	SERVICES.EXE
440	WINLOGON.EXE
392	nEwb0Rn.exe
1168	SERVICES.EXE
3256	WishfulThinking.exe
1732	WINLOGON.EXE
2820	nEwb0Rn.exe
2864	WishfulThinking.exe
4516	SERVICES.EXE
5080	WINLOGON.EXE
4668	SERVICES.EXE

Sets file execution options in registry 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	WINLOGON.EXE

Loads dropped DLL 5 IoCs

pid	Process
1324	nEwb0Rn.exe
1660	nEwb0Rn.exe
3808	nEwb0Rn.exe
392	nEwb0Rn.exe
2820	nEwb0Rn.exe

Windows security modification 2 TTPs 30 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	SERVICES.EXE

Adds Run key to start application 2 TTPs 25 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	WINLOGON.EXE

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File created	C:\desktop.ini	WishfulThinking.exe
File opened for modification	C:\desktop.ini	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File created	C:\desktop.ini	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened for modification	C:\desktop.ini	nEwb0Rn.exe
File created	C:\desktop.ini	nEwb0Rn.exe
File opened for modification	C:\desktop.ini	WishfulThinking.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\V:	WINLOGON.EXE
File opened (read-only)	\??\Q:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\O:	nEwb0Rn.exe
File opened (read-only)	\??\Q:	nEwb0Rn.exe
File opened (read-only)	\??\M:	nEwb0Rn.exe
File opened (read-only)	\??\Q:	WishfulThinking.exe
File opened (read-only)	\??\S:	SERVICES.EXE
File opened (read-only)	\??\J:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\N:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\V:	nEwb0Rn.exe
File opened (read-only)	\??\E:	WishfulThinking.exe
File opened (read-only)	\??\X:	WishfulThinking.exe
File opened (read-only)	\??\K:	WINLOGON.EXE
File opened (read-only)	\??\W:	nEwb0Rn.exe
File opened (read-only)	\??\J:	WINLOGON.EXE
File opened (read-only)	\??\W:	WINLOGON.EXE
File opened (read-only)	\??\S:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\X:	nEwb0Rn.exe
File opened (read-only)	\??\L:	WishfulThinking.exe
File opened (read-only)	\??\P:	WINLOGON.EXE
File opened (read-only)	\??\S:	WINLOGON.EXE
File opened (read-only)	\??\I:	WINLOGON.EXE
File opened (read-only)	\??\H:	SERVICES.EXE
File opened (read-only)	\??\K:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\Y:	nEwb0Rn.exe
File opened (read-only)	\??\R:	WINLOGON.EXE
File opened (read-only)	\??\B:	SERVICES.EXE
File opened (read-only)	\??\F:	SERVICES.EXE
File opened (read-only)	\??\I:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\B:	nEwb0Rn.exe
File opened (read-only)	\??\E:	nEwb0Rn.exe
File opened (read-only)	\??\L:	nEwb0Rn.exe
File opened (read-only)	\??\Z:	WINLOGON.EXE
File opened (read-only)	\??\K:	SERVICES.EXE
File opened (read-only)	\??\O:	SERVICES.EXE
File opened (read-only)	\??\L:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\T:	nEwb0Rn.exe
File opened (read-only)	\??\G:	WINLOGON.EXE
File opened (read-only)	\??\Z:	SERVICES.EXE
File opened (read-only)	\??\Z:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\J:	WishfulThinking.exe
File opened (read-only)	\??\N:	WishfulThinking.exe
File opened (read-only)	\??\U:	WishfulThinking.exe
File opened (read-only)	\??\I:	SERVICES.EXE
File opened (read-only)	\??\U:	SERVICES.EXE
File opened (read-only)	\??\H:	nEwb0Rn.exe
File opened (read-only)	\??\M:	WINLOGON.EXE
File opened (read-only)	\??\Y:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\N:	nEwb0Rn.exe
File opened (read-only)	\??\H:	WINLOGON.EXE
File opened (read-only)	\??\F:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\F:	nEwb0Rn.exe
File opened (read-only)	\??\U:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\O:	WishfulThinking.exe
File opened (read-only)	\??\Q:	WINLOGON.EXE
File opened (read-only)	\??\Y:	WINLOGON.EXE
File opened (read-only)	\??\W:	SERVICES.EXE
File opened (read-only)	\??\Y:	SERVICES.EXE
File opened (read-only)	\??\B:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened (read-only)	\??\K:	WishfulThinking.exe
File opened (read-only)	\??\M:	SERVICES.EXE
File opened (read-only)	\??\X:	SERVICES.EXE
File opened (read-only)	\??\E:	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	WishfulThinking.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	WINLOGON.EXE
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\DamageControl.scr	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	nEwb0Rn.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	nEwb0Rn.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	SERVICES.EXE
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	WINLOGON.EXE
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	SERVICES.EXE
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	SERVICES.EXE
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	WINLOGON.EXE
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File created	C:\Windows\SysWOW64\JawsOfLife.exe	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	SERVICES.EXE
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	WINLOGON.EXE

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\nEwb0Rn.exe	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\nEwb0Rn.exe	WINLOGON.EXE
File created	C:\Windows\nEwb0Rn.exe	SERVICES.EXE
File created	C:\Windows\nEwb0Rn.exe	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	nEwb0Rn.exe
File created	C:\Windows\nEwb0Rn.exe	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	WishfulThinking.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	WINLOGON.EXE
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\nEwb0Rn.exe	nEwb0Rn.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	SERVICES.EXE
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe

Modifies Control Panel 45 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\AutoEndTasks = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Animate"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\AutoEndTasks = "1"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Animate"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Inanimate"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Inanimate"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Animate"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\AutoEndTasks = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Animate"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Inanimate"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Inanimate"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\AutoEndTasks = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s1159 = "Inanimate"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\s2359 = "Animate"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\AutoEndTasks = "1"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\	SERVICES.EXE

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	nEwb0Rn.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	WINLOGON.EXE
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WishfulThinking.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	SERVICES.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
4928	nEwb0Rn.exe
3488	WINLOGON.EXE
4820	WishfulThinking.exe
3056	SERVICES.EXE

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
4928	nEwb0Rn.exe
4820	WishfulThinking.exe
1324	nEwb0Rn.exe
1580	WishfulThinking.exe
3488	WINLOGON.EXE
1660	nEwb0Rn.exe
3808	nEwb0Rn.exe
4684	WishfulThinking.exe
3056	SERVICES.EXE
4532	WishfulThinking.exe
336	WINLOGON.EXE
4240	WINLOGON.EXE
544	SERVICES.EXE
2948	SERVICES.EXE
440	WINLOGON.EXE
392	nEwb0Rn.exe
1168	SERVICES.EXE
3256	WishfulThinking.exe
1732	WINLOGON.EXE
2820	nEwb0Rn.exe
4516	SERVICES.EXE
2864	WishfulThinking.exe
5080	WINLOGON.EXE
4668	SERVICES.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4928	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	80
PID 4960 wrote to memory of 4928	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	80
PID 4960 wrote to memory of 4928	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	80
PID 4960 wrote to memory of 4820	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	81
PID 4960 wrote to memory of 4820	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	81
PID 4960 wrote to memory of 4820	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	81
PID 4960 wrote to memory of 1324	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	82
PID 4960 wrote to memory of 1324	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	82
PID 4960 wrote to memory of 1324	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	82
PID 4960 wrote to memory of 1580	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	83
PID 4960 wrote to memory of 1580	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	83
PID 4960 wrote to memory of 1580	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	83
PID 4960 wrote to memory of 3488	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	84
PID 4960 wrote to memory of 3488	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	84
PID 4960 wrote to memory of 3488	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	84
PID 4928 wrote to memory of 1660	4928	nEwb0Rn.exe	85
PID 4928 wrote to memory of 1660	4928	nEwb0Rn.exe	85
PID 4928 wrote to memory of 1660	4928	nEwb0Rn.exe	85
PID 4820 wrote to memory of 3808	4820	WishfulThinking.exe	86
PID 4820 wrote to memory of 3808	4820	WishfulThinking.exe	86
PID 4820 wrote to memory of 3808	4820	WishfulThinking.exe	86
PID 4928 wrote to memory of 4684	4928	nEwb0Rn.exe	87
PID 4928 wrote to memory of 4684	4928	nEwb0Rn.exe	87
PID 4928 wrote to memory of 4684	4928	nEwb0Rn.exe	87
PID 4960 wrote to memory of 3056	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	88
PID 4960 wrote to memory of 3056	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	88
PID 4960 wrote to memory of 3056	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	88
PID 4820 wrote to memory of 4532	4820	WishfulThinking.exe	89
PID 4820 wrote to memory of 4532	4820	WishfulThinking.exe	89
PID 4820 wrote to memory of 4532	4820	WishfulThinking.exe	89
PID 4928 wrote to memory of 336	4928	nEwb0Rn.exe	90
PID 4928 wrote to memory of 336	4928	nEwb0Rn.exe	90
PID 4928 wrote to memory of 336	4928	nEwb0Rn.exe	90
PID 4820 wrote to memory of 4240	4820	WishfulThinking.exe	91
PID 4820 wrote to memory of 4240	4820	WishfulThinking.exe	91
PID 4820 wrote to memory of 4240	4820	WishfulThinking.exe	91
PID 4928 wrote to memory of 544	4928	nEwb0Rn.exe	92
PID 4928 wrote to memory of 544	4928	nEwb0Rn.exe	92
PID 4928 wrote to memory of 544	4928	nEwb0Rn.exe	92
PID 4820 wrote to memory of 2948	4820	WishfulThinking.exe	93
PID 4820 wrote to memory of 2948	4820	WishfulThinking.exe	93
PID 4820 wrote to memory of 2948	4820	WishfulThinking.exe	93
PID 4960 wrote to memory of 440	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	94
PID 4960 wrote to memory of 440	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	94
PID 4960 wrote to memory of 440	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	94
PID 3488 wrote to memory of 392	3488	WINLOGON.EXE	95
PID 3488 wrote to memory of 392	3488	WINLOGON.EXE	95
PID 3488 wrote to memory of 392	3488	WINLOGON.EXE	95
PID 4960 wrote to memory of 1168	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	96
PID 4960 wrote to memory of 1168	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	96
PID 4960 wrote to memory of 1168	4960	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe	96
PID 3488 wrote to memory of 3256	3488	WINLOGON.EXE	97
PID 3488 wrote to memory of 3256	3488	WINLOGON.EXE	97
PID 3488 wrote to memory of 3256	3488	WINLOGON.EXE	97
PID 3488 wrote to memory of 1732	3488	WINLOGON.EXE	98
PID 3488 wrote to memory of 1732	3488	WINLOGON.EXE	98
PID 3488 wrote to memory of 1732	3488	WINLOGON.EXE	98
PID 3056 wrote to memory of 2820	3056	SERVICES.EXE	99
PID 3056 wrote to memory of 2820	3056	SERVICES.EXE	99
PID 3056 wrote to memory of 2820	3056	SERVICES.EXE	99
PID 3488 wrote to memory of 4516	3488	WINLOGON.EXE	101
PID 3488 wrote to memory of 4516	3488	WINLOGON.EXE	101
PID 3488 wrote to memory of 4516	3488	WINLOGON.EXE	101
PID 3056 wrote to memory of 2864	3056	SERVICES.EXE	100

System policy modification 1 TTPs 35 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	SERVICES.EXE

C:\Users\Admin\AppData\Local\Temp\538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe
"C:\Users\Admin\AppData\Local\Temp\538c32d38eeedf222306181c676fc6b34d00310f76c9ebbca229db59b79d9cff.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Windows security modification
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4960
- C:\Windows\nEwb0Rn.exe
  C:\Windows\nEwb0Rn.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Sets file execution options in registry
  - Windows security modification
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4928
- - C:\Windows\nEwb0Rn.exe
    C:\Windows\nEwb0Rn.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1660
- - C:\Windows\SysWOW64\WishfulThinking.exe
    C:\Windows\system32\WishfulThinking.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:4684
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:336
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:544
- C:\Windows\SysWOW64\WishfulThinking.exe
  C:\Windows\system32\WishfulThinking.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Sets file execution options in registry
  - Windows security modification
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4820
- - C:\Windows\nEwb0Rn.exe
    C:\Windows\nEwb0Rn.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3808
- - C:\Windows\SysWOW64\WishfulThinking.exe
    C:\Windows\system32\WishfulThinking.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:4532
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4240
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2948
- C:\Windows\nEwb0Rn.exe
  C:\Windows\nEwb0Rn.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1324
- C:\Windows\SysWOW64\WishfulThinking.exe
  C:\Windows\system32\WishfulThinking.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:1580
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Sets file execution options in registry
  - Windows security modification
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3488
- - C:\Windows\nEwb0Rn.exe
    C:\Windows\nEwb0Rn.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:392
- - C:\Windows\SysWOW64\WishfulThinking.exe
    C:\Windows\system32\WishfulThinking.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:3256
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1732
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4516
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Sets file execution options in registry
  - Windows security modification
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3056
- - C:\Windows\nEwb0Rn.exe
    C:\Windows\nEwb0Rn.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2820
- - C:\Windows\SysWOW64\WishfulThinking.exe
    C:\Windows\system32\WishfulThinking.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:2864
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5080
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4668
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:440
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Download Admin.exe

Filesize
52KB

MD5
fc253ecefdb1bd3d579c49920f94fbbb

SHA1
8c635f9636b2873626fb98e8e16eb9391ab7fb8e

SHA256
2f92e767a663d421d7545d90da7903410d5abefeddd0238a3ff24c50dda88bb0

SHA512
f561966f05df46bc672acd467176d908c53bf31bc05f87a77391a171c80625e44f86d3381102fce6a2406bf3a6e076cf0510fac384dc191fbcbae23414f63f83

Download Submit
C:\Download Admin.exe

Filesize
52KB

MD5
5f6c7ba319255908ea726ea531663af2

SHA1
dbc2a5a15aee95b9a9b648f8c06a6991fac0a4f9

SHA256
6d3b92568c23a441eb276d372dacf083da0f2cac73d04104f8e0a835b7b25814

SHA512
70fef31274355f835698a07273fc7a3b699ebf0c41b8491f91faa15f0e00ead639a7741a0dba4d8bd073115b4f98d8bc81488939f20d4cfecb6f48145ee936b7

Download Submit
C:\Download Admin.exe

Filesize
52KB

MD5
86c54604a86c8b649464e0f382c69e56

SHA1
76db26e034cf638c69da0737d4491447f695bc85

SHA256
1a647ac689f9b38de72f88f6a351a2991a72902cf7f5f401aa6107b743d82d13

SHA512
4b3ba50b79a4d6bb76b8757cabedab4377a90300b23697a6b1988610a5022dd6f417680d0183eb7fe8477207d8ffe29cadfe3ef90b4d72b02d9754be956cf1cc

Download Submit
C:\MP3[NEW-RELEASE].exe

Filesize
52KB

MD5
242563a198f6a9ac3e63fa223678f178

SHA1
350a804ccf4a3f90acd6fea36c46e6c4f2db382f

SHA256
2e01696c1a3bfc02ecd9e73e06b3bc24ec12de2bb11b7d0aeb56a97ded52efca

SHA512
dde1062368ef5f3d0daaa3f772ea0d4e30e70f23ab699c1d0982d1e861bb2be58139ff2ab4c7cfb5fbb557a9aef19e44b4757a096e297c32cac115fc9c877b5a

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
55851e64ef52985cf52721c59f4e6c85

SHA1
ace4d57662f81002cfc22917f4c906113d4501ab

SHA256
3c35041725a06a48a9d95c44c6353b0f9c3ee402df7c51799264909f7d81423b

SHA512
ae5fdb89ef1e9b70df75f93ef64cc904e13c4b3ba3109481e53133cca0052bd47ca54c9b4e4c77da4830e6d1dfe2fa072a8851833c9d8d102c583a22490814b9

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
55851e64ef52985cf52721c59f4e6c85

SHA1
ace4d57662f81002cfc22917f4c906113d4501ab

SHA256
3c35041725a06a48a9d95c44c6353b0f9c3ee402df7c51799264909f7d81423b

SHA512
ae5fdb89ef1e9b70df75f93ef64cc904e13c4b3ba3109481e53133cca0052bd47ca54c9b4e4c77da4830e6d1dfe2fa072a8851833c9d8d102c583a22490814b9

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
55851e64ef52985cf52721c59f4e6c85

SHA1
ace4d57662f81002cfc22917f4c906113d4501ab

SHA256
3c35041725a06a48a9d95c44c6353b0f9c3ee402df7c51799264909f7d81423b

SHA512
ae5fdb89ef1e9b70df75f93ef64cc904e13c4b3ba3109481e53133cca0052bd47ca54c9b4e4c77da4830e6d1dfe2fa072a8851833c9d8d102c583a22490814b9

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
929f4b0a90eab3b823adbcf11827c743

SHA1
9c3df0d56c95f4c131bc6c8217b4cc9657b6b70c

SHA256
0f30ba9bff239376536993d74f070b85d471c086894c6e04316732c2377a4757

SHA512
8dbe165e66850fbf4868bad8d82b2f04db0069a5706ca1a2fa9aa43c95261626bae816a62792879a3b82dd0cc104812992542024e30d8779e3f0396ecbeaa8e0

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
929f4b0a90eab3b823adbcf11827c743

SHA1
9c3df0d56c95f4c131bc6c8217b4cc9657b6b70c

SHA256
0f30ba9bff239376536993d74f070b85d471c086894c6e04316732c2377a4757

SHA512
8dbe165e66850fbf4868bad8d82b2f04db0069a5706ca1a2fa9aa43c95261626bae816a62792879a3b82dd0cc104812992542024e30d8779e3f0396ecbeaa8e0

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
929f4b0a90eab3b823adbcf11827c743

SHA1
9c3df0d56c95f4c131bc6c8217b4cc9657b6b70c

SHA256
0f30ba9bff239376536993d74f070b85d471c086894c6e04316732c2377a4757

SHA512
8dbe165e66850fbf4868bad8d82b2f04db0069a5706ca1a2fa9aa43c95261626bae816a62792879a3b82dd0cc104812992542024e30d8779e3f0396ecbeaa8e0

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

Filesize
52KB

MD5
fc253ecefdb1bd3d579c49920f94fbbb

SHA1
8c635f9636b2873626fb98e8e16eb9391ab7fb8e

SHA256
2f92e767a663d421d7545d90da7903410d5abefeddd0238a3ff24c50dda88bb0

SHA512
f561966f05df46bc672acd467176d908c53bf31bc05f87a77391a171c80625e44f86d3381102fce6a2406bf3a6e076cf0510fac384dc191fbcbae23414f63f83

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

Filesize
52KB

MD5
929f4b0a90eab3b823adbcf11827c743

SHA1
9c3df0d56c95f4c131bc6c8217b4cc9657b6b70c

SHA256
0f30ba9bff239376536993d74f070b85d471c086894c6e04316732c2377a4757

SHA512
8dbe165e66850fbf4868bad8d82b2f04db0069a5706ca1a2fa9aa43c95261626bae816a62792879a3b82dd0cc104812992542024e30d8779e3f0396ecbeaa8e0

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

Filesize
52KB

MD5
fc253ecefdb1bd3d579c49920f94fbbb

SHA1
8c635f9636b2873626fb98e8e16eb9391ab7fb8e

SHA256
2f92e767a663d421d7545d90da7903410d5abefeddd0238a3ff24c50dda88bb0

SHA512
f561966f05df46bc672acd467176d908c53bf31bc05f87a77391a171c80625e44f86d3381102fce6a2406bf3a6e076cf0510fac384dc191fbcbae23414f63f83

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

Filesize
52KB

MD5
929f4b0a90eab3b823adbcf11827c743

SHA1
9c3df0d56c95f4c131bc6c8217b4cc9657b6b70c

SHA256
0f30ba9bff239376536993d74f070b85d471c086894c6e04316732c2377a4757

SHA512
8dbe165e66850fbf4868bad8d82b2f04db0069a5706ca1a2fa9aa43c95261626bae816a62792879a3b82dd0cc104812992542024e30d8779e3f0396ecbeaa8e0

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
634984dea65773a1c1f66231c8eb717e

SHA1
b163d18d439e49df7cf74089daabaddb2b9cb95c

SHA256
35619ef86d4c72bcff2abc4884692624c60d4883341340d066ad64445609530d

SHA512
11ae40a4ddcd409b68a61ed95a218e1f46130cd5734ad1118d6f33d377eaa5a568dcbccf5e13ddc584d62c704a97ad2544dc19d8c7a00f6b86b22b8c68e10f9f

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
fc253ecefdb1bd3d579c49920f94fbbb

SHA1
8c635f9636b2873626fb98e8e16eb9391ab7fb8e

SHA256
2f92e767a663d421d7545d90da7903410d5abefeddd0238a3ff24c50dda88bb0

SHA512
f561966f05df46bc672acd467176d908c53bf31bc05f87a77391a171c80625e44f86d3381102fce6a2406bf3a6e076cf0510fac384dc191fbcbae23414f63f83

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
55851e64ef52985cf52721c59f4e6c85

SHA1
ace4d57662f81002cfc22917f4c906113d4501ab

SHA256
3c35041725a06a48a9d95c44c6353b0f9c3ee402df7c51799264909f7d81423b

SHA512
ae5fdb89ef1e9b70df75f93ef64cc904e13c4b3ba3109481e53133cca0052bd47ca54c9b4e4c77da4830e6d1dfe2fa072a8851833c9d8d102c583a22490814b9

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE

Filesize
52KB

MD5
55851e64ef52985cf52721c59f4e6c85

SHA1
ace4d57662f81002cfc22917f4c906113d4501ab

SHA256
3c35041725a06a48a9d95c44c6353b0f9c3ee402df7c51799264909f7d81423b

SHA512
ae5fdb89ef1e9b70df75f93ef64cc904e13c4b3ba3109481e53133cca0052bd47ca54c9b4e4c77da4830e6d1dfe2fa072a8851833c9d8d102c583a22490814b9

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

Filesize
52KB

MD5
fc253ecefdb1bd3d579c49920f94fbbb

SHA1
8c635f9636b2873626fb98e8e16eb9391ab7fb8e

SHA256
2f92e767a663d421d7545d90da7903410d5abefeddd0238a3ff24c50dda88bb0

SHA512
f561966f05df46bc672acd467176d908c53bf31bc05f87a77391a171c80625e44f86d3381102fce6a2406bf3a6e076cf0510fac384dc191fbcbae23414f63f83

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

Filesize
52KB

MD5
929f4b0a90eab3b823adbcf11827c743

SHA1
9c3df0d56c95f4c131bc6c8217b4cc9657b6b70c

SHA256
0f30ba9bff239376536993d74f070b85d471c086894c6e04316732c2377a4757

SHA512
8dbe165e66850fbf4868bad8d82b2f04db0069a5706ca1a2fa9aa43c95261626bae816a62792879a3b82dd0cc104812992542024e30d8779e3f0396ecbeaa8e0

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
b766f06bedd77f0994b956939d556453

SHA1
ca96d852eb28d0da59625f3f0f55da8fe77275f9

SHA256
0789fd3e55fc761006efc37317faf76ff0a81b8852ef9a717b55f893d708caa0

SHA512
043e5e4b56614e12cf61949afd8d2e25d64c6b72416a91eba143e401b25414da367eccc3c9d06f6c41e05ebe3a5b625b07c2855cd074b734573676e7ac658259

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
fc253ecefdb1bd3d579c49920f94fbbb

SHA1
8c635f9636b2873626fb98e8e16eb9391ab7fb8e

SHA256
2f92e767a663d421d7545d90da7903410d5abefeddd0238a3ff24c50dda88bb0

SHA512
f561966f05df46bc672acd467176d908c53bf31bc05f87a77391a171c80625e44f86d3381102fce6a2406bf3a6e076cf0510fac384dc191fbcbae23414f63f83

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

Filesize
52KB

MD5
929f4b0a90eab3b823adbcf11827c743

SHA1
9c3df0d56c95f4c131bc6c8217b4cc9657b6b70c

SHA256
0f30ba9bff239376536993d74f070b85d471c086894c6e04316732c2377a4757

SHA512
8dbe165e66850fbf4868bad8d82b2f04db0069a5706ca1a2fa9aa43c95261626bae816a62792879a3b82dd0cc104812992542024e30d8779e3f0396ecbeaa8e0

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
fc253ecefdb1bd3d579c49920f94fbbb

SHA1
8c635f9636b2873626fb98e8e16eb9391ab7fb8e

SHA256
2f92e767a663d421d7545d90da7903410d5abefeddd0238a3ff24c50dda88bb0

SHA512
f561966f05df46bc672acd467176d908c53bf31bc05f87a77391a171c80625e44f86d3381102fce6a2406bf3a6e076cf0510fac384dc191fbcbae23414f63f83

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
929f4b0a90eab3b823adbcf11827c743

SHA1
9c3df0d56c95f4c131bc6c8217b4cc9657b6b70c

SHA256
0f30ba9bff239376536993d74f070b85d471c086894c6e04316732c2377a4757

SHA512
8dbe165e66850fbf4868bad8d82b2f04db0069a5706ca1a2fa9aa43c95261626bae816a62792879a3b82dd0cc104812992542024e30d8779e3f0396ecbeaa8e0

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
4c81870960093bf8765fc36820db2ad1

SHA1
a1d5fcb8a62604bab7feba403eecb165a2cea3f6

SHA256
93e8be5f8c929608e6ad65aea288f0310c08b85aa0412369ddf58335fc787998

SHA512
c47e50fc2455eb19d6e65b186a34ed4e9eff34d2fcd2a28f8a7c50988cf3366768a668ca6af702d50a3bdb0632ddc81482651162e7d4fa97678283afee9e393d

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
c04b26b12b7de073f6ff36e348d25cc3

SHA1
49c0aaf9d1930292b448afe8a95e7dcd28782d8e

SHA256
bc6447c032b1f998ed1607ae626e27d5075cd752d33bfba511fac0f80e3372ad

SHA512
e73239fdf5c50fa183f84f995a0b45cc961157f335e41ba8aad8d2e66ba720aea42d452dc9eb975e1e044b36254e8672704a8d5d2acc062433f00d802857c6aa

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

Filesize
52KB

MD5
929f4b0a90eab3b823adbcf11827c743

SHA1
9c3df0d56c95f4c131bc6c8217b4cc9657b6b70c

SHA256
0f30ba9bff239376536993d74f070b85d471c086894c6e04316732c2377a4757

SHA512
8dbe165e66850fbf4868bad8d82b2f04db0069a5706ca1a2fa9aa43c95261626bae816a62792879a3b82dd0cc104812992542024e30d8779e3f0396ecbeaa8e0

Download Submit
C:\Wallpaper.exe

Filesize
52KB

MD5
fc253ecefdb1bd3d579c49920f94fbbb

SHA1
8c635f9636b2873626fb98e8e16eb9391ab7fb8e

SHA256
2f92e767a663d421d7545d90da7903410d5abefeddd0238a3ff24c50dda88bb0

SHA512
f561966f05df46bc672acd467176d908c53bf31bc05f87a77391a171c80625e44f86d3381102fce6a2406bf3a6e076cf0510fac384dc191fbcbae23414f63f83

Download Submit
C:\Windows\MSVBVM60.DLL

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
fc253ecefdb1bd3d579c49920f94fbbb

SHA1
8c635f9636b2873626fb98e8e16eb9391ab7fb8e

SHA256
2f92e767a663d421d7545d90da7903410d5abefeddd0238a3ff24c50dda88bb0

SHA512
f561966f05df46bc672acd467176d908c53bf31bc05f87a77391a171c80625e44f86d3381102fce6a2406bf3a6e076cf0510fac384dc191fbcbae23414f63f83

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
929f4b0a90eab3b823adbcf11827c743

SHA1
9c3df0d56c95f4c131bc6c8217b4cc9657b6b70c

SHA256
0f30ba9bff239376536993d74f070b85d471c086894c6e04316732c2377a4757

SHA512
8dbe165e66850fbf4868bad8d82b2f04db0069a5706ca1a2fa9aa43c95261626bae816a62792879a3b82dd0cc104812992542024e30d8779e3f0396ecbeaa8e0

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
6802130411ae6026e5b368f39c565384

SHA1
0d4153bb887de8ea331b70628707e0d27a4d26c8

SHA256
87dd0e2a1a438948bb1bfad5e71eb9fad9b882d368e90f81d91c76f11a6c15f0

SHA512
9d5cb0bebc60f8432f22ce566b56efcbd93c5b9b6c50a804c8cc5e33af15a35e7cd9667d7164b871594f8199234d5dd5089ebbefbfffc1c5030941b47f7daa95

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
1e7e099254539a0112905d60d2772e51

SHA1
1ed093a9e434fb5398a71ba6269d8fb99bcaa324

SHA256
54d2b17724ec31dfbecdc9d6af057fb2f238813ef4316c06f52373357078e890

SHA512
a764193dc93738ac26ec4bff763b9475bb18bac1ba5b1bdf7715ca5f1183c1e6cd12b8cdf7d50fa94bfe1083cccbb6f36ead3560763cb066bce60a2b3a190d5b

Download Submit
C:\Windows\SysWOW64\DamageControl.scr

Filesize
52KB

MD5
929f4b0a90eab3b823adbcf11827c743

SHA1
9c3df0d56c95f4c131bc6c8217b4cc9657b6b70c

SHA256
0f30ba9bff239376536993d74f070b85d471c086894c6e04316732c2377a4757

SHA512
8dbe165e66850fbf4868bad8d82b2f04db0069a5706ca1a2fa9aa43c95261626bae816a62792879a3b82dd0cc104812992542024e30d8779e3f0396ecbeaa8e0

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
fc253ecefdb1bd3d579c49920f94fbbb

SHA1
8c635f9636b2873626fb98e8e16eb9391ab7fb8e

SHA256
2f92e767a663d421d7545d90da7903410d5abefeddd0238a3ff24c50dda88bb0

SHA512
f561966f05df46bc672acd467176d908c53bf31bc05f87a77391a171c80625e44f86d3381102fce6a2406bf3a6e076cf0510fac384dc191fbcbae23414f63f83

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
929f4b0a90eab3b823adbcf11827c743

SHA1
9c3df0d56c95f4c131bc6c8217b4cc9657b6b70c

SHA256
0f30ba9bff239376536993d74f070b85d471c086894c6e04316732c2377a4757

SHA512
8dbe165e66850fbf4868bad8d82b2f04db0069a5706ca1a2fa9aa43c95261626bae816a62792879a3b82dd0cc104812992542024e30d8779e3f0396ecbeaa8e0

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
99eee8df15d4471dd3a12f4a46f7e145

SHA1
20848b12ab53b5cd5c76161d58abae7804f0bbb6

SHA256
f0aa9196f737eb617cae1071785e01eb9c2f37aa68d02354d6908e6000f2c7b1

SHA512
e9387ea878bb8a8309da162161dfe7b8c0b6e71935e59954543a7b01c2a6b25faf59eebc893fae4c9b71cc843cef32539af40cef222d6e299a33a27c45f4a1c6

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
a7162d4092ef785028f584c3ebdfd6b3

SHA1
d5fa3408d76dae8736af28353fea833ffad0b30d

SHA256
7467e4b5f75c953774c36c2869be2ee262f857e926cc2aa1227d6fa4e0ebb3b7

SHA512
21fb7266ab72727334913809849f6e4c041b42c2e4f37c651ca85b42c70c839c19617751b7c610cd1d50d70ad33f5cf0c0c499631fcac75d6f40ee9a8333983d

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe

Filesize
52KB

MD5
929f4b0a90eab3b823adbcf11827c743

SHA1
9c3df0d56c95f4c131bc6c8217b4cc9657b6b70c

SHA256
0f30ba9bff239376536993d74f070b85d471c086894c6e04316732c2377a4757

SHA512
8dbe165e66850fbf4868bad8d82b2f04db0069a5706ca1a2fa9aa43c95261626bae816a62792879a3b82dd0cc104812992542024e30d8779e3f0396ecbeaa8e0

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
929f4b0a90eab3b823adbcf11827c743

SHA1
9c3df0d56c95f4c131bc6c8217b4cc9657b6b70c

SHA256
0f30ba9bff239376536993d74f070b85d471c086894c6e04316732c2377a4757

SHA512
8dbe165e66850fbf4868bad8d82b2f04db0069a5706ca1a2fa9aa43c95261626bae816a62792879a3b82dd0cc104812992542024e30d8779e3f0396ecbeaa8e0

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
929f4b0a90eab3b823adbcf11827c743

SHA1
9c3df0d56c95f4c131bc6c8217b4cc9657b6b70c

SHA256
0f30ba9bff239376536993d74f070b85d471c086894c6e04316732c2377a4757

SHA512
8dbe165e66850fbf4868bad8d82b2f04db0069a5706ca1a2fa9aa43c95261626bae816a62792879a3b82dd0cc104812992542024e30d8779e3f0396ecbeaa8e0

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
929f4b0a90eab3b823adbcf11827c743

SHA1
9c3df0d56c95f4c131bc6c8217b4cc9657b6b70c

SHA256
0f30ba9bff239376536993d74f070b85d471c086894c6e04316732c2377a4757

SHA512
8dbe165e66850fbf4868bad8d82b2f04db0069a5706ca1a2fa9aa43c95261626bae816a62792879a3b82dd0cc104812992542024e30d8779e3f0396ecbeaa8e0

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
929f4b0a90eab3b823adbcf11827c743

SHA1
9c3df0d56c95f4c131bc6c8217b4cc9657b6b70c

SHA256
0f30ba9bff239376536993d74f070b85d471c086894c6e04316732c2377a4757

SHA512
8dbe165e66850fbf4868bad8d82b2f04db0069a5706ca1a2fa9aa43c95261626bae816a62792879a3b82dd0cc104812992542024e30d8779e3f0396ecbeaa8e0

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe

Filesize
52KB

MD5
929f4b0a90eab3b823adbcf11827c743

SHA1
9c3df0d56c95f4c131bc6c8217b4cc9657b6b70c

SHA256
0f30ba9bff239376536993d74f070b85d471c086894c6e04316732c2377a4757

SHA512
8dbe165e66850fbf4868bad8d82b2f04db0069a5706ca1a2fa9aa43c95261626bae816a62792879a3b82dd0cc104812992542024e30d8779e3f0396ecbeaa8e0

Download Submit
C:\Windows\msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
fc253ecefdb1bd3d579c49920f94fbbb

SHA1
8c635f9636b2873626fb98e8e16eb9391ab7fb8e

SHA256
2f92e767a663d421d7545d90da7903410d5abefeddd0238a3ff24c50dda88bb0

SHA512
f561966f05df46bc672acd467176d908c53bf31bc05f87a77391a171c80625e44f86d3381102fce6a2406bf3a6e076cf0510fac384dc191fbcbae23414f63f83

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
fc253ecefdb1bd3d579c49920f94fbbb

SHA1
8c635f9636b2873626fb98e8e16eb9391ab7fb8e

SHA256
2f92e767a663d421d7545d90da7903410d5abefeddd0238a3ff24c50dda88bb0

SHA512
f561966f05df46bc672acd467176d908c53bf31bc05f87a77391a171c80625e44f86d3381102fce6a2406bf3a6e076cf0510fac384dc191fbcbae23414f63f83

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
fc253ecefdb1bd3d579c49920f94fbbb

SHA1
8c635f9636b2873626fb98e8e16eb9391ab7fb8e

SHA256
2f92e767a663d421d7545d90da7903410d5abefeddd0238a3ff24c50dda88bb0

SHA512
f561966f05df46bc672acd467176d908c53bf31bc05f87a77391a171c80625e44f86d3381102fce6a2406bf3a6e076cf0510fac384dc191fbcbae23414f63f83

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
fc253ecefdb1bd3d579c49920f94fbbb

SHA1
8c635f9636b2873626fb98e8e16eb9391ab7fb8e

SHA256
2f92e767a663d421d7545d90da7903410d5abefeddd0238a3ff24c50dda88bb0

SHA512
f561966f05df46bc672acd467176d908c53bf31bc05f87a77391a171c80625e44f86d3381102fce6a2406bf3a6e076cf0510fac384dc191fbcbae23414f63f83

Download Submit
C:\Windows\nEwb0Rn.exe

Filesize
52KB

MD5
fc253ecefdb1bd3d579c49920f94fbbb

SHA1
8c635f9636b2873626fb98e8e16eb9391ab7fb8e

SHA256
2f92e767a663d421d7545d90da7903410d5abefeddd0238a3ff24c50dda88bb0

SHA512
f561966f05df46bc672acd467176d908c53bf31bc05f87a77391a171c80625e44f86d3381102fce6a2406bf3a6e076cf0510fac384dc191fbcbae23414f63f83

Download Submit
C:\about.htm

Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\about.htm

Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\desktop.ini

Filesize
222B

MD5
b78e2c99b0e66f6f6accbebdaa4d8442

SHA1
a546aaed8820b44437538600deba9d08a4a11ddc

SHA256
59e9ccbcb65a03c7965b93c758e4562ff8ddd5500b8ec1b66811f9b62744b2ca

SHA512
82d09d87f8dffbc9c261b8d9dc9437350638197430ecee513bf1803ad18db3b939c56141e970d0d9523c93befebd1e76743b860d9dfd2072280becdf5aa2fc6e

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
fc253ecefdb1bd3d579c49920f94fbbb

SHA1
8c635f9636b2873626fb98e8e16eb9391ab7fb8e

SHA256
2f92e767a663d421d7545d90da7903410d5abefeddd0238a3ff24c50dda88bb0

SHA512
f561966f05df46bc672acd467176d908c53bf31bc05f87a77391a171c80625e44f86d3381102fce6a2406bf3a6e076cf0510fac384dc191fbcbae23414f63f83

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
929f4b0a90eab3b823adbcf11827c743

SHA1
9c3df0d56c95f4c131bc6c8217b4cc9657b6b70c

SHA256
0f30ba9bff239376536993d74f070b85d471c086894c6e04316732c2377a4757

SHA512
8dbe165e66850fbf4868bad8d82b2f04db0069a5706ca1a2fa9aa43c95261626bae816a62792879a3b82dd0cc104812992542024e30d8779e3f0396ecbeaa8e0

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
7b6abbb6b253046995e1ee2dd16a7d68

SHA1
86a7816c2dbaa7bfe7db08a538692804cd1a7439

SHA256
3708281520d351e8336620e5670a79106cbebf4c1c8d49efe00af458861dceb6

SHA512
40408b1afb167f810c4e0fb77b94a6e9d1139c8dad523efefced4c9318c84e8e0814435b7121e6ba010947c4db616fe24380e4575802f2b2b5673a5fa08bd489

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
3d704853e56ea6dcd7dea7895930c274

SHA1
2e041540fff02f5ad97cdf91345e65055e7ceb25

SHA256
8a17aec7c58af85c9d8c71df6d673e1ae5d4846732e0c22a881046d93f368fe8

SHA512
b822302e0d3bf6654b024099225f92b8799eb8794bd12c8c6822b4736a17051d1cd56efcfccd9ee8e7908bc00a4fe139b243deefbee044b0131988adcdcdf7fb

Download Submit
C:\nEwb0Rn.exe

Filesize
52KB

MD5
929f4b0a90eab3b823adbcf11827c743

SHA1
9c3df0d56c95f4c131bc6c8217b4cc9657b6b70c

SHA256
0f30ba9bff239376536993d74f070b85d471c086894c6e04316732c2377a4757

SHA512
8dbe165e66850fbf4868bad8d82b2f04db0069a5706ca1a2fa9aa43c95261626bae816a62792879a3b82dd0cc104812992542024e30d8779e3f0396ecbeaa8e0

Download Submit
C:\nEwb0Rn\Folder.htt

Filesize
640B

MD5
5d142e7978321fde49abd9a068b64d97

SHA1
70020fcf7f3d6dafb6c8cd7a55395196a487bef4

SHA256
fe222b08327bbfb35cbd627c0526ba7b5755b02ce0a95823a4c0bf58e601d061

SHA512
2351284652a9a1b35006baf4727a85199406e464ac33cb4701a6182e1076aaff022c227dbe4ad6e916eba15ebad08b10719a8e86d5a0f89844a163a7d4a7bbf9

Download Submit
C:\nEwb0Rn\New Folder.exe

Filesize
52KB

MD5
fc253ecefdb1bd3d579c49920f94fbbb

SHA1
8c635f9636b2873626fb98e8e16eb9391ab7fb8e

SHA256
2f92e767a663d421d7545d90da7903410d5abefeddd0238a3ff24c50dda88bb0

SHA512
f561966f05df46bc672acd467176d908c53bf31bc05f87a77391a171c80625e44f86d3381102fce6a2406bf3a6e076cf0510fac384dc191fbcbae23414f63f83

Download Submit
C:\nEwb0Rn\New Folder.exe

Filesize
52KB

MD5
6bd8a9e2ead99eaa261d5c8acc79c6d4

SHA1
0565ffebbc0f68c64192929c34bd50b676de0920

SHA256
57528b017b10e7e681adb927fbb71b27868cf2df2e8880c5065b1a2c5eedc540

SHA512
36b06f831e1418683cb0929c9dd698f1ec83ae93376b44dee708f635bc2812b64a1009578eb79518055d4c120ee2661eaff812bf00f8baf9e5e60d7520c5c4bd

Download Submit
memory/336-227-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/392-268-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/440-263-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/544-240-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1168-269-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1168-273-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1324-164-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1580-173-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1580-172-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1660-204-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1732-281-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2820-285-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2864-292-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2948-256-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3056-303-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3056-233-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3256-270-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3256-275-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3488-302-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3488-229-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3808-216-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4240-235-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4240-231-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4516-290-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4532-222-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4668-299-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4684-219-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4820-146-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4820-301-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4928-300-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4928-145-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4960-132-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4960-274-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5080-295-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download