882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 00:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Size

52KB
MD5

3568eaf658a9afa3fc624d503b456080
SHA1

eefc86c79e5c49e8ac18130d5fc6a71d15cf4eca
SHA256

882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5
SHA512

8d5bf5a1c2d866b26e2744f6b9d761d675b3bc3c1669988dc9d9de6e1f7406b95c2d2f026eae1c11dd12769fb890a2686ae0f265e4ab533ed28e5980fe309043
SSDEEP

768:d+ciLamXW9XgMxjFkpvMVX8q18q13yO1+33j5n/wSJkfw:IzaEW5gMxZVXf8a3yO10pw0

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 16 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

WishfulThinking.exeWINLOGON.EXEWishfulThinking.exeSERVICES.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exenEwb0Rn.exeWINLOGON.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WishfulThinking.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\WishfulThinking.exe\""	nEwb0Rn.exe

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

WINLOGON.EXESERVICES.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXEWishfulThinking.exenEwb0Rn.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE

Modifies visibility of file extensions in Explorer 2 TTPs 8 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

WINLOGON.EXEnEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWishfulThinking.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WishfulThinking.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 8 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

WishfulThinking.exeWINLOGON.EXEnEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nEwb0Rn.exe

Windows security bypass 2 TTPs 40 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

WishfulThinking.exeSERVICES.EXEWINLOGON.EXEWINLOGON.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWishfulThinking.exenEwb0Rn.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WishfulThinking.exe

Blocks application from running via registry modification 48 IoCs

Adds application to list of disallowed applications.

evasion

Processes:

nEwb0Rn.exeSERVICES.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXEWINLOGON.EXEWishfulThinking.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "notepad.exe"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "taskmgr.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "install.exe"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe

Disables RegEdit via registry modification 16 IoCs

evasion

Processes:

nEwb0Rn.exeWishfulThinking.exeWINLOGON.EXEWINLOGON.EXESERVICES.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWishfulThinking.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 27 IoCs

Processes:

nEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXEnEwb0Rn.exenEwb0Rn.exenEwb0Rn.exenEwb0Rn.exeWishfulThinking.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXEWINLOGON.EXESERVICES.EXESERVICES.EXEnEwb0Rn.exeWishfulThinking.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXEWINLOGON.EXESERVICES.EXESERVICES.EXEnEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXE

pid	process
4932	nEwb0Rn.exe
2256	WishfulThinking.exe
4224	WINLOGON.EXE
996	SERVICES.EXE
3640	nEwb0Rn.exe
1792	nEwb0Rn.exe
1304	nEwb0Rn.exe
1396	nEwb0Rn.exe
4916	WishfulThinking.exe
3120	nEwb0Rn.exe
3908	WishfulThinking.exe
3468	WINLOGON.EXE
2380	WINLOGON.EXE
2228	SERVICES.EXE
1384	SERVICES.EXE
1764	nEwb0Rn.exe
3348	WishfulThinking.exe
532	nEwb0Rn.exe
3176	WishfulThinking.exe
3580	WINLOGON.EXE
3392	WINLOGON.EXE
4548	SERVICES.EXE
1888	SERVICES.EXE
2992	nEwb0Rn.exe
4820	WishfulThinking.exe
3644	WINLOGON.EXE
1296	SERVICES.EXE

Sets file execution options in registry 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WINLOGON.EXEnEwb0Rn.exeWishfulThinking.exeSERVICES.EXEWINLOGON.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exeWishfulThinking.exenEwb0Rn.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Windows\\system32\\cmd.exe"	nEwb0Rn.exe

Loads dropped DLL 7 IoCs

Processes:

nEwb0Rn.exenEwb0Rn.exenEwb0Rn.exenEwb0Rn.exenEwb0Rn.exenEwb0Rn.exenEwb0Rn.exe

pid process

1792 nEwb0Rn.exe
3640 nEwb0Rn.exe
1396 nEwb0Rn.exe
3120 nEwb0Rn.exe
1764 nEwb0Rn.exe
532 nEwb0Rn.exe
2992 nEwb0Rn.exe

pid	process
1792	nEwb0Rn.exe
3640	nEwb0Rn.exe
1396	nEwb0Rn.exe
3120	nEwb0Rn.exe
1764	nEwb0Rn.exe
532	nEwb0Rn.exe
2992	nEwb0Rn.exe

Windows security modification 2 TTPs 48 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

WINLOGON.EXEnEwb0Rn.exeWishfulThinking.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exeSERVICES.EXE

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	WishfulThinking.exe

Adds Run key to start application 2 TTPs 40 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SERVICES.EXEnEwb0Rn.exeWishfulThinking.exeWINLOGON.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n210bw3n = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\n3wb012nAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nEwb0Rn = "C:\\Windows\\nEwb0Rn.exe"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\	nEwb0Rn.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe

description	ioc	process
File opened for modification	C:\desktop.ini	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File created	C:\desktop.ini	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

SERVICES.EXEWishfulThinking.exe882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exeWINLOGON.EXEnEwb0Rn.exe

description	ioc	process
File opened (read-only)	\??\I:	SERVICES.EXE
File opened (read-only)	\??\K:	SERVICES.EXE
File opened (read-only)	\??\P:	WishfulThinking.exe
File opened (read-only)	\??\R:	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened (read-only)	\??\B:	WINLOGON.EXE
File opened (read-only)	\??\L:	WINLOGON.EXE
File opened (read-only)	\??\E:	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened (read-only)	\??\B:	SERVICES.EXE
File opened (read-only)	\??\O:	nEwb0Rn.exe
File opened (read-only)	\??\H:	WishfulThinking.exe
File opened (read-only)	\??\P:	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened (read-only)	\??\O:	SERVICES.EXE
File opened (read-only)	\??\V:	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened (read-only)	\??\K:	WishfulThinking.exe
File opened (read-only)	\??\R:	WINLOGON.EXE
File opened (read-only)	\??\U:	nEwb0Rn.exe
File opened (read-only)	\??\Z:	WishfulThinking.exe
File opened (read-only)	\??\O:	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened (read-only)	\??\K:	nEwb0Rn.exe
File opened (read-only)	\??\Q:	nEwb0Rn.exe
File opened (read-only)	\??\R:	nEwb0Rn.exe
File opened (read-only)	\??\Q:	WishfulThinking.exe
File opened (read-only)	\??\X:	WishfulThinking.exe
File opened (read-only)	\??\S:	SERVICES.EXE
File opened (read-only)	\??\M:	nEwb0Rn.exe
File opened (read-only)	\??\Z:	nEwb0Rn.exe
File opened (read-only)	\??\E:	WishfulThinking.exe
File opened (read-only)	\??\H:	nEwb0Rn.exe
File opened (read-only)	\??\G:	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened (read-only)	\??\S:	WishfulThinking.exe
File opened (read-only)	\??\U:	WINLOGON.EXE
File opened (read-only)	\??\G:	SERVICES.EXE
File opened (read-only)	\??\E:	nEwb0Rn.exe
File opened (read-only)	\??\B:	WishfulThinking.exe
File opened (read-only)	\??\F:	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened (read-only)	\??\X:	nEwb0Rn.exe
File opened (read-only)	\??\J:	WishfulThinking.exe
File opened (read-only)	\??\X:	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened (read-only)	\??\M:	WishfulThinking.exe
File opened (read-only)	\??\U:	WishfulThinking.exe
File opened (read-only)	\??\X:	SERVICES.EXE
File opened (read-only)	\??\F:	WishfulThinking.exe
File opened (read-only)	\??\I:	WishfulThinking.exe
File opened (read-only)	\??\R:	WishfulThinking.exe
File opened (read-only)	\??\H:	SERVICES.EXE
File opened (read-only)	\??\N:	WishfulThinking.exe
File opened (read-only)	\??\O:	WINLOGON.EXE
File opened (read-only)	\??\Y:	nEwb0Rn.exe
File opened (read-only)	\??\Z:	WINLOGON.EXE
File opened (read-only)	\??\M:	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened (read-only)	\??\J:	WINLOGON.EXE
File opened (read-only)	\??\G:	nEwb0Rn.exe
File opened (read-only)	\??\F:	WINLOGON.EXE
File opened (read-only)	\??\V:	WINLOGON.EXE
File opened (read-only)	\??\Y:	WINLOGON.EXE
File opened (read-only)	\??\U:	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened (read-only)	\??\W:	SERVICES.EXE
File opened (read-only)	\??\V:	nEwb0Rn.exe
File opened (read-only)	\??\T:	WINLOGON.EXE
File opened (read-only)	\??\S:	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened (read-only)	\??\M:	SERVICES.EXE
File opened (read-only)	\??\G:	WishfulThinking.exe
File opened (read-only)	\??\Q:	WINLOGON.EXE
File opened (read-only)	\??\V:	WishfulThinking.exe

Drops file in System32 directory 46 IoCs

Processes:

WishfulThinking.exenEwb0Rn.exe882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWINLOGON.EXESERVICES.EXEWishfulThinking.exeWishfulThinking.exeWishfulThinking.exeWishfulThinking.exeWINLOGON.EXEWishfulThinking.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	nEwb0Rn.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	WINLOGON.EXE
File created	C:\Windows\SysWOW64\WishfulThinking.exe	SERVICES.EXE
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	nEwb0Rn.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	nEwb0Rn.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	WINLOGON.EXE
File created	C:\Windows\SysWOW64\DamageControl.scr	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	WishfulThinking.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	WINLOGON.EXE
File created	C:\Windows\SysWOW64\WishfulThinking.exe	WishfulThinking.exe
File created	C:\Windows\SysWOW64\JawsOfLife.exe	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	WINLOGON.EXE
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	SERVICES.EXE
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	WishfulThinking.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	nEwb0Rn.exe
File created	C:\Windows\SysWOW64\WishfulThinking.exe	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	WINLOGON.EXE
File opened for modification	C:\Windows\SysWOW64\WishfulThinking.exe	SERVICES.EXE
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\JawsOfLife.exe	WINLOGON.EXE
File created	C:\Windows\SysWOW64\WishfulThinking.exe	WINLOGON.EXE
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	SERVICES.EXE
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\SysWOW64\DamageControl.scr	WINLOGON.EXE
File created	C:\Windows\SysWOW64\msvbvm60.dll	WishfulThinking.exe

Drops file in Windows directory 28 IoCs

Processes:

WishfulThinking.exeWishfulThinking.exeWINLOGON.EXEWishfulThinking.exe882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exeWINLOGON.EXEWishfulThinking.exenEwb0Rn.exeWishfulThinking.exeSERVICES.EXEWishfulThinking.exenEwb0Rn.exe

description	ioc	process
File opened for modification	C:\Windows\nEwb0Rn.exe	WishfulThinking.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\nEwb0Rn.exe	WINLOGON.EXE
File opened for modification	C:\Windows\nEwb0Rn.exe	WINLOGON.EXE
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\nEwb0Rn.exe	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	WINLOGON.EXE
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	WishfulThinking.exe
File created	C:\Windows\nEwb0Rn.exe	WishfulThinking.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\nEwb0Rn.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\nEwb0Rn.exe	WishfulThinking.exe
File created	C:\Windows\nEwb0Rn.exe	SERVICES.EXE
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	nEwb0Rn.exe
File created	C:\Windows\nEwb0Rn.exe	WINLOGON.EXE
File opened for modification	C:\Windows\nEwb0Rn.exe	nEwb0Rn.exe
File created	C:\Windows\nEwb0Rn.exe	nEwb0Rn.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
File opened for modification	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File opened for modification	C:\Windows\nEwb0Rn.exe	SERVICES.EXE
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe
File created	C:\Windows\msvbvm60.dll	WishfulThinking.exe

Modifies Control Panel 64 IoCs

evasion

Processes:

WINLOGON.EXESERVICES.EXEWishfulThinking.exeWINLOGON.EXEnEwb0Rn.exenEwb0Rn.exeWishfulThinking.exe882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\s1159 = "Inanimate"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\s1159 = "Inanimate"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\AutoEndTasks = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\s1159 = "Inanimate"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\AutoEndTasks = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\s1159 = "Inanimate"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\s2359 = "Animate"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\AutoEndTasks = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\s1159 = "Inanimate"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\AutoEndTasks = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\s2359 = "Animate"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\s2359 = "Animate"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	WishfulThinking.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\s1159 = "Inanimate"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	SERVICES.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\s1159 = "Inanimate"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\s2359 = "Animate"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\s2359 = "Animate"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\AutoEndTasks = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\s1159 = "Inanimate"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\s2359 = "Animate"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\AutoEndTasks = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\s2359 = "Animate"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\DAMAGE~1.SCR"	nEwb0Rn.exe

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

T1112

Processes:

nEwb0Rn.exeWishfulThinking.exeSERVICES.EXEWINLOGON.EXEnEwb0Rn.exeWINLOGON.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exeWishfulThinking.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	nEwb0Rn.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	WINLOGON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "w32.nEwb0Rn.A"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\	WishfulThinking.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

nEwb0Rn.exeWINLOGON.EXESERVICES.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWINLOGON.EXEWishfulThinking.exeWishfulThinking.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WINLOGON.EXE
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	SERVICES.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	SERVICES.EXE
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	nEwb0Rn.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	WINLOGON.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	WishfulThinking.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	nEwb0Rn.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WaitToKillServiceTimeout = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\AutoEndTasks = "1"	SERVICES.EXE
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	nEwb0Rn.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	WishfulThinking.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\	WINLOGON.EXE

Modifies registry class 64 IoCs

Processes:

WishfulThinking.exe882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exeWishfulThinking.exeWINLOGON.EXEnEwb0Rn.exeSERVICES.EXEWINLOGON.EXEnEwb0Rn.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	WINLOGON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\JawsOfLife.exe\" \"%1\" %*"	WINLOGON.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe

pid	process
4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

Processes:

nEwb0Rn.exeWINLOGON.EXESERVICES.EXEWishfulThinking.exe

pid process

3120 nEwb0Rn.exe
3468 WINLOGON.EXE
996 SERVICES.EXE
4916 WishfulThinking.exe

pid	process
3120	nEwb0Rn.exe
3468	WINLOGON.EXE
996	SERVICES.EXE
4916	WishfulThinking.exe

Suspicious use of SetWindowsHookEx 27 IoCs

Processes:

882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXEnEwb0Rn.exenEwb0Rn.exenEwb0Rn.exeWishfulThinking.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXEWINLOGON.EXESERVICES.EXESERVICES.EXEnEwb0Rn.exeWishfulThinking.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXEWINLOGON.EXESERVICES.EXESERVICES.EXEnEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXE

pid	process
4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
4932	nEwb0Rn.exe
2256	WishfulThinking.exe
4224	WINLOGON.EXE
996	SERVICES.EXE
1792	nEwb0Rn.exe
3640	nEwb0Rn.exe
1396	nEwb0Rn.exe
4916	WishfulThinking.exe
3120	nEwb0Rn.exe
3908	WishfulThinking.exe
3468	WINLOGON.EXE
2380	WINLOGON.EXE
2228	SERVICES.EXE
1384	SERVICES.EXE
1764	nEwb0Rn.exe
3348	WishfulThinking.exe
532	nEwb0Rn.exe
3176	WishfulThinking.exe
3580	WINLOGON.EXE
3392	WINLOGON.EXE
4548	SERVICES.EXE
1888	SERVICES.EXE
2992	nEwb0Rn.exe
4820	WishfulThinking.exe
3644	WINLOGON.EXE
1296	SERVICES.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exenEwb0Rn.exeWishfulThinking.exeWINLOGON.EXESERVICES.EXEnEwb0Rn.exeWishfulThinking.exe

description	pid	process	target process
PID 4940 wrote to memory of 4932	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	nEwb0Rn.exe
PID 4940 wrote to memory of 4932	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	nEwb0Rn.exe
PID 4940 wrote to memory of 4932	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	nEwb0Rn.exe
PID 4940 wrote to memory of 2256	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	WishfulThinking.exe
PID 4940 wrote to memory of 2256	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	WishfulThinking.exe
PID 4940 wrote to memory of 2256	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	WishfulThinking.exe
PID 4940 wrote to memory of 4224	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	WINLOGON.EXE
PID 4940 wrote to memory of 4224	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	WINLOGON.EXE
PID 4940 wrote to memory of 4224	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	WINLOGON.EXE
PID 4940 wrote to memory of 996	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	SERVICES.EXE
PID 4940 wrote to memory of 996	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	SERVICES.EXE
PID 4940 wrote to memory of 996	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	SERVICES.EXE
PID 4932 wrote to memory of 3640	4932	nEwb0Rn.exe	nEwb0Rn.exe
PID 4932 wrote to memory of 3640	4932	nEwb0Rn.exe	nEwb0Rn.exe
PID 4932 wrote to memory of 3640	4932	nEwb0Rn.exe	nEwb0Rn.exe
PID 2256 wrote to memory of 1792	2256	WishfulThinking.exe	nEwb0Rn.exe
PID 2256 wrote to memory of 1792	2256	WishfulThinking.exe	nEwb0Rn.exe
PID 2256 wrote to memory of 1792	2256	WishfulThinking.exe	nEwb0Rn.exe
PID 4224 wrote to memory of 1304	4224	WINLOGON.EXE	nEwb0Rn.exe
PID 4224 wrote to memory of 1304	4224	WINLOGON.EXE	nEwb0Rn.exe
PID 4224 wrote to memory of 1304	4224	WINLOGON.EXE	nEwb0Rn.exe
PID 996 wrote to memory of 1396	996	SERVICES.EXE	nEwb0Rn.exe
PID 996 wrote to memory of 1396	996	SERVICES.EXE	nEwb0Rn.exe
PID 996 wrote to memory of 1396	996	SERVICES.EXE	nEwb0Rn.exe
PID 996 wrote to memory of 4916	996	SERVICES.EXE	WishfulThinking.exe
PID 996 wrote to memory of 4916	996	SERVICES.EXE	WishfulThinking.exe
PID 996 wrote to memory of 4916	996	SERVICES.EXE	WishfulThinking.exe
PID 4940 wrote to memory of 3120	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	nEwb0Rn.exe
PID 4940 wrote to memory of 3120	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	nEwb0Rn.exe
PID 4940 wrote to memory of 3120	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	nEwb0Rn.exe
PID 4940 wrote to memory of 3908	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	WishfulThinking.exe
PID 4940 wrote to memory of 3908	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	WishfulThinking.exe
PID 4940 wrote to memory of 3908	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	WishfulThinking.exe
PID 4940 wrote to memory of 3468	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	WINLOGON.EXE
PID 4940 wrote to memory of 3468	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	WINLOGON.EXE
PID 4940 wrote to memory of 3468	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	WINLOGON.EXE
PID 996 wrote to memory of 2380	996	SERVICES.EXE	WINLOGON.EXE
PID 996 wrote to memory of 2380	996	SERVICES.EXE	WINLOGON.EXE
PID 996 wrote to memory of 2380	996	SERVICES.EXE	WINLOGON.EXE
PID 4940 wrote to memory of 2228	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	SERVICES.EXE
PID 4940 wrote to memory of 2228	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	SERVICES.EXE
PID 4940 wrote to memory of 2228	4940	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe	SERVICES.EXE
PID 996 wrote to memory of 1384	996	SERVICES.EXE	SERVICES.EXE
PID 996 wrote to memory of 1384	996	SERVICES.EXE	SERVICES.EXE
PID 996 wrote to memory of 1384	996	SERVICES.EXE	SERVICES.EXE
PID 3120 wrote to memory of 1764	3120	nEwb0Rn.exe	nEwb0Rn.exe
PID 3120 wrote to memory of 1764	3120	nEwb0Rn.exe	nEwb0Rn.exe
PID 3120 wrote to memory of 1764	3120	nEwb0Rn.exe	nEwb0Rn.exe
PID 3120 wrote to memory of 3348	3120	nEwb0Rn.exe	WishfulThinking.exe
PID 3120 wrote to memory of 3348	3120	nEwb0Rn.exe	WishfulThinking.exe
PID 3120 wrote to memory of 3348	3120	nEwb0Rn.exe	WishfulThinking.exe
PID 4916 wrote to memory of 532	4916	WishfulThinking.exe	nEwb0Rn.exe
PID 4916 wrote to memory of 532	4916	WishfulThinking.exe	nEwb0Rn.exe
PID 4916 wrote to memory of 532	4916	WishfulThinking.exe	nEwb0Rn.exe
PID 4916 wrote to memory of 3176	4916	WishfulThinking.exe	WishfulThinking.exe
PID 4916 wrote to memory of 3176	4916	WishfulThinking.exe	WishfulThinking.exe
PID 4916 wrote to memory of 3176	4916	WishfulThinking.exe	WishfulThinking.exe
PID 3120 wrote to memory of 3580	3120	nEwb0Rn.exe	WINLOGON.EXE
PID 3120 wrote to memory of 3580	3120	nEwb0Rn.exe	WINLOGON.EXE
PID 3120 wrote to memory of 3580	3120	nEwb0Rn.exe	WINLOGON.EXE
PID 4916 wrote to memory of 3392	4916	WishfulThinking.exe	WINLOGON.EXE
PID 4916 wrote to memory of 3392	4916	WishfulThinking.exe	WINLOGON.EXE
PID 4916 wrote to memory of 3392	4916	WishfulThinking.exe	WINLOGON.EXE
PID 3120 wrote to memory of 4548	3120	nEwb0Rn.exe	SERVICES.EXE

System policy modification 1 TTPs 56 IoCs

evasion

Modify Registry

T1112

Processes:

WishfulThinking.exeWINLOGON.EXEnEwb0Rn.exenEwb0Rn.exeSERVICES.EXEWINLOGON.EXE882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exeWishfulThinking.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SERVICES.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	WishfulThinking.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	SERVICES.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	SERVICES.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WishfulThinking.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	WINLOGON.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	nEwb0Rn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	nEwb0Rn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegedit = "1"	WINLOGON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	nEwb0Rn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	WishfulThinking.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	WishfulThinking.exe

C:\Users\Admin\AppData\Local\Temp\882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe
"C:\Users\Admin\AppData\Local\Temp\882847e7f7b82b08071d731036ddbcfbe353e7c49366204b2d85a140b09249d5.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Windows security modification
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4940

C:\Windows\nEwb0Rn.exe
C:\Windows\nEwb0Rn.exe
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Windows security modification
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4932

C:\Windows\nEwb0Rn.exe
C:\Windows\nEwb0Rn.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3640

C:\Windows\SysWOW64\WishfulThinking.exe
C:\Windows\system32\WishfulThinking.exe
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Windows security modification
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2256

C:\Windows\nEwb0Rn.exe
C:\Windows\nEwb0Rn.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1792

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Windows security modification
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4224

C:\Windows\nEwb0Rn.exe
C:\Windows\nEwb0Rn.exe
3⤵
- Executes dropped EXE
PID:1304

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Windows security modification
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:996

C:\Windows\SysWOW64\WishfulThinking.exe
C:\Windows\system32\WishfulThinking.exe
3⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Windows security modification
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4916

C:\Windows\nEwb0Rn.exe
C:\Windows\nEwb0Rn.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:532

C:\Windows\SysWOW64\WishfulThinking.exe
C:\Windows\system32\WishfulThinking.exe
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3176

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3392

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1888

C:\Windows\nEwb0Rn.exe
C:\Windows\nEwb0Rn.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1396

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2380

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1384

C:\Windows\nEwb0Rn.exe
C:\Windows\nEwb0Rn.exe
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3120

C:\Windows\SysWOW64\WishfulThinking.exe
C:\Windows\system32\WishfulThinking.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3348

C:\Windows\nEwb0Rn.exe
C:\Windows\nEwb0Rn.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1764

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3580

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4548

C:\Windows\SysWOW64\WishfulThinking.exe
C:\Windows\system32\WishfulThinking.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3908

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Windows security modification
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3468

C:\Windows\nEwb0Rn.exe
C:\Windows\nEwb0Rn.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2992

C:\Windows\SysWOW64\WishfulThinking.exe
C:\Windows\system32\WishfulThinking.exe
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4820

C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3644

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1296

C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2228

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Hidden Files and Directories

T1158

Disabling Security Tools

T1089

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Filesize
52KB

MD5
84eeb4fd939398218be5a54e88fc8363

SHA1
8387027653b929cb52d0283117f07b62ce9d4337

SHA256
77de35ad4de9d17ff60e4b04cfcc572f3977e0cc0afa5a2951f52ca894839ffe

SHA512
cc1689c2ae39e90ed6e9a83c5ececbf4a757fe7c892c02261da9c5c93cf92c50aeb48e6d230f35455e9a64b95f2e0d7d162c435305fbd55d6f9d231e7fcb1eb3

Download Submit
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Filesize
52KB

MD5
0ff201d599a88e746fc6e07c8234bf6d

SHA1
0bac9c184bd769bfd709b5b4bc2f7702788d845a

SHA256
ec2b1333ebf4d8d4067c7d2f1d94e292055cfdf2d8b01d0df33e8d4f87df8fcf

SHA512
82368216f75f7a7489ea22a392813fe405428f8a215c961c87a3d7600af205b66750f638f086b69f24cacaff63344a17e76e9da079b8261e5a201963a768e59f

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
Filesize
52KB

MD5
566a713a8d256423702d60eaaa035932

SHA1
42c58765c1785801bb50581987e2265fc5aa5aa8

SHA256
603986fef284f649d316aaecb5c02957b877af40b8155150f7d1fef8238a9414

SHA512
287bc164550c811abb079b941e221700d43e739b59dbf275603a1b2a40e3bbc35db4196cabac2c935366f4f4b4a39dc84ff977ade419dfecbf4ce3b372749170

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
Filesize
52KB

MD5
235bc84d392472c17f6d5c314ad65492

SHA1
35563f6eb8721fa36de6dab69808223d8d6b70ba

SHA256
a37d40c47379d40e1ee80e228bb9b9b59295b277f5d9a6b06c01aa11999ac9f9

SHA512
b3fc08063cceb8bab7246d22e035aaebb64d07573c59ed02e75814e3087bb04ff6315bc40e9cd82bc458acbe26b63736f03ae6029ec6b08e9384af7df1613885

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
Filesize
52KB

MD5
0ff201d599a88e746fc6e07c8234bf6d

SHA1
0bac9c184bd769bfd709b5b4bc2f7702788d845a

SHA256
ec2b1333ebf4d8d4067c7d2f1d94e292055cfdf2d8b01d0df33e8d4f87df8fcf

SHA512
82368216f75f7a7489ea22a392813fe405428f8a215c961c87a3d7600af205b66750f638f086b69f24cacaff63344a17e76e9da079b8261e5a201963a768e59f

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
Filesize
52KB

MD5
84eeb4fd939398218be5a54e88fc8363

SHA1
8387027653b929cb52d0283117f07b62ce9d4337

SHA256
77de35ad4de9d17ff60e4b04cfcc572f3977e0cc0afa5a2951f52ca894839ffe

SHA512
cc1689c2ae39e90ed6e9a83c5ececbf4a757fe7c892c02261da9c5c93cf92c50aeb48e6d230f35455e9a64b95f2e0d7d162c435305fbd55d6f9d231e7fcb1eb3

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
Filesize
52KB

MD5
235bc84d392472c17f6d5c314ad65492

SHA1
35563f6eb8721fa36de6dab69808223d8d6b70ba

SHA256
a37d40c47379d40e1ee80e228bb9b9b59295b277f5d9a6b06c01aa11999ac9f9

SHA512
b3fc08063cceb8bab7246d22e035aaebb64d07573c59ed02e75814e3087bb04ff6315bc40e9cd82bc458acbe26b63736f03ae6029ec6b08e9384af7df1613885

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
Filesize
52KB

MD5
235bc84d392472c17f6d5c314ad65492

SHA1
35563f6eb8721fa36de6dab69808223d8d6b70ba

SHA256
a37d40c47379d40e1ee80e228bb9b9b59295b277f5d9a6b06c01aa11999ac9f9

SHA512
b3fc08063cceb8bab7246d22e035aaebb64d07573c59ed02e75814e3087bb04ff6315bc40e9cd82bc458acbe26b63736f03ae6029ec6b08e9384af7df1613885

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
Filesize
52KB

MD5
0ff201d599a88e746fc6e07c8234bf6d

SHA1
0bac9c184bd769bfd709b5b4bc2f7702788d845a

SHA256
ec2b1333ebf4d8d4067c7d2f1d94e292055cfdf2d8b01d0df33e8d4f87df8fcf

SHA512
82368216f75f7a7489ea22a392813fe405428f8a215c961c87a3d7600af205b66750f638f086b69f24cacaff63344a17e76e9da079b8261e5a201963a768e59f

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
Filesize
52KB

MD5
84eeb4fd939398218be5a54e88fc8363

SHA1
8387027653b929cb52d0283117f07b62ce9d4337

SHA256
77de35ad4de9d17ff60e4b04cfcc572f3977e0cc0afa5a2951f52ca894839ffe

SHA512
cc1689c2ae39e90ed6e9a83c5ececbf4a757fe7c892c02261da9c5c93cf92c50aeb48e6d230f35455e9a64b95f2e0d7d162c435305fbd55d6f9d231e7fcb1eb3

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
Filesize
52KB

MD5
84eeb4fd939398218be5a54e88fc8363

SHA1
8387027653b929cb52d0283117f07b62ce9d4337

SHA256
77de35ad4de9d17ff60e4b04cfcc572f3977e0cc0afa5a2951f52ca894839ffe

SHA512
cc1689c2ae39e90ed6e9a83c5ececbf4a757fe7c892c02261da9c5c93cf92c50aeb48e6d230f35455e9a64b95f2e0d7d162c435305fbd55d6f9d231e7fcb1eb3

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
Filesize
52KB

MD5
235bc84d392472c17f6d5c314ad65492

SHA1
35563f6eb8721fa36de6dab69808223d8d6b70ba

SHA256
a37d40c47379d40e1ee80e228bb9b9b59295b277f5d9a6b06c01aa11999ac9f9

SHA512
b3fc08063cceb8bab7246d22e035aaebb64d07573c59ed02e75814e3087bb04ff6315bc40e9cd82bc458acbe26b63736f03ae6029ec6b08e9384af7df1613885

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
Filesize
52KB

MD5
235bc84d392472c17f6d5c314ad65492

SHA1
35563f6eb8721fa36de6dab69808223d8d6b70ba

SHA256
a37d40c47379d40e1ee80e228bb9b9b59295b277f5d9a6b06c01aa11999ac9f9

SHA512
b3fc08063cceb8bab7246d22e035aaebb64d07573c59ed02e75814e3087bb04ff6315bc40e9cd82bc458acbe26b63736f03ae6029ec6b08e9384af7df1613885

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
Filesize
52KB

MD5
0ff201d599a88e746fc6e07c8234bf6d

SHA1
0bac9c184bd769bfd709b5b4bc2f7702788d845a

SHA256
ec2b1333ebf4d8d4067c7d2f1d94e292055cfdf2d8b01d0df33e8d4f87df8fcf

SHA512
82368216f75f7a7489ea22a392813fe405428f8a215c961c87a3d7600af205b66750f638f086b69f24cacaff63344a17e76e9da079b8261e5a201963a768e59f

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
Filesize
52KB

MD5
84eeb4fd939398218be5a54e88fc8363

SHA1
8387027653b929cb52d0283117f07b62ce9d4337

SHA256
77de35ad4de9d17ff60e4b04cfcc572f3977e0cc0afa5a2951f52ca894839ffe

SHA512
cc1689c2ae39e90ed6e9a83c5ececbf4a757fe7c892c02261da9c5c93cf92c50aeb48e6d230f35455e9a64b95f2e0d7d162c435305fbd55d6f9d231e7fcb1eb3

Download Submit
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
Filesize
52KB

MD5
0ff201d599a88e746fc6e07c8234bf6d

SHA1
0bac9c184bd769bfd709b5b4bc2f7702788d845a

SHA256
ec2b1333ebf4d8d4067c7d2f1d94e292055cfdf2d8b01d0df33e8d4f87df8fcf

SHA512
82368216f75f7a7489ea22a392813fe405428f8a215c961c87a3d7600af205b66750f638f086b69f24cacaff63344a17e76e9da079b8261e5a201963a768e59f

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
Filesize
52KB

MD5
6563285ffaf2345cd37bda643268807c

SHA1
f772f2668971817be3ba45e9f1d76a0d9dc15e73

SHA256
9d7dc66aece7da4e3d80689a7d5ee0a018056253e531fc344b90272a71a22973

SHA512
7026d7820203c7ca7a5a418644593a747aa25e301dd0b378f701dec11a24ae172fed2aa378b57db12cc1dff2a57be7d8131771da30bc03b947d7f4169536f391

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
Filesize
52KB

MD5
235bc84d392472c17f6d5c314ad65492

SHA1
35563f6eb8721fa36de6dab69808223d8d6b70ba

SHA256
a37d40c47379d40e1ee80e228bb9b9b59295b277f5d9a6b06c01aa11999ac9f9

SHA512
b3fc08063cceb8bab7246d22e035aaebb64d07573c59ed02e75814e3087bb04ff6315bc40e9cd82bc458acbe26b63736f03ae6029ec6b08e9384af7df1613885

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
Filesize
52KB

MD5
a9aef4a3793d04098a1c0cb122c2e9fd

SHA1
026290c82cf03712b774bc0b0682ca1bce2eaad7

SHA256
2fc3bb5af8c07411758c572ecc9080291e2c63ec692158ed7dd6d5aedef53679

SHA512
22b6aabd89ab4df3469fa09b1b83e12db707e359550d00fb94dabb63cc4710d5d7afe3e463e83c037cd62e909c8a09e7eb5cf8141600e9637bf168822e60e4e2

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
Filesize
52KB

MD5
6563285ffaf2345cd37bda643268807c

SHA1
f772f2668971817be3ba45e9f1d76a0d9dc15e73

SHA256
9d7dc66aece7da4e3d80689a7d5ee0a018056253e531fc344b90272a71a22973

SHA512
7026d7820203c7ca7a5a418644593a747aa25e301dd0b378f701dec11a24ae172fed2aa378b57db12cc1dff2a57be7d8131771da30bc03b947d7f4169536f391

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
Filesize
52KB

MD5
6563285ffaf2345cd37bda643268807c

SHA1
f772f2668971817be3ba45e9f1d76a0d9dc15e73

SHA256
9d7dc66aece7da4e3d80689a7d5ee0a018056253e531fc344b90272a71a22973

SHA512
7026d7820203c7ca7a5a418644593a747aa25e301dd0b378f701dec11a24ae172fed2aa378b57db12cc1dff2a57be7d8131771da30bc03b947d7f4169536f391

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
Filesize
52KB

MD5
84eeb4fd939398218be5a54e88fc8363

SHA1
8387027653b929cb52d0283117f07b62ce9d4337

SHA256
77de35ad4de9d17ff60e4b04cfcc572f3977e0cc0afa5a2951f52ca894839ffe

SHA512
cc1689c2ae39e90ed6e9a83c5ececbf4a757fe7c892c02261da9c5c93cf92c50aeb48e6d230f35455e9a64b95f2e0d7d162c435305fbd55d6f9d231e7fcb1eb3

Download Submit
C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
Filesize
52KB

MD5
61f1d84dec4cecf57c65658bae2a13c0

SHA1
a8cfecb3a204fdd3d620a9425745fc30806575d7

SHA256
dd415aea4e5ab99b497f1707c2ef406c28e6b3af5ea58c96990226f541a460ca

SHA512
8bd7af8a2e3d5ed1a1ada369f91c78aa6e80290368c7f44d62336b3abc8bdbea0ffaec5a4f7c0110ffce4be49aebf6441de6b0e0091f551b72842a49b231b344

Download Submit
C:\Windows\MSVBVM60.DLL
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\DamageControl.scr
Filesize
52KB

MD5
566a713a8d256423702d60eaaa035932

SHA1
42c58765c1785801bb50581987e2265fc5aa5aa8

SHA256
603986fef284f649d316aaecb5c02957b877af40b8155150f7d1fef8238a9414

SHA512
287bc164550c811abb079b941e221700d43e739b59dbf275603a1b2a40e3bbc35db4196cabac2c935366f4f4b4a39dc84ff977ade419dfecbf4ce3b372749170

Download Submit
C:\Windows\SysWOW64\DamageControl.scr
Filesize
52KB

MD5
235bc84d392472c17f6d5c314ad65492

SHA1
35563f6eb8721fa36de6dab69808223d8d6b70ba

SHA256
a37d40c47379d40e1ee80e228bb9b9b59295b277f5d9a6b06c01aa11999ac9f9

SHA512
b3fc08063cceb8bab7246d22e035aaebb64d07573c59ed02e75814e3087bb04ff6315bc40e9cd82bc458acbe26b63736f03ae6029ec6b08e9384af7df1613885

Download Submit
C:\Windows\SysWOW64\DamageControl.scr
Filesize
52KB

MD5
f72c4cd9107dad08fd6aa6e1f5ed9c66

SHA1
b441087df555d1e4103b1423522c979f9497a313

SHA256
e4fa174c4187dc2df326387f01b573709fd1003b24e28a0592690653c9e05a36

SHA512
e5392ccb814da948784ca1e7f93a2b85dab3d2d2b3227b6de3e34e5edb5c0e438eab9a80db613646dde2ba71312bac55b73e2ebe900bbac754b7f81a84fe409b

Download Submit
C:\Windows\SysWOW64\DamageControl.scr
Filesize
52KB

MD5
2b127288e3b3396194b033b1d154fb97

SHA1
b08cfe6a4c36556759f7650158ce317cb67d7412

SHA256
712083ce6f6d30db09dcbba7618e56031c7c288fa68dac119a6dd3f2f72552db

SHA512
eab0d4b151e93ae2e9bbcf2b4a9ee2fe16324833307103dd7ce40ed0e83d0bf03f5e19fcb3e1c276754d30d447b91539eff05d239d20fd0b0412859f9f833f09

Download Submit
C:\Windows\SysWOW64\DamageControl.scr
Filesize
52KB

MD5
2b127288e3b3396194b033b1d154fb97

SHA1
b08cfe6a4c36556759f7650158ce317cb67d7412

SHA256
712083ce6f6d30db09dcbba7618e56031c7c288fa68dac119a6dd3f2f72552db

SHA512
eab0d4b151e93ae2e9bbcf2b4a9ee2fe16324833307103dd7ce40ed0e83d0bf03f5e19fcb3e1c276754d30d447b91539eff05d239d20fd0b0412859f9f833f09

Download Submit
C:\Windows\SysWOW64\DamageControl.scr
Filesize
52KB

MD5
84eeb4fd939398218be5a54e88fc8363

SHA1
8387027653b929cb52d0283117f07b62ce9d4337

SHA256
77de35ad4de9d17ff60e4b04cfcc572f3977e0cc0afa5a2951f52ca894839ffe

SHA512
cc1689c2ae39e90ed6e9a83c5ececbf4a757fe7c892c02261da9c5c93cf92c50aeb48e6d230f35455e9a64b95f2e0d7d162c435305fbd55d6f9d231e7fcb1eb3

Download Submit
C:\Windows\SysWOW64\DamageControl.scr
Filesize
52KB

MD5
b5a0427e8cf935366dfbc534b2de352f

SHA1
0d974d93432b6a995813c489ccd08168a7b52080

SHA256
88996fb800af1d567a3676e68eac48e87b7ff1f5cca564a96fc7a05f04139861

SHA512
017a76add9144918f4f62d34d8c0caae317839968c62be90a87bb795b1153a2767386f0572edd29f15b38ae0d4ef9fa4635438955b1f97ca2fd3b2d8ba36227d

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe
Filesize
52KB

MD5
566a713a8d256423702d60eaaa035932

SHA1
42c58765c1785801bb50581987e2265fc5aa5aa8

SHA256
603986fef284f649d316aaecb5c02957b877af40b8155150f7d1fef8238a9414

SHA512
287bc164550c811abb079b941e221700d43e739b59dbf275603a1b2a40e3bbc35db4196cabac2c935366f4f4b4a39dc84ff977ade419dfecbf4ce3b372749170

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe
Filesize
52KB

MD5
235bc84d392472c17f6d5c314ad65492

SHA1
35563f6eb8721fa36de6dab69808223d8d6b70ba

SHA256
a37d40c47379d40e1ee80e228bb9b9b59295b277f5d9a6b06c01aa11999ac9f9

SHA512
b3fc08063cceb8bab7246d22e035aaebb64d07573c59ed02e75814e3087bb04ff6315bc40e9cd82bc458acbe26b63736f03ae6029ec6b08e9384af7df1613885

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe
Filesize
52KB

MD5
3e5609b923ddee2c972013df5a621740

SHA1
c0625ba18913c377c6fb478bd84e142b918b3bf0

SHA256
74f6f9fc63624a01a3b73c530aa8d215af03ae4faa9ee331c2ee233830b87f63

SHA512
6bae79a657ecf94b25bda86b70a5fce1bc69bfff6448d34a6318ee904a2ecd05798a5e995d122590173cd55b48dc913b4a700d4b66bd1a7070968617894b4170

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe
Filesize
52KB

MD5
3e5609b923ddee2c972013df5a621740

SHA1
c0625ba18913c377c6fb478bd84e142b918b3bf0

SHA256
74f6f9fc63624a01a3b73c530aa8d215af03ae4faa9ee331c2ee233830b87f63

SHA512
6bae79a657ecf94b25bda86b70a5fce1bc69bfff6448d34a6318ee904a2ecd05798a5e995d122590173cd55b48dc913b4a700d4b66bd1a7070968617894b4170

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe
Filesize
52KB

MD5
0ff201d599a88e746fc6e07c8234bf6d

SHA1
0bac9c184bd769bfd709b5b4bc2f7702788d845a

SHA256
ec2b1333ebf4d8d4067c7d2f1d94e292055cfdf2d8b01d0df33e8d4f87df8fcf

SHA512
82368216f75f7a7489ea22a392813fe405428f8a215c961c87a3d7600af205b66750f638f086b69f24cacaff63344a17e76e9da079b8261e5a201963a768e59f

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe
Filesize
52KB

MD5
0d636169e02d08155d81c8ad52af3093

SHA1
6100fa4737222a778f25ff7df3a128918519cb19

SHA256
b8dd7698662d4dd6f27145149f246ac828e23c51a4df16b686fd9597308cb8dc

SHA512
f79f5e72d5ed9ddda1a4932373f8d5a947e6e5909612b2e199d8bb52eb4554fa86056a11de8595ad6265e02d6d404b9af7ba883bbb53044279a4dfd118077949

Download Submit
C:\Windows\SysWOW64\JawsOfLife.exe
Filesize
52KB

MD5
fb43b7d12e7182e66e127c95dc5682e9

SHA1
1d95fb8ed88aae4b5ea9a0d18ddb4f885e426bea

SHA256
be23931489d0ce8e5c99100090caa5218a4b5c0a00b606f94406577d68847006

SHA512
36325109d7002af30e804cd5221a2a96a13af6d25ba015c60f9a887ba41dbbed6359957db5284e3f858761e4eb755ef66e3be1ed92bff5edb7df992269c84631

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe
Filesize
52KB

MD5
235bc84d392472c17f6d5c314ad65492

SHA1
35563f6eb8721fa36de6dab69808223d8d6b70ba

SHA256
a37d40c47379d40e1ee80e228bb9b9b59295b277f5d9a6b06c01aa11999ac9f9

SHA512
b3fc08063cceb8bab7246d22e035aaebb64d07573c59ed02e75814e3087bb04ff6315bc40e9cd82bc458acbe26b63736f03ae6029ec6b08e9384af7df1613885

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe
Filesize
52KB

MD5
235bc84d392472c17f6d5c314ad65492

SHA1
35563f6eb8721fa36de6dab69808223d8d6b70ba

SHA256
a37d40c47379d40e1ee80e228bb9b9b59295b277f5d9a6b06c01aa11999ac9f9

SHA512
b3fc08063cceb8bab7246d22e035aaebb64d07573c59ed02e75814e3087bb04ff6315bc40e9cd82bc458acbe26b63736f03ae6029ec6b08e9384af7df1613885

Download Submit
C:\Windows\SysWOW64\WishfulThinking.exe
Filesize
52KB

MD5
235bc84d392472c17f6d5c314ad65492

SHA1
35563f6eb8721fa36de6dab69808223d8d6b70ba

SHA256
a37d40c47379d40e1ee80e228bb9b9b59295b277f5d9a6b06c01aa11999ac9f9

SHA512
b3fc08063cceb8bab7246d22e035aaebb64d07573c59ed02e75814e3087bb04ff6315bc40e9cd82bc458acbe26b63736f03ae6029ec6b08e9384af7df1613885

Download Submit
C:\Windows\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\msvbvm60.dll
Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\nEwb0Rn.exe
Filesize
52KB

MD5
566a713a8d256423702d60eaaa035932

SHA1
42c58765c1785801bb50581987e2265fc5aa5aa8

SHA256
603986fef284f649d316aaecb5c02957b877af40b8155150f7d1fef8238a9414

SHA512
287bc164550c811abb079b941e221700d43e739b59dbf275603a1b2a40e3bbc35db4196cabac2c935366f4f4b4a39dc84ff977ade419dfecbf4ce3b372749170

Download Submit
C:\Windows\nEwb0Rn.exe
Filesize
52KB

MD5
566a713a8d256423702d60eaaa035932

SHA1
42c58765c1785801bb50581987e2265fc5aa5aa8

SHA256
603986fef284f649d316aaecb5c02957b877af40b8155150f7d1fef8238a9414

SHA512
287bc164550c811abb079b941e221700d43e739b59dbf275603a1b2a40e3bbc35db4196cabac2c935366f4f4b4a39dc84ff977ade419dfecbf4ce3b372749170

Download Submit
C:\Windows\nEwb0Rn.exe
Filesize
52KB

MD5
566a713a8d256423702d60eaaa035932

SHA1
42c58765c1785801bb50581987e2265fc5aa5aa8

SHA256
603986fef284f649d316aaecb5c02957b877af40b8155150f7d1fef8238a9414

SHA512
287bc164550c811abb079b941e221700d43e739b59dbf275603a1b2a40e3bbc35db4196cabac2c935366f4f4b4a39dc84ff977ade419dfecbf4ce3b372749170

Download Submit
C:\Windows\nEwb0Rn.exe
Filesize
52KB

MD5
566a713a8d256423702d60eaaa035932

SHA1
42c58765c1785801bb50581987e2265fc5aa5aa8

SHA256
603986fef284f649d316aaecb5c02957b877af40b8155150f7d1fef8238a9414

SHA512
287bc164550c811abb079b941e221700d43e739b59dbf275603a1b2a40e3bbc35db4196cabac2c935366f4f4b4a39dc84ff977ade419dfecbf4ce3b372749170

Download Submit
C:\Windows\nEwb0Rn.exe
Filesize
52KB

MD5
566a713a8d256423702d60eaaa035932

SHA1
42c58765c1785801bb50581987e2265fc5aa5aa8

SHA256
603986fef284f649d316aaecb5c02957b877af40b8155150f7d1fef8238a9414

SHA512
287bc164550c811abb079b941e221700d43e739b59dbf275603a1b2a40e3bbc35db4196cabac2c935366f4f4b4a39dc84ff977ade419dfecbf4ce3b372749170

Download Submit
C:\Windows\nEwb0Rn.exe
Filesize
52KB

MD5
566a713a8d256423702d60eaaa035932

SHA1
42c58765c1785801bb50581987e2265fc5aa5aa8

SHA256
603986fef284f649d316aaecb5c02957b877af40b8155150f7d1fef8238a9414

SHA512
287bc164550c811abb079b941e221700d43e739b59dbf275603a1b2a40e3bbc35db4196cabac2c935366f4f4b4a39dc84ff977ade419dfecbf4ce3b372749170

Download Submit
C:\Windows\nEwb0Rn.exe
Filesize
52KB

MD5
d13c48793edb1ec2f812a005aa8b747c

SHA1
e4e10c18c3b417a7a5eab3295551b8e4c32c8533

SHA256
f88b1af356d8084e940e741c8fd5935d7105826fa59ca5bef5516514904f5670

SHA512
c29ffec2a4b9237b5494e0ed802262f7826d3ebe419c924e3aff1c5e7afc905e8ea18e1f404d25b87093218e5f8c48b130c3e2bff7878dc8328cc1af8f3e02e6

Download Submit
C:\about.htm
Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\about.htm
Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\about.htm
Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\about.htm
Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\about.htm
Filesize
2KB

MD5
94c0c5518c4f4bb044842a006d04932a

SHA1
23d9a914f6681d65e2b1faa171f4cf492562ebdb

SHA256
224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

SHA512
79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

Download Submit
C:\nEwb0Rn.exe
Filesize
52KB

MD5
566a713a8d256423702d60eaaa035932

SHA1
42c58765c1785801bb50581987e2265fc5aa5aa8

SHA256
603986fef284f649d316aaecb5c02957b877af40b8155150f7d1fef8238a9414

SHA512
287bc164550c811abb079b941e221700d43e739b59dbf275603a1b2a40e3bbc35db4196cabac2c935366f4f4b4a39dc84ff977ade419dfecbf4ce3b372749170

Download Submit
C:\nEwb0Rn.exe
Filesize
52KB

MD5
235bc84d392472c17f6d5c314ad65492

SHA1
35563f6eb8721fa36de6dab69808223d8d6b70ba

SHA256
a37d40c47379d40e1ee80e228bb9b9b59295b277f5d9a6b06c01aa11999ac9f9

SHA512
b3fc08063cceb8bab7246d22e035aaebb64d07573c59ed02e75814e3087bb04ff6315bc40e9cd82bc458acbe26b63736f03ae6029ec6b08e9384af7df1613885

Download Submit
C:\nEwb0Rn.exe
Filesize
52KB

MD5
21d4bda6d56b851d7037c686e736e782

SHA1
43c7e6896262e5f76ee67a17952d69e4fedd5101

SHA256
5fb370d4a7e21e332123bc31d2503e1ad8b147538cc8b72e4ca52163bca4b22d

SHA512
3b68382061b8d52f7abf78a7208392528c8de8bc46650c72b4afcf7d61c3117273b8d44756a057c56a0cd5b535178ceb2f34765a0f7c8e2b848056ef8d586253

Download Submit
C:\nEwb0Rn.exe
Filesize
52KB

MD5
21d4bda6d56b851d7037c686e736e782

SHA1
43c7e6896262e5f76ee67a17952d69e4fedd5101

SHA256
5fb370d4a7e21e332123bc31d2503e1ad8b147538cc8b72e4ca52163bca4b22d

SHA512
3b68382061b8d52f7abf78a7208392528c8de8bc46650c72b4afcf7d61c3117273b8d44756a057c56a0cd5b535178ceb2f34765a0f7c8e2b848056ef8d586253

Download Submit
C:\nEwb0Rn.exe
Filesize
52KB

MD5
21d4bda6d56b851d7037c686e736e782

SHA1
43c7e6896262e5f76ee67a17952d69e4fedd5101

SHA256
5fb370d4a7e21e332123bc31d2503e1ad8b147538cc8b72e4ca52163bca4b22d

SHA512
3b68382061b8d52f7abf78a7208392528c8de8bc46650c72b4afcf7d61c3117273b8d44756a057c56a0cd5b535178ceb2f34765a0f7c8e2b848056ef8d586253

Download Submit
C:\nEwb0Rn.exe
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\nEwb0Rn.exe
Filesize
52KB

MD5
509ed61266ce7d17af1fbcf51dcbca7f

SHA1
c6c98d0e12008543d268e2fe7f2076931a55a64a

SHA256
28d67bd17a7df47122eca3eb656c37e07216c82aca5dba2dc2688a31092a9e8c

SHA512
f45f48b025d7ec406fe5293be8c504d3ace22f7f23b4ea6d5a2e119034d6927e0aec212df83333de7b9a59820a6adf740eeadd4599ba50ad57d94f5f2be5d055

Download Submit
memory/532-272-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/532-268-0x0000000000000000-mapping.dmp

Download
memory/996-190-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/996-152-0x0000000000000000-mapping.dmp

Download
memory/996-312-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1296-311-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1296-308-0x0000000000000000-mapping.dmp

Download
memory/1304-203-0x0000000000000000-mapping.dmp

Download
memory/1304-220-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1384-256-0x0000000000000000-mapping.dmp

Download
memory/1384-260-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1396-216-0x0000000000000000-mapping.dmp

Download
memory/1396-233-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1764-261-0x0000000000000000-mapping.dmp

Download
memory/1764-265-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1792-221-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1792-185-0x0000000000000000-mapping.dmp

Download
memory/1888-291-0x0000000000000000-mapping.dmp

Download
memory/2228-257-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2228-250-0x0000000000000000-mapping.dmp

Download
memory/2256-146-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2256-140-0x0000000000000000-mapping.dmp

Download
memory/2256-206-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2380-255-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2380-249-0x0000000000000000-mapping.dmp

Download
memory/2992-300-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2992-295-0x0000000000000000-mapping.dmp

Download
memory/2992-298-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3120-245-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3120-314-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3120-234-0x0000000000000000-mapping.dmp

Download
memory/3176-271-0x0000000000000000-mapping.dmp

Download
memory/3176-277-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3176-282-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3348-264-0x0000000000000000-mapping.dmp

Download
memory/3348-273-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3392-281-0x0000000000000000-mapping.dmp

Download
memory/3392-289-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3468-315-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3468-242-0x0000000000000000-mapping.dmp

Download
memory/3468-248-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3580-284-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3580-278-0x0000000000000000-mapping.dmp

Download
memory/3640-183-0x0000000000000000-mapping.dmp

Download
memory/3640-191-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3640-218-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3644-307-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3644-303-0x0000000000000000-mapping.dmp

Download
memory/3908-239-0x0000000000000000-mapping.dmp

Download
memory/3908-243-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4224-207-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4224-147-0x0000000000000000-mapping.dmp

Download
memory/4224-189-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4548-287-0x0000000000000000-mapping.dmp

Download
memory/4548-292-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4820-304-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4820-299-0x0000000000000000-mapping.dmp

Download
memory/4916-226-0x0000000000000000-mapping.dmp

Download
memory/4916-246-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4916-313-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4932-145-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4932-135-0x0000000000000000-mapping.dmp

Download
memory/4932-205-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4940-132-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4940-275-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4940-283-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download